هیچی برگر [﷼]

Oh yeah? Bring back the mustache man I dare u

I was sniffing around trying to learn more about this FOIA (Freedom of Information Act) gumpy I found on the internet. *I didn't find it, someone else found it and sent it to me It's from Bloomberg and (currently) behind a paywall as part of their "FOIA News", or whatever silly name they're calling it to make it interesting. > lists victims (but redacted) > interviews witnesses > big shenanigans > solarwinds was precise in what doing > nicknamed "Lazy Fortnite" by government (???) > victim 1 is v v v important https://assets.bwbx.io/documents/users/iqjWHBFdfxIU/ry9xLM9wJMxA/v0

Yeah, so pretty much this guy is releasing an exploit in solidarity with Nightmare Eclipse guy. He said he notified GitHub about the exploit 60 minutes before releasing this paper. I don't do web stuff, and I'm not a VSCode nerd, so I'm confused by the underlying technologies. If you're a stinky GitHub and VSCode nerd maybe you'll understand. tl;dr click github dev, github dev opens editor, in github dev editor have javascript, javascript does shortcuts automatically. github treats javascript shortcuts as real human input, or something. use javascript shortcut stuff to automatically install vscode extension. the vscode extension steals your data tl;dr tl;dr user clicks 1 link, 1 click steals all data from your github https://blog.ammaraskar.com/github-token-stealing/