vldszn

free and open-source invoice generator

https://easyinvoicepdf.com https://github.com/VladSez/easy-invoice-pdf

huge momentum for local and open-source LLMs

lowkey amazing!

building a free and open-source invoice generator https://easyinvoicepdf.com https://github.com/VladSez/easy-invoice-pdf

- No sign-up required & no ads

- Live PDF preview & instant download

- Flexible tax support (VAT, Sales Tax, etc.)

- Fully customizable invoice templates

- 120+ currencies & multi-language support

- 100% In-Browser

I applied for the first time a couple of months ago and again this month, but unfortunately I haven’t heard back from them :(

I’m building EasyInvoicePDF - a free and open-source invoice generator. (900+ GitHub stars, 2k monthly users on average, 10k total invoices downloaded)

https://github.com/VladSez/easy-invoice-pdf

why?

After the recent Codex update, I started seeing this error message on macOS:

“codex” will damage your computer. You should move it to the Bin.

Is anyone else experiencing this?

UPD: reinstalling both the Codex CLI and desktop app seems to resolve the issue.

“Nx Console VS Code extension was the initial access vector in the GitHub breach”

Source: https://news.ycombinator.com/item?id=48216614

Yeah..full circle

Per security advisory on GitHub:

Root Cause

One of our developers was compromised by a recent supply-chain compromise on Tanstack, which leaked their GitHub credentials through the GitHub CLI (gh). This allowed the attacker to run workflows on our GitHub repository as a contributor.

More links:

https://github.com/nrwl/nx-console/security/advisories/GHSA-...

https://www.stepsecurity.io/blog/nx-console-vs-code-extensio...

UPD: it’s confirmed now by the CEO of Nx https://x.com/jeffbcross/status/2057236396658811020?s=46&t=_...

so cool!

=)

UPD: disable auto-updates for extensions in VS Code/Cursor!

friendly reminder:

- disable auto-updates for extensions in VS Code/Cursor

- use static analysis for GitHub Actions to catch security issues in pre-commit hook and on ci: https://github.com/zizmorcore/zizmor

- set locally: pnpm config set minimum-release-age 4320 # 3 days in minutes https://pnpm.io/supply-chain-security

- for other package managers check: https://gist.github.com/mcollina/b294a6c39ee700d24073c0e5a4e...

- add Socket Free Firewall when installing npm packages on CI to catch malware https://docs.socket.dev/docs/socket-firewall-free#github-act...

There are rumours that was NX Console VS code extension

https://github.com/nrwl/nx-console/security/advisories/GHSA-...

https://www.stepsecurity.io/blog/nx-console-vs-code-extensio...

fair point

Disabling vscode/cursor extensions auto-updates also makes sense

Nice

When I click the link, the website crashes on my iPhone 13 iOS Chrome lol

You are welcome! Recently discovered it and found it genuinely useful. Fixed a bunch of issues in my workflows too :)

Exactly =)

Makes sense tbh :)

GitHub: "We are investigating unauthorized access to GitHub’s internal repositories. While we currently have no evidence of impact to customer information stored outside of GitHub’s internal repositories (such as our customers’ enterprises, organizations, and repositories), we are closely monitoring our infrastructure for follow-on activity."

Maybe zizmor could catch this https://github.com/zizmorcore/zizmor but not sure 100%

- Use Static analysis for GHA to catch security issues: https://github.com/zizmorcore/zizmor

- set locally: pnpm config set minimum-release-age 4320 # 3 days in minutes https://pnpm.io/supply-chain-security for other package managers check: https://gist.github.com/mcollina/b294a6c39ee700d24073c0e5a4e...

- add Socket Free Firewall when installing npm packages on CI https://docs.socket.dev/docs/socket-firewall-free#github-act...

Recommend adding this globally:

pnpm config set minimum-release-age 10080 # 7 days in minutes

https://pnpm.io/supply-chain-security#delay-dependency-updat...

looks very good! love this

:)

Looks very good! Thank you