Bradley Ball

@sqlballs.com

Father of 4, Sr. TPM at #Microsoft, Comic Book aficionado, I ❤️ roller coasters. cohost aka.ms/TftF/youtube Opinions are my own. 🧵’s @sqlballs

What did you do on your day off? I found this amazing bakery, and now I’m napping. (The last one is the box of goodies I took home to the fam.

BildBildBildBild

I came home from Fabcon & SQLCon and found my family had bought Andes mint cookie crunch thins. It is mint, chocolate, and Oreo cookies (probably not Oreo because they didn’t license them, but it taste like Oreos) I CANNOT STRESS THIS ENOUGH, THESE ARE ADDICTIVE!! STAY AWAY!!!

BildBild

The problem is bigger than prompts in GHA. Actions might now be the biggest attack vector for OSS. We just had major repos like Trivy get deleted because of workflows using the deadly pull_request_target event. gbhackers.com/hackerbot-cl...

Hackerbot-Claw Bot Exploits GitHub Actions CI/CD Flaw to Attack Microsoft and DataDog

Hackerbot-claw, an autonomous AI bot, has launched a week-long campaign abusing GitHub Actions misconfigurations to hit CI/CD pipelines at Microsoft, DataDog.

gbhackers.com