devtake.dev — #githubArticles tagged github on devtake.dev.https://devtake.dev/en-usVS Code's webview sandbox leaks GitHub tokens that read and write every private repohttps://devtake.dev/article/vscode-zero-day-github-token-theft/https://devtake.dev/article/vscode-zero-day-github-token-theft/A disclosed VS Code zero-day lets one click on a malicious github.dev notebook steal a GitHub OAuth token with full read-write access to every private repo.Wed, 03 Jun 2026 13:15:00 GMTsecuritysecuritygithubcredential-theftdev-toolsrcesupply-chainoauthluca-reinhardtMicrosoft is shipping Linux's core commands on Windows, built in Rusthttps://devtake.dev/article/microsoft-coreutils-windows-rust/https://devtake.dev/article/microsoft-coreutils-windows-rust/Microsoft's Coreutils for Windows brings native ls, cp, and grep to Windows, built on the Rust uutils project. Here's what it is and why the Rust rewrite matters.Wed, 03 Jun 2026 12:45:00 GMTopen-sourceopen-sourcerustdev-toolsgithublinuxsoren-vanekGitHub banned the researcher dropping Windows zero-days. The code was already mirrored everywhere.https://devtake.dev/article/github-bans-researcher-windows-zero-day/https://devtake.dev/article/github-bans-researcher-windows-zero-day/GitHub wiped Nightmare-Eclipse's account on May 23 after weeks of unpatched Windows exploits. The ban reopened the oldest fight in security: who decides what research gets hosted?Fri, 29 May 2026 06:50:00 GMTsecuritysecuritygithubvulnerability-disclosurezero-daymicrosoftwindowssupply-chainrceluca-reinhardtMicrosoft just open-sourced 86-DOS. Tim Paterson's 45-year-old listings are now on GitHub under MIT.https://devtake.dev/article/microsoft-dos-historical-source-open-sourced/https://devtake.dev/article/microsoft-dos-historical-source-open-sourced/Yufeng Gao and Rich Cini scanned Tim Paterson's 1981 assembler printouts. Microsoft pushed them to DOS-History/Paterson-Listings on April 28, the 45th anniversary.Mon, 25 May 2026 12:30:00 GMTopen-sourcemicrosoftms-dos86-dosopen-sourcecomputer-historygithubmit-licensetim-patersonsoren-vanekKarpathy posted four notes about Claude Code. The CLAUDE.md they spawned has 110K GitHub stars.https://devtake.dev/article/karpathy-claude-md-github-trending/https://devtake.dev/article/karpathy-claude-md-github-trending/Forrest Chang turned Andrej Karpathy's January coding thread into a 70-line CLAUDE.md. It now has 110,000+ stars and has trended on GitHub for 28 weeks.Fri, 22 May 2026 10:30:00 GMTaiandrej-karpathyclaude-codeclaudeai-agentsagentic-codingai-assistantgithubdev-toolsdieter-morelliGitHub's internal repos were breached. The attacker came in through a poisoned VS Code extension.https://devtake.dev/article/github-internal-repos-breach-vscode-extension/https://devtake.dev/article/github-internal-repos-breach-vscode-extension/GitHub detected the intrusion on May 18 after a malicious VS Code extension compromised an employee's device. The attacker claims to have exfiltrated 3,800 internal repositories.Fri, 22 May 2026 10:15:00 GMTsecuritysecuritygithubvscodesupply-chaincredential-theftdev-toolsluca-reinhardtA CISA contractor left GovCloud admin keys on public GitHub. The file was named 'Important AWS Tokens.txt'.https://devtake.dev/article/cisa-aws-govcloud-keys-github-leak/https://devtake.dev/article/cisa-aws-govcloud-keys-github-leak/GitGuardian found a public CISA repo with 844 MB of secrets, including AWS GovCloud admin keys. The repo sat open for six months.Thu, 21 May 2026 11:15:00 GMTsecuritysecuritycisagithubsupply-chaincredential-theftawsgitguardiangovcloudluca-reinhardtRPCS3's maintainers will ban contributors who submit undisclosed AI pull requestshttps://devtake.dev/article/rpcs3-ai-slop-pull-requests-policy/https://devtake.dev/article/rpcs3-ai-slop-pull-requests-policy/The PS3 emulator project posted on X on May 10, citing 'AI slop' that has been clogging review. The hard line: ban-on-sight if you don't disclose.Mon, 11 May 2026 10:15:00 GMTopen-sourceopen-sourcerpcs3emulatorgithubai-codingai-slopplaystation-3contributorssoren-vanekGitHub Copilot's Claude Opus multiplier jumps to 27x on June 1. Monthly plans dodge the hike.https://devtake.dev/article/github-copilot-multiplier-hike-june-2026/https://devtake.dev/article/github-copilot-multiplier-hike-june-2026/GitHub's new model multiplier table for Copilot Pro and Pro+ annual plans lands June 1. Opus 4.6 goes 3 to 27. Sonnet 4.6 goes 1 to 9.Mon, 04 May 2026 10:45:00 GMTaigithub-copilotgithubai-agentspricingmicrosoftanthropicclaude-opusdev-toolsdieter-morelliMicrosoft open-sourced the earliest known DOS code, transcribed from a stack of Tim Paterson's printouts.https://devtake.dev/article/microsoft-dos-source-code-open-sourced/https://devtake.dev/article/microsoft-dos-source-code-open-sourced/MIT-licensed at GitHub on April 28, the 86-DOS 1.00 kernel and PC-DOS development snapshots were OCR'd from 45-year-old assembler listings.Sun, 03 May 2026 12:45:00 GMTopen-sourcemicrosoftdos86-dosopen-sourceretrocomputingmit-licensegithubtim-patersonsoren-vanekMitchell Hashimoto is pulling Ghostty off GitHub. The reason is daily outages.https://devtake.dev/article/ghostty-leaving-github-mitchell-hashimoto/https://devtake.dev/article/ghostty-leaving-github-mitchell-hashimoto/Ghostty's creator has tracked GitHub outages every workday for months. After 18 years on the platform, he's moving the project. A read-only mirror stays.Wed, 29 Apr 2026 09:25:00 GMTopen-sourceghosttygithubopen-sourcedev-toolsmitchell-hashimototerminalhashicorpsoren-vanekWiz found an RCE in GitHub's git-push pipeline. The patch shipped in six hours.https://devtake.dev/article/github-rce-cve-2026-3854-wiz/https://devtake.dev/article/github-rce-cve-2026-3854-wiz/CVE-2026-3854 is a CVSS 8.7 RCE in GitHub's git-push pipeline. github.com fixed it within hours. 88% of Enterprise Server installs were still vulnerable at disclosure.Wed, 29 Apr 2026 09:05:00 GMTsecuritygithubsecuritycve-2026-3854rcesupply-chainwizgithub-actionsdev-toolsluca-reinhardtGitHub Copilot kills premium requests on June 1. Token billing arrives, fallback models do not.https://devtake.dev/article/github-copilot-usage-based-billing/https://devtake.dev/article/github-copilot-usage-based-billing/On June 1 every Copilot plan switches to GitHub AI Credits priced per token. Code completions stay free. Fallback models and credit rollover do not.Tue, 28 Apr 2026 11:00:00 GMTaigithub-copilotgithubai-agentspricingmicrosoftanthropicclaude-opusdev-toolsdieter-morelliInside GitHub's fake star economy: 6 million bought stars and how to spot themhttps://devtake.dev/article/github-fake-star-economy/https://devtake.dev/article/github-fake-star-economy/A Carnegie Mellon study counted 6 million suspected fake stars across 18,617 GitHub repos. Here's what the StarScout research actually found and how to read a star count now.Mon, 20 Apr 2026 16:00:00 GMTopen-sourcegithubfake-starsstarscoutopen-sourcesoftware-researchicse-2026supply-chainai-repossoren-vanekA $5,000 open-source radar that sees 20 km, built by one engineer in Moroccohttps://devtake.dev/article/aeris-10-open-source-radar-github/https://devtake.dev/article/aeris-10-open-source-radar-github/Nawfal Motii's Aeris-10 phased-array radar beats $250,000 commercial systems at 3% of the cost. Hardware, firmware, and FPGA bitstream are all on GitHub.Fri, 17 Apr 2026 13:00:00 GMThardwareopen-hardwareradargithubfpgaphased-arraymakercern-ohlhiro-tanaka