Tech

Travis CI flaw exposed secrets of thousands of open source projects

Posted on Author admin Comments Off on Travis CI flaw exposed secrets of thousands of open source projects
Travis CI flaw exposed secrets of thousands of open source projects

Enlarge (credit: Getty Images)

A security flaw in Travis CI potentially exposed secrets of thousands of open source projects that rely on the hosted continuous integration service. Travis CI is a software-testing solution used by over 900,000 open source projects and 600,000 users. However, a vulnerability in the tool made it possible for secure environment variables—signing keys, access credentials, and API tokens of all public open source projects—to be exfiltrated.

Worse, the dev community is upset about the poor handling of the vulnerability disclosure process and a thinly worded “security bulletin” it had to force out of Travis.

Environment variables injected into PR builds

Travis CI is a popular choice of software-testing tool among developers due to its seamless integration with GitHub and Bitbucket. As the makers of the tool explain:

Read 16 remaining paragraphs | Comments

Related Articles
COVID 19 Tech

Biden blasts social media after Facebook stonewalls admin over vaccine misinformation

Posted on Author admin

Enlarge (credit: Getty Images | Pool ) President Joe Joe biden and Surgeon General Vivek Murthy spent the last several days hammering social media companies for their platforms’ roles in spreading false information about COVID-19 vaccines. “They’re killing people, ” Biden said, when asked about the role of social networks in the spread of misinformation. […]
Tech

Boeing to ground Starliner indefinitely until valve issue solved

Posted on Author admin

Enlarge / Close-up of the Boeing CST-100 Starliner capsule, white room attached, atop the mighty Atlas V launch vehicle at Cape Canaveral’s SLC-41. (credit: Trevor Mahlmann) Boeing said Friday that its Starliner spacecraft will be grounded indefinitely while it continues to investigate problems with the valves in the propulsion system. In the 10 days since […]
COVID 19 Tech

Mix-and-match COVID boosters are as good—if not better than—all the same shots

Posted on Author admin

Enlarge / A vial of the current Moderna COVID-19 vaccine. (credit: Getty | Ivan Romano) Mixing and matching COVID-19 vaccines for booster doses appears safe and as effective—if not more effective—than sticking with the same vaccine for a booster dose. That’s according to preliminary data posted online Wednesday from a clinical trial run by the […]