Yohane

🖱Web Developer (Programmer & Designer) ◾🛠 Computer Technician ◾ Millenial ◾[CAT/ESP/EN/FR]

[Yohane @MeYohane]

ℹManifiesto:⤵

🔷TODOS mis 💬 TUITS, 🔁 RT, ❤ MG son en el amparo Art. 20 de la CE, punto 1 a).

DERECHO: "A expresar y difundir libremente la opinión"

Pues:

⚀La Democracia y ⚖Justicia EspaÑolas se encuentran pervertidas.

⚁Aplico este aviso a TODAS mis acciones en TW.

[José Vico 🔻🇵🇸🇿🇦 @josevico4]

La trampa de las 40 horas semanales.

Es el horario perfecto para que te creas clase media, aunque no tengas tiempo para nada.
Escuchad esta reflexión

[Yohane @MeYohane]

@MagiHildebrandt Totalment d'acord que el manteniment és essencial.

Però la física és la mateixa per a tots.

* Càlcul fet amb el pes mitjà d'un vehicle (1.500 Kg).

[Yohane @MeYohane]

@miqu3lm0la Et diria de convidar-te a un cafè, però em quedaria massa curt amb un de sol.

Hauries de mirar el tema de tenir un compte a: https://t.co/AP85uaTswu

[Yohane @MeYohane]

@AlejandroCence2 Sólo puedo decir: "la madre que los parió..."

Y aún tienes que escuchar: "pero oye, eres libre..."

[Yohane @MeYohane]

@douglax Engagement bait, evitad hacerle aún más la comba ese es su propósito.

#engagementbait
#humblebrag

[Yohane @MeYohane]

@mbafraaude Pero si parece el hall de un aeropuerto.

[Yohane @MeYohane]

@RubenSanchezTW Es el plan perfecto.

Usuario recurre al cuñado móvil de compañía ajena para llamar a desatención al cliente.

Buenas tardes le atiende Mª Carmen ¿Cómo? ¿Qué incidencia? ¿Pero nos llamado, y habla conmigo? Aquí todo funciona bien, fíjese que des de ayer que ni entran llamadas...

[Yohane @MeYohane]

@soycamarero Cualquiera que tenga dos dedos de frente debería entender lo obvio. En tu casa haz lo que quieras, pero en un local de pública concurrencia hay leyes y normas.

El local que lo permita, que luego no se sorprenda de una visita con sanción del inspector de Sanidad o Policía local.

[Yohane @MeYohane]

@GuillemCalSer Qui compra producte fresc a un supermercat enlloc d'un mercat o botiga especialitzada ha de ser conscient que pagarà la comoditat.

[Yohane @MeYohane]

@traumatogeek Quizás el hecho de estar tan familiarizada con las roturas (óseas, articulares, musculares...) os da la seguridad que en el peor de los casos habrá un "arreglo".

Me pregunto que posición debe ocupar el médico forense.

[Yohane @MeYohane]

@viquirepublica Diners enverinats.

[Yohane @MeYohane]

@_Senda Per repartir bastonades si que hi ha cuartos.

[Yohane @MeYohane]

@NombreFalso1231 Como se nota que el medio también es afín, esas cantidades es mejor trasladarlas a ejemplos de lo que podemos ver diariamente, para apreciar la barbaridad.

6 millones de litros
2.400 piscinas olímpicas

[Evan Luthra @EvanLuthra]

🚨A HACKER GROUP JUST STOLE 4,000 OF GITHUB'S OWN PRIVATE REPOSITORIES.. PUT THEM UP FOR SALE FOR $50,000.. AND THE WAY THEY GOT IN IS THE SCARIEST PART..

They didn't hack GitHub's servers.. They poisoned a VS Code extension.. One GitHub employee installed it.. And the attackers walked through the front door using the employee's own credentials..

The group calls themselves TeamPCP.. They name their malware after the sandworms from Dune.. And they've been running the most sophisticated supply chain attack campaign in cybersecurity history..

Here's how the whole thing unfolded..

In March.. They poisoned Trivy.. One of the most trusted security scanners in the world.. Used by over 10,000 development workflows globally..

They injected credential-stealing malware into Trivy's official GitHub Action.. The malware ran silently BEFORE the security scan.. So every log showed "scan completed successfully" while the malware was stealing AWS keys, SSH credentials, database passwords, and Kubernetes tokens in the background..

It took Aqua Security 5 days to fully remove them..

Using the stolen credentials.. They breached Cisco Systems.. Cloned over 300 private repositories.. Including source code for unreleased AI products.. And repositories belonging to Cisco's customers.. Major banks.. Government agencies.. BPO firms..

In April.. They hit Checkmarx.. Another security vendor.. Poisoned 5 official Docker images in 83 minutes.. The scanner worked perfectly.. It just silently sent all your secrets to the attackers..

That automatically cascaded into Bitwarden.. The password manager.. Their CI/CD system pulled the poisoned Docker image.. And the attackers injected malware into Bitwarden's official CLI package published on npm..

One compromised security scanner poisoned a password manager.. Automatically.. No human involved..

In May.. They hit TanStack.. Libraries downloaded millions of times per week.. 84 malicious package versions across 42 packages..

And here's the terrifying part..

The malware scraped the raw memory of GitHub's build servers.. Extracted authentication tokens.. Used those tokens to bypass two-factor authentication.. And then published the infected packages with completely valid cryptographic signatures..

Every security verification tool on earth said the packages were legitimate.. Because they were signed by the real pipeline.. Using real keys.. The attackers just happened to be inside the pipeline when it signed..

They defeated the entire trust model of modern software supply chains..

The same week they hit the Nx Console VS Code extension.. 2.2 million installations.. The malware specifically targeted Claude Code configurations.. Hunting for AI assistant credentials..

That's a first.. Supply chain malware designed to steal your AI's access keys..

Then on May 19.. They revealed the GitHub breach.. 4,000 internal repositories.. Listed for sale at $50,000.. With a warning.. "If nobody buys it.. We leak everything for free"..

Their malware is self-propagating.. Once it infects one package.. It automatically finds every other package that developer maintains.. Steals the publish tokens.. And infects all of them.. Then those packages infect the next developer.. And the next..

It jumps between npm and PyPI automatically..
The group doesn't even do the extortion themselves.. They sell stolen credentials to ransomware gangs.. One gang used TeamPCP's data to threaten Cisco with leaking FBI and NASA personnel records..

And the scariest part of all..

They didn't break any encryption.. They didn't find any zero-days.. They exploited the fact that the entire software industry blindly trusts its own build tools..

Every security scanner.. Every Docker image.. Every VS Code extension.. Every GitHub Action.. Is a potential weapon if someone poisons it upstream..

And right now.. Nobody can tell the difference between a legitimate build and a compromised one..

Because the compromised ones have valid signatures too.

[Yohane @MeYohane]

@3CatInfo Això és publicitat enganyosa, tocarà canviar el nom per "Llet seva".

[Yohane @MeYohane]

@RRZE4132

[Yohane @MeYohane]

@roberthernando @quironsalud Como tengas alguien ingresado y tengas que comer ahí por necesidad, mejor aprovechas y te vendes un riñón, total tienen el quirófano al lado.

[Jonpetit @Jonpetit_]

Lo mucho que Megumin quiere a Kazuma 🥰

[Yohane @MeYohane]

@EsdeProfugos Cualquiera podría trasladar y llenar un museo invisible con semejante arte, y sólo transportando los certificados de autenticidad.

Pero luego limitan los pagos en efectivo...

[Yohane @MeYohane]

@creepydotorg Obviously she has enough money to don't care how much time to be there.