infosec.place

Conversation

The postmortem of the hack on my Forgejo instance is here! I had fun investigating and writing it, so I hope y’all enjoy reading about it :)

@phillip Hot take: signups should be disabled at install time by default in almost every software.

@phillip very nice writeup, thanks! Reminds me everytime to review my current setup🥶