Embed Notice

HTML Code

<blockquote style="position: relative; padding-left: 55px;"><section><a href="https://infosec.exchange/users/yossarian/statuses/113800124591191644">yossarian (1.3.6.1.4.1.55738) (yossarian@infosec.exchange)'s status on Friday, 10-Jan-2025 05:36:36 JST</a><a href="https://infosec.exchange/@yossarian" title="yossarian@infosec.exchange"><img src="https://gnusocial.jp/avatar/209904-48-20241114162721.webp" width="48" height="48" alt="yossarian (1.3.6.1.4.1.55738)" style="position: absolute; left: 0; top: 0;">yossarian (1.3.6.1.4.1.55738)</a></section><article><p>i'll be speaking at FOSDEM in the Security Devroom about zizmor and GitHub Actions security!</p><p>details here: </p><p><a href="https://fosdem.org/2025/schedule/event/fosdem-2025-6543-hunting-for-github-actions-bugs-with-zizmor/" rel="nofollow noreferrer">https://fosdem.org/2025/schedule/event/fosdem-2025-6543-hunting-for-github-actions-bugs-with-zizmor/</a></p><p><a href="https://infosec.exchange/tags/fosdem" rel="tag">#fosdem</a> <a href="https://infosec.exchange/tags/fosdem2025" rel="tag">#fosdem2025</a></p></article><footer><a rel="bookmark" href="https://gnusocial.jp/conversation/4343831#notice-8493167">In conversation</a><time datetime="2025-01-10T05:36:36+09:00" title="Friday, 10-Jan-2025 05:36:36 JST">about a month ago</time> <span>from <span><a href="https://infosec.exchange/@yossarian/113800124591191644" rel="external" title="Sent from infosec.exchange via ActivityPub">infosec.exchange</a></span></span><a href="https://infosec.exchange/@yossarian/113800124591191644">permalink</a><h4>Attachments</h4><ol><li><label><a rel="external" href="https://gnusocial.jp/attachment/3878090">Much of the world's open source lives on GitHub, and uses GitHub Actions to provide tasks ranging from routine testing to critical build and release processes. As such, the security of GitHub Actions (and the workflows and actions that users develop and consume) is paramount to the security of the world's software.But how secure is GitHub Actions, really? This talk will introduce GitHub Actions' internal building blocks and (mostly implicit) security model, and provide real world examples of security failures and surprising avenues of exploitation that recur in widely used actions and workflows. These examples will be motivated via zizmor , a Rust-based static analysis tool for GitHub Actions that can catch many of the most common (and severe) footguns that occur when writing workflows.Attendees will leave knowing more about GitHub Actions security and best practices for writing secure workflows, as well as how to use zizmor both locally and in Cl to detect potential security issues. No prior familiarity with GitHub Actions is necessary.</a></label><br><a href="https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/800/122/792/026/649/original/d7fbd67287577517.png" rel="external">https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/800/122/792/026/649/original/d7fbd67287577517.png</a></li><li><article><header><div>Domain not in remote thumbnail source whitelist: fosdem.org</div><h5><a href="https://fosdem.org/2025/schedule/event/fosdem-2025-6543-hunting-for-github-actions-bugs-with-zizmor/#fosdem">FOSDEM 2025 - Hunting for GitHub Actions bugs with zizmor</a></h5><div></div></header><div></div><footer></footer></article></li></ol></footer></blockquote>

Corresponding Notice

Embed this notice
yossarian (1.3.6.1.4.1.55738) (yossarian@infosec.exchange)'s status on Friday, 10-Jan-2025 05:36:36 JST yossarian (1.3.6.1.4.1.55738)
i'll be speaking at FOSDEM in the Security Devroom about zizmor and GitHub Actions security!
details here:
https://fosdem.org/2025/schedule/event/fosdem-2025-6543-hunting-for-github-actions-bugs-with-zizmor/
#fosdem #fosdem2025
In conversationabout a month ago from infosec.exchangepermalink
Attachments
1. Much of the world's open source lives on GitHub, and uses GitHub Actions to provide tasks ranging from routine testing to critical build and release processes. As such, the security of GitHub Actions (and the workflows and actions that users develop and consume) is paramount to the security of the world's software. But how secure is GitHub Actions, really? This talk will introduce GitHub Actions' internal building blocks and (mostly implicit) security model, and provide real world examples of security failures and surprising avenues of exploitation that recur in widely used actions and workflows. These examples will be motivated via zizmor , a Rust-based static analysis tool for GitHub Actions that can catch many of the most common (and severe) footguns that occur when writing workflows. Attendees will leave knowing more about GitHub Actions security and best practices for writing secure workflows, as well as how to use zizmor both locally and in Cl to detect potential security issues. No prior familiarity with GitHub Actions is necessary.
  https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/800/122/792/026/649/original/d7fbd67287577517.png
2. Domain not in remote thumbnail source whitelist: fosdem.org
  FOSDEM 2025 - Hunting for GitHub Actions bugs with zizmor

Public

Embed Notice

HTML Code

Corresponding Notice