Discussion
bfung: imo, old news. Those who care about security would’ve seen the news, and those who don’t won’t care. No point in reposting.
mtmail: Looks like the repository URL was marked [dead] for several years, I can't tell why. Best to email the moderator (link in footer).Big security stories often get republished, one might say reviewed and filtered. For this story I seeopensourcemalware.com - https://news.ycombinator.com/item?id=47449498stepsecurity.io - https://news.ycombinator.com/item?id=47451081arstechnica.com - https://news.ycombinator.com/item?id=47464996and 4 others.
kay_o: Looking at https://news.ycombinator.com/from?site=github.com/aquasecuri... around 2024 when the dead started, a spambot ring was repeatedly posting it?
cluckindan: Maybe it was intentionally compromised all along.
fragmede: Oh that's clever. Use the spambot ring to promote the story so that the story gets marked dead because of that! Instead of hiding the news, use the botnet to promote it and use the system against itself.
JoshuaDavid: Trivy (a very widely-used security scanner) was recently compromised. Anyone who installed the aquasecurity/trivy-action dependency by tag rather than by sha during a 3 hour period on March 19 was likely compromised. There is a Github security advisory at https://github.com/aquasecurity/trivy/security/advisories/GH...6 separate people have tried to submit this to HN. All of the submissions are marked as [dead]. I am unsure whether this is a malicious action taken by the actors who compromised trivy or whether it's just the result of prior spam under github.com/aquasecurity, but regardless it is probably not ideal for security advisories to be auto-marked as [dead].
altairprime: [delayed]
tptacek: You should just mail hn@ycombinator.com about this stuff.Or: write a short blog post about it, and post that, on your (different) domain.
gzread: What if their goal is more to raise awareness about HN moderation practices than to fix the problem quickly?It's certainly worked. Lots of people have seen this and now have a slightly worse opinion of HN moderation.
tptacek: Probably offset by the people whose opinion of HN moderation will improve as a result of this. Six of one, &c.
tomhow: Please just email us (hn@ycombinator.com) when something like this happens.Moderators didn't see these submissions or if we did, we didn't know why this project or incident was significant or important.Now we've seen it, we've boosted the first submission of the incident onto the front page, and updated the URL and title to the most up-to-date/complete page about the incident.The reason the submissions were being killed is that the GitHub account's address had been banned on HN due to previously being submitted by spam bots.
tomhow: > raise awareness about HN moderation practicesWhat practices?
