Sourcehut account takeover via build logs (XSS in ansi2html) (blog.arusekk.pl)
34 points by arusekk 2 hours ago
JamesCoyne an hour ago
Really commendable work fixing up the upstream python project. I don't think there's anything to be embarrassed about in the timeline.
serhack_ 18 minutes ago
I love sourcehut, and I can't really think anything to replace it. But here's my shot. It's a popular myth that independently from the project size, someone should always take the main stream product in the field than small projects because most of the people would use the main stream product and there's an higher chance that vulnerabilities get already exploited/recognized/fixed. Is that true or not? TL;DR: in the evaluation of such products (sourcehut but even self hosted stuff), should we also take account about the project history and the exposition to threats?
rvz 19 minutes ago
HN hug of death, strikes again.