Jon Klaric retweeted
ok update on the deleted repo thing, since it kind of blew up
first, some context on why i posted it like that. there have been so many security incidents lately that my brain is basically stuck in alert mode. so when i saw a stranger in our audit log deleting a private repo, i assumed the worst.
we figured out what happened. nobody hacked us, and it wasn't a github bug.
that repo was a private fork of a repo owned by @StainlessAPI, the company that generated our SDKs. our entire SDK pipeline ran on it.
Stainless got acquired by @AnthropicAI back in may. and on october 27, with zero heads-up to us, someone there deleted their copy of the repo.
turns out when you delete a private repo on github, every private fork of it gets deleted too. same request, under two seconds. and our audit log shows the person who deleted *their* repo as the one who deleted *ours*. that's why it looked like a random outsider walked into our org and nuked something.
no email. no "hey, we're cleaning these up, grab a copy." just gone, along with the production repo behind every one of our SDKs.
github support walked us through all of it within a day, which, genuinely, thank you.
one ask though @github: put this in the audit log. right now the event for our repo just says "repo.destroy" by an outside user. if it said "deleted because upstream fork parent X was deleted", we'd have understood it in two minutes instead of spending a night thinking we'd been breached.
we had a local clone, so we pushed it back up as a standalone repo and the SDKs are running again.
if you were a Stainless customer and you've got anything living as a private fork of one of their repos, go detach it today. it takes ten minutes. their delete is your delete.
someone outside our GitHub org deleted one of our private repos.
no membership or invite or role. nothing in our org or enterprise audit logs gave them access. just one repo.destroy from the gh CLI.
and it's not in deleted repositories, so no restore.
@github how is this possible, what sorcery is this?
Please tell me this is a Halloween tale designed to scare the sh*t out of devs…
someone outside our GitHub org deleted one of our private repos.
no membership or invite or role. nothing in our org or enterprise audit logs gave them access. just one repo.destroy from the gh CLI.
and it's not in deleted repositories, so no restore.
@github how is this possible, what sorcery is this?
Jon Klaric retweeted
If you believe free speech is for you but not your political opponents, you're illiberal.
If no contrary evidence could change your beliefs, you're a fundamentalist.
If you believe the state should punish those with contrary views, you're a totalitarian.
If you believe political opponents should be punished with violence or death, you're a terrorist.
Jon Klaric retweeted
URGENT - PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches thehackernews.com/2026/10/ur…
Oh, and a cheeky little CVE in libc (regcomp) to finish up the day too. openwall.com/lists/musl/2026…
Jon Klaric retweeted
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
The Supabase .NET SDK is now officially supported with a major new version. v8 puts every package in one repo, on one version number.
Learn more → supabase.com/blog/introducin…
Jon Klaric retweeted
Forked @ecklflorentin's LG TV launcher to add more TVs and casting.
Then I had a worse idea: T3 Code on the TV.
Agents now sitting next to Netflix, and the home screen tells me when one is still working, failed, or needing my attention.
@theo @maria_rcks @jullerino it's slow on a Fire TV stick, but it runs 📺
You can now code from your TV with T3code. @theo you coming around for some Netflix and coding?
XKCD strikes again m.xkcd.com/221/
Jon Klaric retweeted
Replying to @wagslane @joelhooks
🫡 appreciate yall a ton
Everyone who doesn’t qualify under my “have your boss pay for it” callout should probably be on boot :)
Starship, Starlink, Grok, and Roadster. These should all have been Sputnik moments for Europe. Triggered immediate deregulation, mobilization of capital, and ambition to catch up. And that's just the work of Elon's companies alone. But what do we get? A hollowed out EU Inc 💀






















