Lup Yuen Lee 李立源 @lupyuen@qoto.org
- Pronouns/Gender/Sexuality
- He/Him/They, Bisexual/Asexual 🇸🇬
- Date of Birth
- 1969
- Articles
- https://lupyuen.org
IoT Techie and Educator / Apache NuttX PMC
Joined Jan 2020
#Fedora 42 Beta with COSMIC desktop environment
https://www.howtogeek.com/fedora-linux-42-beta-cosmic-release/
Compromised `reviewdog` #GitHubActions "injected Malicious Code into any CI Workflows using it, dumping the CI Runner memory containing the Workflow Secrets"
https://www.wiz.io/blog/new-github-action-supply-chain-attack-reviewdog-action-setup
#Arm64 MMU Page Tables: Deciphering in #NuttX 😬
Source: https://gist.github.com/lupyuen/728b09461f5f4ab32e7e4a80d744ba4d
New #PebbleOS watches: Core Time 2 and Core 2 Duo
https://ericmigi.com/blog/introducing-two-new-pebbleos-watches
Show thread
OpenMV AE3: 2 x Arm Cortex-M55, 2 x Arm Ethos-U55 microNPU
https://www.hackster.io/news/introducing-the-openmv-ae3-and-n6-cameras-e9ce2ee4ab1e
Cheap Yellow Display SPI on #ESP32
https://blog.mark-stevens.co.uk/2025/03/cheap-yellow-display-spi/
Pytest and Pexpect in #NuttX ... Some interesting challenges 🤔
Article: https://lupyuen.org/articles/ci7.html#why-so-difficult
ReCamMaster: "re-capture in-the-wild Videos with novel Camera Trajectories"
"Writing a nonfiction history book with (mostly) #Linux and FOSS" (#LibreOffice Writer)
https://www.dedoimedo.com/computers/history-book-linux-foss-other.html
"Decrypting Encrypted files from Akira Ransomware (Linux/ESXI variant 2024) using a bunch of GPUs"
"Ethics in an Epidemic: AIDS, Morality, and Culture"
WoeMeter by "Lumon Industries" (#ESP32-S3)
Lup Yuen Lee 李立源
boosted
also, many actions have side-effects and/or do not document that they only work on Ubuntu-based (public) runners.
When you have self-hosted runners, disk layout, and the OS, might differ. I use CentOS/Fedora.
I also prevent the use of something like apt or dnf installs, as the OS itself is immutable.
Lup Yuen Lee 李立源
boosted
@lupyuen what concerns me is how this got propagated to others.
GitHub Actions has no security model or vetting process. Best to pin on a sha, as versions can easily be 'recreated' to contain malicious code. I always fork and/or create my own actions.
GitHub Action `tj-actions/changed-files` "used in over 23,000 repositories, has been compromised ... The compromised Action prints CI/CD Secrets in #GitHubActions build logs"
- Pronouns/Gender/Sexuality
- He/Him/They, Bisexual/Asexual 🇸🇬
- Date of Birth
- 1969
- Articles
- https://lupyuen.org
IoT Techie and Educator / Apache NuttX PMC
Joined Jan 2020
