@cljack Yes. And if you're interested in a guy belonging to the second half then you better be able to deal with the first. Nobody said that it's gonna be easy.
‼️🚨 BREAKING: Another researcher skipped coordinated disclosure entirely and dropped a critical 1-click GitHub token theft in public because he doesn't want to deal with MSRC. In his own words: "I really don't want to deal with MSRC on VSCode bugs."
The bug: just clicking a link can hand an attacker a GitHub token that reads AND writes to all your repos, including private ones. It lives in github[.]dev, GitHub's browser-based VSCode editor, which passes the browser an OAuth token that isn't scoped to a single repo. That token can touch everything you can.
Researcher Ammar Askar found that VSCode's sandboxed "webviews" leak keyboard events to the main editor. A malicious repo opened via one link can simulate keystrokes, install a local extension that skips VSCode's publisher-trust check, and exfiltrate your token. He published a working proof-of-concept.
He says when he reports github[.]dev bugs, GitHub tells him they're out of scope and to go report to MSRC, and a prior VSCode bug he reported was silently fixed with no credit. One commenter summed up the mood: "MSRC has turned into Feedback Hub."
@veronikaruut@Zasilkovna@Alzacz@dpd_cz@Allegro_Group "Město by mohlo reagovat na stížnosti obyvatel a řešit konkrétní problematické případy." - Presne o tohle by slo vsem zmrdum, stezovali by se na kazdy box, protoze nesnesou kdyz neco funguje dobre.
@f_kalenda Jakchce usporadat knihkupectvi krt kdyz nemaji jeste ani ty mikrofony a aktivni repraky (a maly mixazni pult na ovladani)? To predpokladaji ze se tam sejde jenom 10 lidi nebo co?
@randomrecruiter Every single company where HR scum has unlimited veto power over a candidate like that is doomed to crash and burn. HR that does this should be fired.