本記事では GitHub Actions で pull_request event の代わりに pull_request_target を用い、 workflow の改竄を防いでより安全に CI を実行する方法について紹介します。 まずは前置きとして背景や解決したいセキュリティ的な課題について説明した後、 pull_request_target を用いた安全な CI の実行について紹介します。 本記事では OSS 開発とは違い業務で private repository を用いて複数人で開発を行うことを前提にします。 長いので要約 GitHub Actions で Workflow の改竄を防ぎたい GitHub の branch protection rule や codeowner, OIDC だけでは不十分なケースもある pull_request event の代わりに pull_r
Designing better target sizes
Intro As a user, you need to interact with clickable UI elements like buttons, links, cards, and more. If an action has a small target size, it will be harder for the user to click, or they might click an adjacent action element by mistake. Let’s take a look at the following example.
PAPERWALL: Chinese Websites Posing as Local News Outlets Target Global Audiences with Pro-Beijing Content - The Citizen Lab
Key Findings A network of at least 123 websites operated from within the People’s Republic of China while posing as local news outlets in 30 countries across Europe, Asia, and Latin America, disseminates pro-Beijing disinformation and ad hominem attacks within much larger volumes of commercial press releases. We name this campaign PAPERWALL. PAPERWALL has similarities with HaiEnergy, an influence
Published 16 Jan, 2024 by Louis Pilfold Gleam is a type safe and scalable language for the Erlang virtual machine and JavaScript runtimes. Today Gleam v0.34.0 has been published. Let’s take a look at what’s new! Multi-target projects Gleam can compile to one of two targets: Erlang or JavaScript. Some packages may only support one of the two targets, possibly because they make use of Erlang feature
Faked images of black voters with Trump are a growing disinformation trend in the US election, the BBC finds.
Application Load Balancer increases application availability with Automatic Target Weights
Application Load Balancer (ALB) now supports Automatic Target Weights (ATW), which uses a new routing algorithm to optimize the amount of traffic sent to each target based on information available to the load balancer. With this initial launch, ALB will adjust the amount of traffic sent to each target based on implicit health information, like 5XX errors and connection errors. Before this launch,
Malicious npm Packages Used to Target GitHub Developer SSH Keys
Malicious npm Packages Used to Target GitHub Developer SSH Keys Security researchers have uncovered two new malicious packages on the npm open source package manager that utilized GitHub to store stolen Base64-encrypted SSH keys taken from developer systems. These packages, identified earlier this month, have since been removed from npm. According to a ReversingLabs report published today, this di
こんにちは、スマートバンクでアプリエンジニアをしているロクネムです。 みなさんはiOSアプリの開発を行う上で、ボタン等のタッチ可能なコンポーネントの”Touch Targetのサイズ”を意識していますか？ 小さすぎるTouch Targetは、指で操作するiOSアプリにおいてユーザーのアクセシビリティを低下させてしまいます。 Human Interface Guidelinesにおいても、タッチ可能な領域を最低でも44 x 44pt以上は確保するように記されています。 この記事では、SwiftUIでiOSアプリを開発する上で、どのように十分なTouch Targetを確保するかについて、弊社の開発しているB/43という家計簿プリカアプリを例にご紹介します。 Button テキスト内のリンク TextField まとめ Button まずは1番わかりやすいButtonにおけるTouch Ta
A Mexican Drug Cartel’s New Target? Seniors and Their Timeshares
The operation is relatively simple. Cartel employees posing as sales representatives call up timeshare owners, offering to buy their investments back for generous sums. They then demand upfront fees for anything from listing advertisements to paying government fines. The representatives persuade their victims to wire large amounts of money to Mexico — sometimes as much as hundreds of thousands of
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
pull_request_target で GitHub Actions の改竄を防ぐ
'We were told to target foreigners': Ex-officer on systematic racial profiling by Japan police - The Mainichi
Multi-target projects – Gleam
Trump supporters target black voters with faked AI images
SwiftUIでTouch Targetのサイズを意識する - inSmartBank
AIDB on X: "Microsoftなどの研究者らが、プロンプト圧縮技術『LLMLingua-"2"』を公開し、タスクの精度を維持したまま圧縮率2-5倍を達成したと報告しています。 さらにプロンプトが圧縮されることにより、回答速度が倍速になるとのこと。 "LLMLingua-2: Learn Compression Target via Data Distillation for… https://t.co/4bEsVp3pfp"