I don't personally buy that, they offer a package manager in the form of nuget for example, if their products there are compromised, they're well withing normal reach to block THEIR packages, but why would they need to block the rest ?
Maybe I'm missing something dumb
* GitHub [which they own] allowed the contribution to ignore CI
* GitHub [which they own] failed to detect suspicious content on check-in
* GitHub [which they own] isn't sufficiently integrated into Microsoft security that the compromised token wasn't rolled.
> I, like many others love to knock on Microslop when I can, but in this case they did the right thing.
I've no idea what your problem with this sentence is. They have an organisational security problem, aided/demonstrated by lack of effort to effectively lockdown GitHub Actions and allowing MRs to circumvent CI/CD.
That this is a Microsoft problem that was present pre-AI is not up for debate. See https://www.cisa.gov/sites/default/files/2025-03/CSRBReviewO...
In the age of AI, it's now endemic and being weaponised.
No argument from me, but what would you have them do in the immediate timeframe ?
They can publish self-congratulatory stuff like this: https://www.microsoft.com/en-us/security/blog/2026/06/05/sec... but they can't publish a post-mortem on their own platform?
I'm told that when Affirmed got compromised Microsoft Security descended on the org and rewrote their entire backlog. Where is the plan from GitHub that they are now taking security seriously given GitHub Actions is now a primary threat vector even for projects written by their own company.