<story><title>Tell HN: Travis CI is seemingly compromised (once again)</title><text>A number of Travis CI users appear to have had Travis CI tokens revoked by Github in response to suspicious activity surrounding token.&lt;p&gt;Travis themselves have still not issued any notice or acknowledged this incident so it&amp;#x27;s worth letting the community know if they weren&amp;#x27;t already aware.&lt;p&gt;From memory, this will be the second breach in 2022 (&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;blog.aquasec.com&amp;#x2F;travis-ci-security&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;blog.aquasec.com&amp;#x2F;travis-ci-security&lt;/a&gt;) in addition to last year&amp;#x27;s secret exposure (&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;arstechnica.com&amp;#x2F;information-technology&amp;#x2F;2021&amp;#x2F;09&amp;#x2F;travis-ci-flaw-exposed-secrets-for-thousands-of-open-source-projects&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;arstechnica.com&amp;#x2F;information-technology&amp;#x2F;2021&amp;#x2F;09&amp;#x2F;travi...&lt;/a&gt;)&lt;p&gt;---&lt;p&gt;A sampling of users on Twitter who have run into this issue:&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;twitter.com&amp;#x2F;peter_szilagyi&amp;#x2F;status&amp;#x2F;1600593274108055559&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;twitter.com&amp;#x2F;peter_szilagyi&amp;#x2F;status&amp;#x2F;160059327410805555...&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;twitter.com&amp;#x2F;yaqwsx_cz&amp;#x2F;status&amp;#x2F;1600599797118996491&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;twitter.com&amp;#x2F;yaqwsx_cz&amp;#x2F;status&amp;#x2F;1600599797118996491&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;twitter.com&amp;#x2F;samonchain&amp;#x2F;status&amp;#x2F;1600611567606775808&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;twitter.com&amp;#x2F;samonchain&amp;#x2F;status&amp;#x2F;1600611567606775808&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;twitter.com&amp;#x2F;dzarda_cz&amp;#x2F;status&amp;#x2F;1600613369408634886&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;twitter.com&amp;#x2F;dzarda_cz&amp;#x2F;status&amp;#x2F;1600613369408634886&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;twitter.com&amp;#x2F;samonchain&amp;#x2F;status&amp;#x2F;1600611567606775808&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;twitter.com&amp;#x2F;samonchain&amp;#x2F;status&amp;#x2F;1600611567606775808&lt;/a&gt;&lt;p&gt;---&lt;p&gt;An example notice being sent out by Github (in lieu of Travis themselves taking any action):&lt;p&gt;&amp;gt; Hi {username}&lt;p&gt;&amp;gt; We&amp;#x27;re writing to let you know that we observed suspicious activity that suggests a threat actor used a Personal Access Token (PAT) associated with your account to access private repository metadata.&lt;p&gt;&amp;gt; Out of an abundance of caution, we reset your account password and revoked all of your Personal Access Tokens (classic), OAuth App tokens, and GitHub App tokens to protect your account, {username}.</text></story><parent_chain></parent_chain><comment><author>stuaxo</author><text>Not surprising after they got rid of so many devs, reminds me of another company who did that recently, I wonder how long we will have to wait for that to start having issues.</text></comment>
<story><title>Tell HN: Travis CI is seemingly compromised (once again)</title><text>A number of Travis CI users appear to have had Travis CI tokens revoked by Github in response to suspicious activity surrounding token.&lt;p&gt;Travis themselves have still not issued any notice or acknowledged this incident so it&amp;#x27;s worth letting the community know if they weren&amp;#x27;t already aware.&lt;p&gt;From memory, this will be the second breach in 2022 (&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;blog.aquasec.com&amp;#x2F;travis-ci-security&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;blog.aquasec.com&amp;#x2F;travis-ci-security&lt;/a&gt;) in addition to last year&amp;#x27;s secret exposure (&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;arstechnica.com&amp;#x2F;information-technology&amp;#x2F;2021&amp;#x2F;09&amp;#x2F;travis-ci-flaw-exposed-secrets-for-thousands-of-open-source-projects&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;arstechnica.com&amp;#x2F;information-technology&amp;#x2F;2021&amp;#x2F;09&amp;#x2F;travi...&lt;/a&gt;)&lt;p&gt;---&lt;p&gt;A sampling of users on Twitter who have run into this issue:&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;twitter.com&amp;#x2F;peter_szilagyi&amp;#x2F;status&amp;#x2F;1600593274108055559&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;twitter.com&amp;#x2F;peter_szilagyi&amp;#x2F;status&amp;#x2F;160059327410805555...&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;twitter.com&amp;#x2F;yaqwsx_cz&amp;#x2F;status&amp;#x2F;1600599797118996491&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;twitter.com&amp;#x2F;yaqwsx_cz&amp;#x2F;status&amp;#x2F;1600599797118996491&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;twitter.com&amp;#x2F;samonchain&amp;#x2F;status&amp;#x2F;1600611567606775808&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;twitter.com&amp;#x2F;samonchain&amp;#x2F;status&amp;#x2F;1600611567606775808&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;twitter.com&amp;#x2F;dzarda_cz&amp;#x2F;status&amp;#x2F;1600613369408634886&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;twitter.com&amp;#x2F;dzarda_cz&amp;#x2F;status&amp;#x2F;1600613369408634886&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;twitter.com&amp;#x2F;samonchain&amp;#x2F;status&amp;#x2F;1600611567606775808&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;twitter.com&amp;#x2F;samonchain&amp;#x2F;status&amp;#x2F;1600611567606775808&lt;/a&gt;&lt;p&gt;---&lt;p&gt;An example notice being sent out by Github (in lieu of Travis themselves taking any action):&lt;p&gt;&amp;gt; Hi {username}&lt;p&gt;&amp;gt; We&amp;#x27;re writing to let you know that we observed suspicious activity that suggests a threat actor used a Personal Access Token (PAT) associated with your account to access private repository metadata.&lt;p&gt;&amp;gt; Out of an abundance of caution, we reset your account password and revoked all of your Personal Access Tokens (classic), OAuth App tokens, and GitHub App tokens to protect your account, {username}.</text></story><parent_chain></parent_chain><comment><author>piskerpan</author><text>I’m surprised it’s still around. Since GitHub released Actions and Travis abandoned the freemium, there weren’t many reasons to stay</text></comment>