Top all-time · #674
JFrog
Company blog · jfrog.com/blogsecurityprogramming
JFrog is the company blog at jfrog.com, writing about security and programming. Since 2014, 93 different Hacker News readers have linked it 111 times, most often “Leaked admin access token to Python, PyPI, and PSF GitHub repos”. It is still writing: the last post was on 2026-10-30, and you can follow it by feed.
Rarely recommended · 1 of 40 sampled comments recommend it?
Why HN links it
HN readers mostly link JFrog for Artifactory, its private package registry and mirror, and its docs. Its blog is cited for security research on malicious npm and PyPI packages and leaked tokens.
- Recommended for · 1 comments
- One commenter says the original JFrog blog post has the in-depth analysis that a poor, unoriginal article lacks.
Summarised by Claude from a sample of 40 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
JFrog software supply chain solutions provide an end-to-end pipeline to control your binaries from build to production. Power your software updates to the edge.
Most-linked posts?
- /artifactory/12 people · 12 mentions · first linked 2018-01-06
- Leaked admin access token to Python, PyPI, and PSF GitHub repos6 people · 6 mentions · first linked 2024-07-11
- Service end for Bintray, JCenter, GoCenter, and ChartCenter5 people · 5 mentions · first linked 2021-02-03
- PixelSmash – Critical FFmpeg Vulnerability4 people · 4 mentions · first linked 2026-06-23
- Large-scale NPM attack targets Azure developers with malicious packages4 people · 4 mentions · first linked 2022-03-23
- /confluence/display/RTF/Npm+Registry3 people · 3 mentions · first linked 2018-01-07
- Examining OpenSSH Sandboxing and Privilege Separation – Attack Surface Analysis3 people · 3 mentions · first linked 2023-03-14
- Data Scientists Targeted by Malicious Hugging Face ML Models with Backdoor3 people · 3 mentions · first linked 2024-02-28
- JFrog research discovers coordinated attacks on Docker Hub that planted millions3 people · 3 mentions · first linked 2024-04-30
- Artifactory 3.7 now supports Docker v22 people · 3 mentions · first linked 2015-03-23
What Hacker News says?
jfrog's artifactory has nice support for python https://www.jfrog.com/confluence/display/RTF/PyPI+Repositori...
Comment linking /confluence/display/RTF/PyPI+Repositories
on “GitHub Package Registry”Submitted Malicious PyPI packages stealing credit cards and injecting code as a story · 489 points
HN discussionAs others have stated you could run your own registry or use an alternative service for private repositories, to minimise or eliminate the attack vector. By replicating the images (or packages) that you need into your own account, you can minimise the possibility of a bad actor replacing a well-known image with something untrusted. An alternative is to side-cart a service like Notary ( https://docs.docker.com/notary…
Comment linking /artifactory/
on “Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled”Submitted Service end for Bintray, JCenter, GoCenter, and ChartCenter as a story · 134 points
HN discussion"Maven, ivy and sbt are the go-to tools for having your system download unsigned binary data from the internet and run it on your computer." You should setup a maven repository (Nexus, Artifactory) for your organisation if you want to have more control on binaries. Seems that artifactory can host docker files: https://www.jfrog.com/confluence/display/RTF/Docker+Reposito...
Comment linking /confluence/display/RTF/Docker+Repositories
on “The sad state of sysadmin in the age of containers”Submitted Leaked admin access token to Python, PyPI, and PSF GitHub repos as a story · 114 points
HN discussionSomething like this? https://jfrog.com/artifactory/
Comment linking /artifactory/
on “We all dodged a bullet”Submitted JFrog research discovers coordinated attacks on Docker Hub that planted millions as a story · 47 points
HN discussionWhile it may not be the right time to _start_, incidents like this are an excellent reason to consider an internal read-through proxy package repository. The last couple of organisations I've worked with have used Artifactory: https://jfrog.com/artifactory/
Comment linking /artifactory/
on “Many packages suddenly disappeared”Submitted OpenSSH Pre-Auth Double Free – CVE-2023-25136 – Writeup and Proof-of-Concept as a story · 15 points
HN discussionhttps://jfrog.com/blog/log4shell-0-day-vulnerability-all-you... "If using log4j 2.10.0 or any later version, we recommend disabling message lookups globally by setting the environment variable LOG4J_FORMAT_MSG_NO_LOOKUPS to true by executing this command before Java applications are loaded in one of the system’s init scripts"
Comment linking /blog/log4shell-0-day-vulnerability-all-you-need-to-know/
on “Log4jmemes.com: for those of us that need a laugh”Submitted Watch out for DoS when using Rust’s Hyper package as a story · 12 points
HN discussion> What I don't miss from Ubuntu are the PPA's, I have just looked into the extra sources to see if I have any PPA there but I was surprised to see the only one, which come with a Pop_OS! to bring some custom tiling manager and other tweaks. Frankly, era of PPAs has ended. I don't find many software packages shared on Launchpad nor I won't trust PPA owners to install anything from most of PPAs. There are better ways…
Comment linking /artifactory/
on “I3: Improved Tiling Window Manager”Submitted Fast Remediation Is the New Trust Model (JFrog and OpenAI Zero-Day Findings) as a story · 10 points
HN discussionDoes anyone recommend some pull-through registry to use? Docker Docs has some recommendations [0], but I wonder how feature complete it is. I'd like to find something that: - Can pull and serve private images - Has UI to show a list of downloaded images, and some statistics on how much storage and bandwidth they use - Can run periodic GC to delete unused images - (maybe) Can be set up to pre-download new tags IIRC A…
Comment linking /artifactory/
on “Docker limits unauthenticated pulls to 10/HR/IP from Docker Hub, from March 1”Submitted Large-scale NPM attack targets Azure developers with malicious packages as a story · 9 points
HN discussion> Such as? You can search the web, but as an appetiser here you go: https://jfrog.com/blog/malware-civil-war-malicious-npm-packa... > In what way? Well, you can't bundle GPL licensed software with less restrictive one such as BSD, which is a big deal, that's why BSD and GNU/Linux are so separated in many ways. That's just one problem. It'c clear that all-or-nothing approach doesn't work in free and open source softw…
Comment linking /blog/malware-civil-war-malicious-npm-packages-targeting-malware-authors/
on “Going Dark: The war on encryption is on the rise”Submitted Binary secret scanning prevents serious supply chain attack on Python ecosystem as a story · 5 points
HN discussionNow that alternate registries to crates.io is available, hoping artifactory could add support for rust... - https://www.jfrog.com/jira/browse/RTFACT-13469
Comment linking /jira/browse/RTFACT-13469
on “Rust 1.34.0”Submitted Large-scale NPM attack targets Azure developers with malicious packages as a story · 5 points
HN discussionYea, JFrog announced the May 1st shutdown of Bintray on Feb 3rd: https://jfrog.com/blog/into-the-sunset-bintray-jcenter-gocen... 3 month warning that they'd blow up the ecosystem. I have no idea why a company that builds products for devs would take such an aggressively anti-dev approach to shutting down a core service.
Comment linking /blog/into-the-sunset-bintray-jcenter-gocenter-and-chartcenter/
on “Java Is Underhyped”Submitted PixelSmash – Critical FFmpeg Vulnerability as a story · 3 points
HN discussionI run tens of thousands of docker images in production, or rather, tens of thousands of copies of a few hundred images. If you do something like this, you absolutely MUST have a local registry. Harbor [1], JFrog [2], and Quay [3] would be the first ones that I look at. Harbor is open source, free, and a member of the CNCF. You will need to do a little bit of work to set it up to scale properly. JFrog offers a SaaS r…
Comment linking /confluence/display/JFROG/JFrog+Artifactory
on “Docker to rate limit image pulls”Submitted Data Scientists Targeted by Malicious Hugging Face ML Models with Backdoor as a story · 3 points
HN discussionYes. That is why they thinned things down with the compute module form factors. https://www.raspberrypi.com/for-industry/ https://jfrog.com/connect/post/3-best-industrial-raspberry-p...
Comment linking /connect/post/3-best-industrial-raspberry-pi-solutions-in-2020/
on “Raspberry Pi Pico W: your $6 IoT platform”Submitted Data Scientists Targeted by Malicious Hugging Face ML Model with Silent Backdoor as a story · 3 points
HN discussionOne popular option: https://jfrog.com/artifactory/
Comment linking /artifactory/
on “Ask HN: What is the first thing you implement at a new company?”Submitted SSH protocol flaw – Terrapin Attack CVE-2023-48795: All you need to know as a story · 3 points
HN discussionyes: https://www.jfrog.com/confluence/display/RTF/Npm+Registry
Comment linking /confluence/display/RTF/Npm+Registry
on “Npm operational incident, 6 Jan 2018”Submitted Integer Overflow Enables HTTP Smuggling as a story · 3 points
HN discussion
