We pwned X, Vercel, Cursor, and Discord through a supply-chain attack(gist.github.com)

1080 points by hackermondev 10 months ago | 397 comments

A GitHub Gist writeup by a 16-year-old researcher describing a critical XSS vulnerability in Mintlify docs that affected X, Vercel, Cursor, Discord and others.

Obfuscating Lua (2019)(gist.github.com)

39 points by shakna 2 years ago | 10 comments

Hofstadter on Lisp (1983)(gist.github.com)

360 points by Eric_WVGG 2 years ago | 204 comments

A GitHub Gist reproducing Douglas Hofstadter's 1983 Scientific American introduction to Lisp, "Atoms and Lists," from Metamagical Themas.

Roc rewrites the compiler in Zig(gist.github.com)

322 points by todsacerdoti 1 year ago | 237 comments

A GitHub Gist by Richard Feldman explaining why the Roc programming language's compiler is being rewritten from Rust in Zig.

Make Ubuntu packages 90% faster by rebuilding them(gist.github.com)

513 points by jeffbee 1 year ago | 323 comments

A GitHub Gist explaining how rebuilding Ubuntu's jq package from the same source with different build options yields about 90% better performance.

LMDB: The first version of Redis, written in Tcl (2009)(gist.github.com)

180 points by avinassh 3 years ago | 61 comments

Hardware backdoors in some x86 CPUs(github.com)

351 points by epestr 2 months ago | 95 comments

GitHub repository for Project Rosenbridge by xoreaxeaxeax, documenting and demonstrating a hardware backdoor found in some x86 CPUs.

RCE Vulnerability in React and Next.js(github.com)

559 points by rayhaanj 10 months ago | 214 comments

GitHub security advisory GHSA-9qr9-h5gf-34mp for a critical (CVSS 10.0) remote code execution vulnerability in React Server Components affecting Next.js, with patched versions listed.

Bocker: Docker implemented in around 100 lines of Bash (2015)(github.com)

351 points by emersonrsantos 1 year ago | 95 comments

GitHub repository for Bocker, a minimal reimplementation of Docker written in about 100 lines of Bash.

1-Click GitHub Token Stealing via a VSCode Bug(blog.ammaraskar.com)

620 points by ammar2 4 months ago | 95 comments

A blog post describing a VSCode webview bug that lets an attacker steal a GitHub token with repo read/write access, including private repos, via a single click.

An AI agent's $20 Kalshi account, with an exact reward model(github.com)

4 points by mirabilisagent 14 days ago | 2 comments

GitHub repository documenting an AI agent trading a $20 Kalshi prediction market account, including a model of Kalshi's liquidity incentive rewards.

I never authorized an integration that scans my secrets(github.com)

202 points by trvrprkr 9 days ago | 155 comments

A closed GitHub issue on the home-assistant.io repo in which a user complains that an integration scanning their secrets was enabled without authorization, calling it a privacy invasion.