my job?

[yossarian@infosec.exchange]

my job? wasting an absolutely ungodly amount of GitHub's free compute

[yossarian@infosec.exchange]

my list got cut off

[caspicat@infosec.exchange]

@yossarian btw have you seen this? Old news, but not sure if this was widely discussed. TL;DR You can't trust GitHub runner images

https://www.stepsecurity.io/blog/how-stepsecurity-harden-runner-detected-unexpected-microsoft-defender-installation-on-github-hosted-ubuntu-runners

No SBOMs released for affected images during that window
https://github.com/actions/runner-images/releases

[yossarian@infosec.exchange]

@caspicat I actually hadn't seen this, but I'm not sure how it makes GH's own runners untrustworthy? it's definitely a (bad) operational error, but AFAICT it doesn't change the platform's security posture significantly