Angelo DeLuca

software (reverse) engineer, research engineer @kududyn

[Angelo DeLuca @AngDeLuca]

@niieani Of course, but what particularly raised my eyebrow is all of the internal repository/knowledegebase URLs in comments.

[Angelo DeLuca @AngDeLuca]

someone at GitHub forgot to disable sourcemaps 💀

[typed-sigterm @typed_sigterm]

@AngDeLuca by design - replied by @github

[Angelo DeLuca @AngDeLuca]

@typed_sigterm @github Wild.

[Angelo DeLuca @AngDeLuca]

@OfficiallyMelon https://t.co/LJsALRNAiL

[Angelo DeLuca @AngDeLuca]

@imsingee Even if this is intentional, it’s still not great security hygiene. There’s plenty of documentation, internal URLs, and probably enough implementation detail to make phishing easier.

[Angelo DeLuca @AngDeLuca]

@say_menn I never implied it was amazing, only odd/funny. FWIW, there are also internal URLs throughout the code.

Hopefully you have a better day tomorrow. 🙏

[Angelo DeLuca @AngDeLuca]

@OfficiallyMelon Nobody in that thread is a GitHub employee.

[Angelo DeLuca @AngDeLuca]

@victorbayas https://t.co/hZwP0bTiTY

[Angelo DeLuca @AngDeLuca]

@rub_nogueira Given that it’s super easy to accidentally include sourcemaps in production and that the code includes internal URLs, I think it’s fair to assume that it likely wasn’t intentional.

[Angelo DeLuca @AngDeLuca]

@quadulator

[Angelo DeLuca @AngDeLuca]

@rub_nogueira Given that it’s super easy to accidentally include sourcemaps in production and that the code includes internal URLs, I think it’s fair to assume that it likely wasn’t intentional.

[Angelo DeLuca @AngDeLuca]

@OfficiallyMelon Where has GitHub confirmed it?

[Angelo DeLuca @AngDeLuca]

@imsingee Even if this is intentional, it’s still not great security hygiene. There’s plenty of documentation, internal URLs, and probably enough implementation detail to make phishing easier.

[Angelo DeLuca @AngDeLuca]

@neogoose_btw https://t.co/1ZsoqXmhAL

[Angelo DeLuca @AngDeLuca]

https://t.co/2ap62LIe7q

[Angelo DeLuca @AngDeLuca]

https://t.co/2ap62LIe7q

[Angelo DeLuca @AngDeLuca]

Their internal knowledgebase is apparently at https://t.co/paaUT9xz2b

[Angelo DeLuca @AngDeLuca]

@imsingee I came across that same thread. Nobody in it is a GitHub employee from what I can tell.

[Angelo DeLuca @AngDeLuca]

@bomberfish77 Turn off your internet while the app is launching. Keep it off for around 30 seconds afterward, and then turn it back on.

[Angelo DeLuca @AngDeLuca]

@neogoose_btw Berkeley Mono spotted 🔥🔥🔥

[Angelo DeLuca @AngDeLuca]

do these OF promo accounts use real people to do the advertising? 💀

[Angelo DeLuca @AngDeLuca]

@crvvdev iirc warbird gets applied to notepad