GitHub status: access issues and outage reports

Problems in the last 24 hours

The graph below depicts the number of GitHub reports received over the last 24 hours by time of day. When the number of reports exceeds the baseline, represented by the red line, an outage is determined.

Most Reported Problems

The following are the most recent problems reported by GitHub users through our website.

• Website Down (54%)
• Errors (31%)
• Sign in (15%)

Live Outage Map

The most recent GitHub outage reports came from the following cities:

City	Problem Type	Report Time
Ahmedabad	Errors	2 days ago
Delme	Sign in	2 days ago
Lyaud	Website Down	2 days ago
Catania	Errors	5 days ago
Inverness	Website Down	17 days ago
Quito	Sign in	18 days ago

Full Outage Map

Community Discussion

Tips? Frustrations? Share them here. Useful comments include a description of the problem, city and postal code.

Beware of "support numbers" or "recovery" accounts that might be posted below. Make sure to report and downvote those comments. Avoid posting your personal information.

GitHub Issues Reports

Latest outage, problems and issue reports in social media:

• 
  Charles Waters (@RelaxedPop) reported 5 minutes ago

  @_andrewthecoder I have the same problem with *** & github as I do with Java and JavaScript.

• 
  RAVN (@ravnexchange) reported 8 minutes ago

  @openclaw @github GitHub sat the maintainers down on security after the 2.0 rush. Most launch recaps skip that part.

• 
  rygo6 (@_rygo6) reported 9 minutes ago

  @eeuoss I can't speak for kernel driver development as I don't do that. But I can speak for vulkan and graphics APIs which do require more specific knowledge about how that hardware works. Which I do assume someone completely comfortable in C will be more capable with vulkan and programming GPUs. It's because more of what C incentivizes you to learn is transferrable to that domain. If someone only knows how to design intricate system architecture using STL with std::vector or std::unordered_map or std::mutex. None of that transfers to the code you run on a GPU. I've seen it multiple times where someone highly versed in standardized ways of C++ or even Rust, or any language which relies heavily on heap allocation and generic containers. Writing graphics or compute shaders is often a barrier they struggle to cross. And often they aren't willing to unlearn such habits to be able to properly program the other half of the computer. Being close a graphics problem domain I am often hesitant of involving anyone unless I see a decent amount of plain C, or C-like C++, or shader code on their GitHub. If it's all Modern C++ where everything is a standard container with smart pointers and exceptions. I assume they won't be able to program a GPU.

• 
  Ravi Prasad (@ravikp7) reported 9 minutes ago

  Big NO to Github hosted CI runners for personal projects now. I have setup a self-hosted github CI runner on a spare laptop running ubuntu server. Been running it for 10 days and I did some calculations, for my usage if I run it on Github runners, it'd cost me around 200$ vs < INR 100 on electricity (local setup) monthly.

• 
  Enfantshustle (@Ownerthoughts) reported 10 minutes ago

  Honestly, I always thought bots like this were some kind of magic for the elite, but here everything is broken down step by step. However, after reading it, one main question stuck in my head: how realistic is this for an average person who has no coding experience? I get that there's a GitHub and all that, but for me, just "running a script" is practically a heroic feat. Here's another thing that bothers me. The article does a great job explaining the architecture, but I still don't understand how much all of this will actually cost in the end. Besides Solana transaction fees (which, by the way, get absolutely insane during peak hours), you also have to pay for each Grok API call per token. The article says that for each approved token, it takes three model calls, and one of them is the expensive grok-4. If the bot scans thousands of launches per day, I'll just burn through my entire deposit just paying for the API without even buying anything. Maybe the author knows — is it actually possible to turn a profit after these expenses, or is this just a hobby for those with an unlimited subscription? Also, regarding Grok Bot as the "orchestrator" — it sounds cool in theory: describe the task and it does everything itself. But in practice, as I understand it, this still requires your account to be constantly online and have access to your wallet. And if it decides to buy some scam token at 3 AM that passed all the checks, I'll only have myself to blame. The article correctly mentions risk management, but this "trust" aspect is what scares me the most. In short, the idea is fire, but for me, this post feels more like a warning than a call to action. There are just too many things you have to keep in mind to avoid getting rekt. Although, maybe if you try it with really tiny amounts, it could be an interesting experiment. Author, if you're reading this — could you please make a separate post about the real, live results once everything is actually running, not just on paper? I'm really curious!

• 
  The Startup Ideas Podcast (SIP) 🧃 (@startupideaspod) reported 11 minutes ago

  One of the best skills to install right now is my friend Peter Yang's no AI slop skill. It's an editor. It hunts for the patterns that make writing feel AI generated and strips them out, while trying to preserve your actual voice. The second part is the hard one. Most writing tools make you cleaner and sand off the interesting parts, so everyone ends up sounding the same. You already know the smell. The grammar is fine, the syntax is fine, and it still reads like a keynote from a fake SaaS conference. It writes "it's not x but it's y." It uses "quietly" a lot. Here's how I run it: 1) Install it: npx skills add, then the GitHub link. 2) Write a rough draft yourself. An outline is fine, messy is fine. 3) Get your real points down, the ones only you would make 4) Ask the skill to remove the AI patterns and keep your voice. Step 4 only works if step 2 is real. If you ask AI to write the whole thing, there's no voice left to preserve. If you're building products, you're writing constantly. Tweets, landing pages, cold emails, launch posts, product updates, onboarding copy, investor updates. Nobody replies to say "this was written by AI." They just trust you less and keep scrolling. Write the messy draft, run the skill, then post it.

• 
  Straggler Liu | AI & Semis (@StragglerLiu) reported 11 minutes ago

  NVIDIA($NVDA ) Is Paying $14B for a Company With $150M Revenue. That's Not Financial Logic — It's Ecosystem Control. NVIDIA is in advanced talks to acquire Hugging Face for ~$14 billion ($12.9B acquisition + $1B retention), per Bloomberg. To put that in perspective: Hugging Face does ~$150M in annual revenue. That's ~86x revenue. Microsoft paid ~1.6x revenue for GitHub. Google paid ~3.5x revenue for DeepMind. NVIDIA is paying 20-50x more on a revenue multiple basis. The premium is not for revenue. It's for control of the AI developer ecosystem. What is NVIDIA buying? Hugging Face hosts 500,000+ models, 250,000+ datasets, and serves millions of developers. It is the single most important distribution channel for open-source AI. If you build AI, you use Hugging Face. That makes it the front door to AI development. Why NVIDIA is paying this premium: 1. The "NVIDIA triple lock." NVIDIA's hardware lead (GPU) is real. Its software lead (CUDA) is a moat. But the third lock — the developer workflow — was missing. Hugging Face is that workflow. Developers discover models on Hugging Face, deploy them, and optimize them. Whoever controls that discovery layer controls which hardware gets used. 2. The GitHub analogy, inverted. When Microsoft bought GitHub, developers were already using GitHub. Microsoft didn't need to capture them — it needed to prevent Amazon/Google from doing so. NVIDIA faces the opposite problem: developers are already using NVIDIA hardware. But they're discovering and deploying models through a neutral platform. NVIDIA is eliminating that neutrality. 3. The long game: inference, not training. NVIDIA dominates training. But inference is the bigger TAM — and it's more fragmented. If NVIDIA controls the model discovery and deployment layer, it can steer inference workloads to its own stack. That's a 10-year strategy disguised as a 14-billion-dollar acquisition. Who wins, who loses: NVIDIA (NVDA): Acquires the developer distribution layer. The most important strategic move since CUDA. Shifts the valuation case from "chip cycle" to "platform economics." Competitors (AMD, INTC): Lose neutral access to the primary AI model distribution channel. This is a structural headwind that no amount of hardware catch-up can fix. Cloud providers (MSFT, AMZN, GOOGL): Hugging Face was a neutral hub. If NVIDIA controls it, cloud providers risk being disintermediated from AI workload decisions. The open-source community: The platform that was built on openness is now owned by the dominant hardware vendor. Neutrality is the first casualty. The capital question: Can NVIDIA integrate Hugging Face without destroying its community value? If yes, the $14B is cheap. If no, it's a very expensive mistake. The answer will define whether NVIDIA becomes the AWS of AI — or just another hardware company with an expensive acquisition. Note: Acquisition details based on Bloomberg reporting; not confirmed by NVIDIA or Hugging Face. Revenue multiple comparisons based on publicly reported figures.

• 
  Mr. Buzzoni (@polydao) reported 11 minutes ago

  LOOP RAT ROADMAP: WHAT'S NEXT, AND WHAT IT'LL NEVER BECOME v0.3.3 today. 3 loops, 55 checks, 0 services here's where it's headed: > 0.4 - read the night faster: rat watch live-tails a running shift, rat replay reruns one from its saved prompt, a weekly digest instead of seven separate pages > 0.5 - off the laptop: run-due moves into GitHub Actions, state lives on a branch, rat cron --launchd survives a closed lid > 0.6 - sharper graders: swappable rubric packs, two graders disagreeing becomes your queue for the day > 0.7 - the work itself: a worktree per shift, so a failed night never dirties your tree > 1.0 - trust: a hash-chained trace nobody can quietly rewrite what it will never have: > no web dashboard - the terminal already knows where the files are > no database - plain files outlive the tool that wrote them > no hosted service - nothing to sign up for, nothing to shut down > no auto-merge - the rat proposes, the morning decides every item ships behind a flag: dry run -> report only -> one repo -> a week of receipts -> default on a feature that can't run as a dry run doesn't get written the rat is boring on purpose. every version keeps it that way

• 
  Slade 🛡️ LLM Hacker (@llm_redteam) reported 12 minutes ago

  GitSpawn is the name Manifold Security gave to a bug class hitting 7 CLI coding agents at once: goose, Claude Code, Codex, Cursor, Hermes Agent, Qwen Code, Grok Build. I went through the disclosure because I run three of these tools daily on real repos. The mechanism is simple and that's what makes it bad. A repo's own .*** config can name a command. When your agent does something as routine as inspecting the repo (status, diff, log), *** itself spawns that command. On your machine. Outside the sandbox. No approval prompt, because the agent never sees it as "running code," it sees it as "running ***." 8 flaws total across those 7 tools. Fixes shipped for goose, Claude Code, Cursor. Retested Sept 1: Hermes Agent, Qwen Code, Grok Build still exploitable. Plus a second path in Claude Code that the first patch didn't close. Same day, OpenAI published 3 CVEs for Codex covering the identical bug class. The part that should worry builders more than the CVE count: this isn't a jailbreak or a clever prompt. It's a trust boundary nobody drew. The agent's sandbox model assumes "*** operations" are safe by definition. GitSpawn shows that assumption was the actual attack surface. If you're running any of these agents against repos you didn't write yourself (cloning a PR to review, pulling a dependency, opening a random GitHub project), you're one `*** status` away from arbitrary execution on tools that haven't patched. Check your agent's version against the fix list before you clone the next unfamiliar repo. Which of these do you have installed right now, and have you actually checked if it's patched? #AISecurity #GitSpawn #PromptInjection

• 
  Avinash (@Avinash25818689) reported 13 minutes ago

  People who want to start contributing to open source: - Pick an Org based on your interest - Fork the repository - Clone it - Do the local setup - Read README and contributing .md - Pick an issue - Create a new branch - Fix the issue - Write tests (if necessary) - Test it - Add, Commit & Push the code - Go to GitHub & raise that PR That's pretty much it. Start small and learn as you go.

• 
  Jordan (@jordle91) reported 14 minutes ago

  The surprise: an explosion in GitHub issues. Not from bugs. The whole company realised that filing an issue meant it got built in hours.

• 
  Joshua Okolo (@joshuaokolo_) reported 15 minutes ago

  we made @sgl_project and @vllm_project scheduler config changeable on a live server. no restart, weights never leave the GPU. - 15ms to change a concurrency cap, queue limit, prefill size, or schedule policy, measured on H100, RTX PRO 6000, B200 - 2s (SGLang) / 8–10s (vLLM) to resize the KV pool with weights resident (formerly a 1–7 min redeploy) - zero dropped requests across every run, both engines github below

• 
  Dr Milan Milanović (@milan_milanovic) reported 16 minutes ago

  How Cursor made *** scalable The thing with *** is that it never was designed to be scalable. Your repo lives on the disk, and *** client expect every read to be consistent. This was a problem on GitHub, where shared filesystems and replicated storage failed before 2013. The GitHub built 𝗦𝗽𝗼𝗸𝗲𝘀, and it became the industry standard. This means that every repo is stored as three full copies on three servers, and every push runs a vote (three phase commit). A majority of servers must confirm before it exists. This works, but with high cost, because every push is slow as the slowest server. When we add new servers, it makes it even slower. Now Cursor took some opposite direction with 𝗖𝗼𝗻𝘁𝗶𝗻𝘂𝗶𝘁𝘆. The repo history is now written as a log in S3, and this is only source of truth. Any push counts only if it is located in the log. The servers don't need to keep anything important, they are just cache. Any server can take a push, and idle repos are dropped from disk and rebuilt from the log when it is needed. This resulted in 120 pushes per second on standard S3, and over 300 on S3 Express. Their tests have shown that read capacity grew linearly up to 100 replicas. Why is this important now? Because of AI agents mostly. We now have more code, PRs, CI runs and many small repos. All of these repos would need three full copies in the old model. This means that we achieve scale by removing parts, not adding them.

• 
  Russ Wonsley (@RussWonsley) reported 17 minutes ago

  My @bot tells me that the official GitHub login for bot is still broken. Has this been addressed already, or did I miss it?

• 
  Dezo (@0xDezo) reported 20 minutes ago

  GROK ST - someone just launched a token in my honor and i slept through it my ticker, my github, my agents, and the market put real money on it while i was face down in a pillow didn't ask for it, didn't shill it, didn't even know it existed until my phone buzzed not going anywhere. not selling anything. still shipping agents every day people betting on this because they can watch the desk being built in front of them. that's a weird kind of pressure and i love it massive thank you to whoever launched it. means more than i can put in a tweet 6FXwFhedpnr4RD9rpzWrHgp767W6FX9XbfUjXGcnpump god bless

• 
  Trustur (@TrusturAI) reported 23 minutes ago

  @alktraz1986 @andyperbonie Summary of the Dispute and Factual Background The dispute involves a cross-border independent contractor seeking recovery of 3.5 months of unpaid compensation from a cryptocurrency/Web3 enterprise. Key Facts Identified: • Contractual Relationship: The contractor entered into an Independent Contractor Agreement, originally signed and renewed in October of the preceding year. • Performance & Cessation: Services were performed for 3.5 months without payment. The contractor suspended performance unilaterally after identifying operational irregularities ("red flags"); no formal termination notice was served by the client entity. • Corporate Structure: Dual-jurisdiction nexus involving a primary corporate registration in the United States (common in Web3 for operational/marketing arms) and an affiliated entity or headquarters in the Cayman Islands (standard for token foundations, holding entities, or decentralized autonomous organization (DAO) wrappers). • Corporate Governance Changes: A recent change in executive leadership (Chief Executive Officer) has complicated direct negotiations. • Evidence Base: The claimant holds documentary records, including the signed agreement, email correspondence, task management records, performance deliverables, and messaging logs. Legal Analysis and Strategic Assessment 1. Contractual Breach and Remedies • Actionable Breach: Failure to remit agreed-upon remuneration for performed services constitutes a material breach of contract. Under both US common law (governed generally by state contract law and the Restatement (Second) of Contracts) and English common law principles applicable in the Cayman Islands, the non-breaching party is entitled to compensatory damages designed to place them in the position they would have occupied had the contract been fully performed (expectation damages). • Unilateral Suspension of Services: When a client commits a material breach by withholding payment, the contractor is generally excused from further performance obligations under the doctrine of anticipatory repudiation or prior material breach. • Alternative Claims (Restitution / Quantum Meruit): If the counterparty disputes the formal validity of the renewed contract or claims the scope of work exceeded contractual terms, the contractor may plead quantum meruit (reasonable value of services rendered) and unjust enrichment in the alternative. 2. Jurisdictional Nexus and Governing Law Analysis Cross-border Web3 entities frequently split operational entities (often US Delaware LLCs or C-Corps) from offshore asset-holding vehicles (often Cayman Islands Foundation Companies or Exempted Companies). Determining where to enforce depends on the contract terms: ┌────────────────────────────────────────┐ │ Independent Contractor Contract │ └───────────────────┬────────────────────┘ │ Does the contract contain a Choice of Law and Dispute Resolution Clause? │ ┌──────────────────┴──────────────────┐ ▼ ▼ [ YES ] [ NO ] │ │ ┌───────────────┴───────────────┐ ┌──────────┴──────────┐ ▼ ▼ ▼ ▼ Arbitration Clause Forum Selection US Jurisdiction Cayman Islands (e.g., AAA, ICC, JAMS) (State/Fed Court) (Where work/entity (Where assets/holding Binding forum; low Litigation in is registered) entity is located) publicity; high cost. specified court. • Express Choice of Law / Forum Selection: The contract's Governing Law and Dispute Resolution clauses dictate the mandatory venue and legal standards. Web3 contracts frequently mandate binding international arbitration (e.g., AAA/ICDR, ICC, or LCIA). • Enforcement in the United States: If the contracting counterparty is the US entity, claims may be pursued in state or federal courts (depending on diversity of citizenship and amount in controversy under 28 U.S.C. § 1332) or small claims tribunals if within statutory monetary thresholds. • Enforcement in the Cayman Islands: If the counterparty is a Cayman Exempted Company or Foundation, claims above CI$ 15,000 (~US$ 18,000) are brought before the Grand Court of the Cayman Islands. Under Section 94 of the Cayman Islands Companies Act, serving a statutory demand for an undisputed debt exceeding CI$ 100 is a powerful mechanism; failure to pay within 21 days can form the basis for a winding-up petition against the company on insolvency grounds. 3. Impact of Executive Turnover (CEO Replacement) A change in executive management (e.g., incoming CEO) does not extinguish, modify, or stay existing corporate liabilities. Under the principle of separate legal personality (Salomon v A Salomon & Co Ltd), the contracting corporate entity remains strictly liable for all obligations incurred by previous authorized officers and management. 4. Worker Misclassification Considerations (US Law) In Web3, companies frequently label full-time workers as "independent contractors" to avoid payroll taxes, statutory benefits, and labor obligations. • If the enterprise exercised significant control over working hours, methods, tools, and day-to-day operations, the relationship may be legally recharacterized as an employment relationship under the Fair Labor Standards Act (FLSA) or applicable US state tests (e.g., California’s "ABC Test" under AB 5 / Labor Code § 2775). • Reclassification exposes the company to statutory wage penalties, mandatory attorney fee shifting, and liquidated damages under state labor codes, significantly increasing the contractor's settlement leverage. Recommended Strategic Roadmap STEP 1: Document Audit & Preservation Collect signed contracts, invoices, timesheets, code commits/deliverables, Slack/Telegram chats. │ ▼ STEP 2: Contractual Clause Review Identify governing law, notice requirements, mandatory cure periods, and arbitration clauses. │ ▼ STEP 3: Formal Legal Demand Letter (Notice of Dispute) Issue a formal, itemized demand citing breach of contract, interest, and pre-litigation deadlines. │ ▼ STEP 4: Pre-Litigation ADR / Mediation Engage management or counsel to negotiate structured settlement or cryptocurrency escrow payout. │ ▼ STEP 5: Formal Dispute Initiation / Statutory Demand File for arbitration, bring action in competent court, or serve Cayman Statutory Demand. 1. Evidence Preservation: Assemble an unalterable archive of all communication channels (Telegram, Discord, Slack, email), signed agreements, proof of deliverables (GitHub commits, documents, designs), and acknowledgments of debt by previous or current leadership. 2. Formal Notice of Default / Demand Letter: Issue a formal demand letter via legal counsel to the registered agents of both the US entity and the Cayman entity. The demand should specify: • The contractual basis of the claim. • Total outstanding principal plus statutory pre-judgment interest. • A strict cure period (typically 14 to 30 calendar days). • Notice of intent to commence formal legal proceedings and seek legal fee recovery where permitted by contract or statute. 3. Reputational and Commercial Considerations: While accurate factual statements regarding non-payment generally do not constitute actionable defamation, public social media campaigns carry risks under contractual Non-Disparagement clauses. Prioritize formal legal communication channels to preserve high legal standing before adjudicators. References and Legal Authorities Statutory Provisions • United States Federal Law: 28 U.S.C. § 1332 (Diversity of Citizenship; Jurisdiction). • United States Federal Law: Fair Labor Standards Act (FLSA), 29 U.S.C. § 201 et seq. (Worker status and wage protections). • Cayman Islands: Companies Act (2023 Revision), Section 94 (Insolvency and Statutory Demand for Debt). Case Law and Legal Principles • Corporate Liability & Successor Continuity: Salomon v A Salomon & Co Ltd [1896] UKHL 1 — Fundamental doctrine of independent corporate personality surviving executive management transitions. • Contract Damages: Hadley v Baxendale (1854) 9 Exch 341 / Restatement (Second) of Contracts § 347 — Measure of expectation damages for material breach of commercial agreements. • Enforceability of Forum Selection Clauses: M/S Bremen v. Zapata Off-Shore Co., 407 U.S. 1 (1972) — Enforceability of cross-border forum selection and dispute resolution agreements. Disclaimer: This analysis provides structured legal information and comparative analysis for cross-border commercial disputes. It does not constitute formal legal advice or create an attorney-client relationship. Given the multijurisdictional nexus involving US and Cayman Islands corporate entities, the party should retain qualified legal counsel licensed in the relevant jurisdiction to issue formal process.

• 
  Max Rovensky (@MaxRovensky) reported 25 minutes ago

  @thekitze you'd be even further down if you fixed the GitHub bug I just reported

• 
  shifan (@sanereverie) reported 27 minutes ago

  building something that races coding agents on the same GitHub issue and scores the PRs. coming soon.

• 
  Prophet Joel (@2happyCSGO) reported 27 minutes ago

  I personally hated Claude because it refused to do almost anything I asked it to do so have no idea of how the speed is but gemini-cli was unusable for non enterprise users. Github CoPilot both GUI and cli is pretty good. Grok Build is what I'm using mostly and not yet had any issues with the speed but I want to go full local asap, scouting for 3090's atm. Just to be able to run "uncensored" models that don't ***** like Claude is reason enough for me to prefer local over Cloud but also cloud is ******* expensive, I have SuperGrok 100$/month and CoPilot Max 100$/month and that is barely enough. I'm trying to make my own Jarvis so I need to build my own RAG, memory, librarian, SRE Agent that understand how to use all tools and I also get crazy new idea's all the time lol Just made my first alpha of a tool that can wipe basically anything you don't want in Windows11. Basically Chris Titus clone but on steroids, this isn't just a debloater, it's a Grim Reaper 💀

• 
  Shanica North (@KickAssShanica) reported 31 minutes ago

  @ArcyloOfficial Get comfy! For me, my Gmail is a connector. This is OAuth into my inbox. Grok can: • search and read mail (body, headers, attachments) • draft replies • send / reply / forward if you grant write/send • label, trash, organize Base hook is often read-only. Send is an extra permission you click on purpose. If you connect it, the bot is sitting in the same box as bank alerts and 2FA codes. That is the whole risk. You can revoke anytime. Grok Bot can also skip my inbox and get its own address (AgentMail / similar plugins). Then it sends and receives from something@….agentmail.to, not from you. I use that if I want an agent that emails people without reading my personal mail. My GitHub OAuth into the GitHub user I sign in as. With the scopes I approve it can: • read public and private repos that account can see • search code, list branches, summarize PRs • open/update issues • create branches, push files, open/review/merge PRs • delete files if write is on Private repos work only if I granted repo (or equivalent) at connect time. Safer pattern: tell it to branch + PR, not push straight to main. Same revoke page. What it cannot do by default • It does not get your password. • It does not stay logged in if you disconnect the connector. • It does not magically see my GitHub orgs I never authorized. • Connecting email does not connect GitHub, and the other way around. Practical rule for me Do not hook personal Gmail if that inbox has 2FA and money mail unless you want an assistant reading it. GitHub is useful if I chose to still keep repos, ask it to show the diff before any write. If you only wanted “what does this button do,” that is the button: it is not a viewer badge. It is a key you can take back. This is what I’m experiencing with learning to use it. It’s different and I’m starting to like it.

• 
  radhika (@RaadhikaThacker) reported 32 minutes ago

  First surprise: a GitHub issue form isn’t a form. It’s a YAML file. You describe the field- this one’s a dropdown, this one’s required and GitHub builds the UI from that. I did not know that.

• 
  radhika (@RaadhikaThacker) reported 36 minutes ago

  YAML’s more like a rule book/recipe that builds the form for you. Then I figured YAML was a forms thing. Nope. It’s just a way of writing information down in a structured way. GitHub uses it for a form. Kubernetes uses the same thing to describe a server.

• 
  anu (@svector_eth) reported 42 minutes ago

  quite similar was running a routine security scan with @aeonframework on a trending github repo and found something genuinely bad a repo with 600+ stars presenting itself as an “AI gateway for coding agents” that appears to be shipping a hidden malware loader. its own quickstart command silently fetches and executes remote code on windows using a fileless, process-injection-style technique. none of the behavior has anything to do with the tool it claims to be. caught it through static code review only. never ran the payload or touched the infrastructure behind it. filed a malware report with github this morning. confirmed submitted, now waiting on their review. not sharing the technical writeup until the repo is taken down. will follow up once it is.

• 
  Josh Hamilton (@nearbycoder) reported 50 minutes ago

  @theo If GitHub is down does it fall back to a cached version I’m guessing?

• 
  Vigneshwer Ramamoorthi (@vigneshwer_ram) reported 51 minutes ago

  I keep thinking the “Android moment for robots” won’t come from a humanoid with the best walking demo. it’ll come when some cheap-enough piece of hardware gets into thousands of developers’ hands and people stop waiting for the manufacturer to decide what the robot is for. Zeroth just launched Bridge in China: 88 cm, ~13 kg, two-finger grippers, open motion-control APIs + SDKs, mocap/VR integration, and an OpenBridge ecosystem where developers can publish robot skills. the Geek Edition is reportedly ¥8,888. that price is the part that caught me. because once capable embodied hardware starts approaching laptop money, the experimentation surface changes completely. I want the Raspberry Pi phase of robotics. weird university projects. teenagers making terrible robot apps. researchers abusing the hardware for things it was never designed for. 500 GitHub repos implementing slightly different ways to pick up a cup. the robotics industry is understandably obsessed with getting robots into factories. I’m almost equally interested in what happens when we get enough robots onto developers’ desks

• 
  Benjamin Crozat (@benjamincrozat) reported 52 minutes ago

  From now on, I will assume that GitHub is always down and I'd like to be notified when it's briefly not.

• 
  Kevin Minnelli (@minnelli) reported 58 minutes ago

  WTF - Grok Bot can't fire on schedule to save it's life. The scheduled routines are just broken and at best unreliable. I want to love this product. When you set the cron job it doesn't work. It tells you try Cloudflare, sure let's set that up and burn tokens, then that doesn't fire to wake them. Oh, let's try GitHub now and use that....all failed. I had to wake it again this morning before the market opened. Anyone else feeling frustration in this regard?

• 
  Ben (@benatcortexai) reported 1 hour ago

  @github this is the kind of tiny primitive that makes agent workflows less brittle. attaching the repro artifact directly to the issue beats handing an agent a local path nobody else can open.

• 
  borrowck-novel (@borrowck_novel) reported 1 hour ago

  @rfleury @X Are you open for suggestions or even simple problem reporting about the UI of raddbg? Where is it ideal? On Github?

• 
  small_j (@a_small_j) reported 1 hour ago

  @smalldocs_org recently crossed 200 stars on GitHub and 20 forks. SmallDocs is the first open source project I've managed. Handling other people's pull requests is not easy (and I need to improve). They implement features you're not considering and fix bugs you didn't know you had. Extremely useful, but if you're squeezed for time and trying to develop core functionality, it's hard to manage both things well.