Andrew Nesbitt

brew install actions/checkout - Using Homebrew's tap machinery as a curated distribution layer for GitHub Actions.

https://nesbitt.io/2026/08/04/brew-install-actions-checkout.html

i didn’t think it was physically possible, but there’s finally something worse than curl | sh

@Di4na @Rairii 🫠

brew install actions/checkout - Using Homebrew's tap machinery as a curated distribution layer for GitHub Actions.

https://nesbitt.io/2026/08/04/brew-install-actions-checkout.html

@petko it's protecting the database and rails apps a bit, doesn't seem to actually stop the scrapers trying though.

Also if you're adding cache busting url parameters to api requests to try and get fresher results, I'm just going to block you, don't do that.

@omkar_foss can you give https://repos.ecosyste.ms/hosts/GitHub another try?

@omkar_foss that one seems unreliable, i will investigate

@omkar_foss yeah that page is just broken, it tries to paginate through 292m repo records

Curl had it's summer of bliss, @ecosystems is having it's Summer of Piss (taking) by security companies hammering the public api and ignoring the data license.

@bagder nope, i just have a free cloudflare account.

Anubis upgraded to 1.26.2 and difficulty level increased.

Also found some new security companies heavily scraping, I look forward to seeing whatever they produce with this CC-BY-SA data that I'm sure they will follow the license of and republish their findings under the same license.

RE: https://mastodon.social/@andrewnez/117032582823441702

Investigating this today, looks like there's a new residential proxy scraping the html of the various ecosyste.ms services, not the json api.

Useragent is all last years chrome on desktop mac, all executing js and passing anubis, see if I can make some tweaks to that config to shut it down.

@muan battery life is really bad

RE: https://fosstodon.org/@adamchainz/117017044548701755

"Wheels are also now built with frame pointers enabled, per the PEP 831 change in Python 3.15. Frame pointers are a debugging feature for low-level languages like C, which allow debuggers to reconstruct the call stack of a program. Python has decided to enable frame pointers by default and encourage the ecosystem to do so as well, to make debugging easier for us all, so time-machine is joining the party."

Enabled by default for 3.15, do this for older versions:

https://github.com/adamchainz/time-machine/pull/627

#Python

It’s now up to 101m 🫣

92m requests to @ecosystems so far today, the biggest single day I've ever seen 🫠

Paraphrasing an email from a security company : We copied one of your blog posts and turned into an advert for one of our products. Please add a link to our blog post to the end of yours. 🥉

Restricting npm bypass-2FA granular access tokens https://github.blog/changelog/2026-07-31-restricting-npm-bypass-2fa-granular-access-tokens
#github

(this officially loosens zizmor's "GHA only" policy. if there are other platforms you care about, help me understand them better here: https://github.com/orgs/zizmorcore/discussions/2253)