Top all-time · #18302
Marcus Young
Personal blog · marcyoung.us/postprogrammingsecurity
Marcus Young writes Mark Young, a personal blog at marcyoung.us about programming and security. Since 2018, 4 different Hacker News readers have linked it 5 times, most often “Zuckerpunch – Abusing Self Hosted GitHub Runners at Facebook”. It is still writing: the last post was on 2025-03-06, and you can follow it by feed.
Too few sampled comments (1) to say how often HN recommends it.?
Why HN links it
One commenter links the 'zuckerpunch' post, which covers the security risk of self-hosted CI runners executing pull requests, and cites Facebook's PyTorch repo as a similar case.
Summarised by Claude from a sample of 1 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
I recently set up paperless-ngx and wanted an easy way to simply email myself receipts or documents and get them uploaded and tagged.
Most-linked posts?
- Zuckerpunch – Abusing Self Hosted GitHub Runners at Facebook2 people · 2 mentions · first linked 2022-09-06
What Hacker News says?
https://marcyoung.us/post/zuckerpunch/ Facebook had this exact problem recently with the pytorch repo. Their self hosted CI runners would run on all PRs, and it could leak all sorts of stuff.
Comment linking /post/zuckerpunch/
on “Fast CI with MicroVMs”Submitted Zuckerpunch – Abusing Self Hosted GitHub Runners at Facebook as a story · 4 points
HN discussionSubmitted Let’s Rethink Jenkins as a story · 4 points
HN discussionSubmitted Hulk-Smash Production – Marcus Young as a story · 1 points
HN discussionSubmitted A Physical Deploy-Production Button – Marcus Young as a story · 1 points
HN discussion