• 9 Posts
  • 733 Comments
Joined 3 years ago
cake
Cake day: July 7th, 2023

help-circle






  • reposting the tl;dr I wrote from another community…

    Yesterday, for about 1h30min (starting at 5:57pm ET / 21:57 UTC) anyone installing the latest version of the command line interface of bitwarden was installing malware.

    The malware steals GitHub/npm tokens, .ssh, .env, shell history, GitHub Actions and cloud secrets, then exfiltrates the data to private domains and as GitHub commits and doesn’t seem to be targeting Bitwarden specifically, or user vaults.

    There’s no evidence that end user vault data was accessed or at risk, or that production data or production systems were compromised, according to their official statement.

    It seems there were 334 bitwarden CLI downloads in this time period, some or many of which might have been from bots, so this is a higher bound to the number of affected users.







  • as someone who only writes frontend now and then, I agree, and I don’t know how react devs find anything in their projects with the horizontal organization. I work regularly on a small one like that and it’s already a pain every time I have to backtrack where this component I’m looking at is defined.

    I have the same strong feeling about how most distros and OSes have Projects/ Documents/ Videos/ Images/ etc in the home directory: this lazy “organization” is totally useless. The first thing I do on a fresh image is to get rid of these directories.

    They’re all grouped by what they are instead of what project / domain they belong to, so finding anything is very inconvenient. My file explorer can help grouping files by type automatically, but it won’t know what is their intent.