Hacker News Reader

itsmrwaveon Ask HN: How do you keep track of node packages/ruby gems security issues?

For gems I use `bundler-audit`, see: https://github.com/rubysec/bundler-audit

It checks for vulnerable versions of gems in `Gemfile.lock`, checks for insecure gem sources, allows ignoring certain advisories that have been manually worked around, prints advisory information and does not require a network connection.

itsmrwaveon Why Baidu Has Been Hijacked to Attack GitHub

I think I spoke too soon ... latest update:

"19:23 UTC The on-going DDoS attack now includes GitHub Pages. We are working to mitigate any service disruption."

https://status.github.com/messages

itsmrwaveon Why Baidu Has Been Hijacked to Attack GitHub

In hindsight, GitHub moving away from GitHub Pages from the github.com domain to github.io makes this whole situation less severe. Imagine all the GitHub-Pages-powered sites that would have been down at the moment.

https://github.com/blog/1452-new-github-pages-domain-github-...

Obviously the link above might not work at the moment.