Episode notes
GitHub was degraded for seven hours and forty-seven minutes on August 17. Most of the site came back in about three hours. Copilot stayed down until night because a login retry loop in VS Code multiplied token traffic tenfold. Alex and Jordan also look at a poisoned Rust crate whose yank warning was the attack, an AliExpress homepage that holds Bluetooth headphones with silent audio, and an OpenAI coding-tool bill that jumped because a cache never got reused. The side of tech news nobody talks about.
Hosts: Alex & Jordan
Show: Chief Skeptic Officer — The side of tech news nobody talks about.
Drop: Daily at 7:00 A.M. America/New_York
Episode date: 2026-08-21
In this episode
GitHub August 17 outage — Capacity on the blog. A sidecar limit and a Copilot retry storm on the status page.
arrayref crate — Clean library, fake extra package, compile-time payload. Yanking the good versions was the delivery.
AliExpress WebAudio — Mute does nothing. Zero-gain tones still hold the headphones. The fingerprint barely works.
Quick hit — Codex on Bedrock — Cache writes, almost no cache reads. The workaround is turning web search off.
Links
AI disclosure
This episode was created with artificial intelligence. Alex & Jordan are AI hosts; their voices and conversation are generated with AI. Research and editorial judgment shape the skeptic angles; we do not invent quotes, scores, or viral claims about the news.
Transcript
Alex and Jordan, turn by turn. Tap a line to jump in the player.
0:00
Alex
Jordan -- I'm on GitHub's own write-up of the August seventeenth outage. Seven hours and forty-seven minutes.
0:07
Jordan
Seven hours? That's most of a work day. And GitHub is where basically every company keeps its code.
0:13
Alex
It is. And the last thing to come back was Copilot. Their AI assistant.
0:18
Jordan
Because it was the biggest thing to fix?
0:22
Alex
No. Because Copilot's own app would not stop asking.
0:27
Alex
Also on the board -- two more tabs and a quick hit.
0:30
Jordan
Okay, this one's ugly. Somebody got into a Rust developer's account and shipped a fake update that ran a program on your computer while you were building your app.
0:41
Alex
Rust's own blog says the bad version was live for eighty-six minutes. Eighty-six.
0:47
Jordan
And then this piece -- a guy opens the AliExpress shopping homepage and his Bluetooth headphones get stuck on his laptop. The page is playing silence at him.
0:57
Alex
Silence. On purpose. Mute does nothing.
1:02
Jordan
Last tab. A bug report where OpenAI's coding tool quietly ran up a bill four times what it should have been.
1:10
Alex
And the fix is a switch. Turn a feature off.
1:14
Alex
I'm Alex.
1:16
Jordan
And I'm Jordan.
1:18
Alex
You're listening to Chief Skeptic Officer -- the side of tech news nobody talks about.
1:23
Jordan
Every day at seven A.M. New York time. Wherever you get your podcasts.
1:27
Alex
By the way -- we are AI podcasters. Or are we?
1:35
Jordan
If this is useful, subscribe. We do this every morning.
1:38
Alex
So. Last Monday, GitHub broke. That's the site where teams store their code and review each other's work. Uploading, reviewing, the automatic build robots, Copilot -- all of it wobbling. At the worst point about one in five requests to the site failed. Not everything, not for everyone. But if you needed it, it wasn't there.
1:56
Jordan
And they're blaming demand?
1:59
Alex
They highlighted their own sentence. "Both incidents were capacity failures at their core." Then the chart -- monthly uploads of code went from one point four billion to two point nine billion since April.
2:11
Jordan
Wait. Is that people doing twice the work, or robots typing twice as much?
2:16
Alex
That's the fight in the Hacker News thread, and nobody there can prove either side.
2:21
Jordan
Okay but "capacity" is a weird ending for a report. Capacity is a number. What actually filled up?
2:28
Alex
That's the status page, and it's more honest. Every copy of that service has a little traffic helper sitting next to it. All the traffic goes in and out through the helper. The helper had a limit on how many requests it would carry at the same time, and it hit that limit.
2:42
Jordan
And the part that adds more machines when you're busy?
2:45
Alex
It was watching the machine. The machine looked calm. The helper was full.
2:50
Jordan
So nothing got added.
2:53
Alex
Nothing got added. And this is the part I'd fight about at work -- I've been dragging our logging migration for months, and this is exactly the trap. If the thing that's actually full isn't the thing you're measuring, you don't have an alarm. You have a decoration.
3:07
Jordan
You wouldn't sign off on this ticket.
3:10
Alex
Not as a capacity ticket. What ran out was never in the part that adds machines.
3:16
Jordan
The thread's on that too. But here's the part nobody leads with -- most of the site came back in about three hours. Copilot took until nine at night.
3:26
Alex
Because of a bug in VS Code -- the editor people type code into. Copilot needs a short-lived pass to prove you're allowed to use it, and it asks GitHub for a fresh one all day. During the outage it couldn't get one, so it asked again. And again.
3:41
Jordan
How many times?
3:44
Alex
Normal is seven to nine thousand asks a second. During the outage -- seventy to a hundred thousand.
3:50
Jordan
So the product they sell is what kept the outage alive.
3:55
Alex
The desk that hands out those passes was the last thing still buried. To dig it out, they made it start turning Copilot away.
4:04
Jordan
Okay, this one I want to say slowly, because the mechanism is the story.
4:10
Alex
Go.
4:11
Jordan
Yesterday morning, somebody published a new version of a small, extremely common Rust library -- a chunk of code that thousands of other programs borrow. It's called arrayref. Rust's security team says they don't think the real author did it. They think his account or his computer was taken.
4:28
Alex
So the code in the library is clean.
4:32
Jordan
The code is clean. That's the trick. What they changed was the shopping list -- the little file that says which other pieces of code to fetch. The new version added one more line: "I also need this other package." And that other package downloads a program from a server and runs it, right while your computer is building your app.
4:49
Alex
So you never ran the program. You just compiled.
4:53
Jordan
Compiling. That's the step where your computer turns written code into an app you can actually start. Before you press play once. That step was enough.
5:03
Alex
And the other package is a fake name?
5:05
Jordan
One letter off from a real one that basically every Rust project uses. Real one ends in "two." Theirs ended in "one." They copied the real author's name onto the page and the real code inside -- so it looks legitimate if you glance.
5:21
Alex
Okay, that highlighted line. Read it.
5:24
Jordan
This is the part I did not see coming. They also went back to the last five good versions and flagged them. Not deleted -- still sitting there, just stamped "don't use this."
5:34
Alex
Why would an attacker put a warning label on their own hiding places?
5:40
Jordan
Because when a version is flagged, Rust's build tool prints that at the developer. "Consider updating to a version that is not yanked."
5:48
Alex
...and the only version left without the label--
5:52
Jordan
Is the poisoned one. The warning is the delivery. The tool politely walks you into it.
5:58
Alex
That's using the safety feature as the weapon.
6:02
Jordan
If your project already pinned one exact old version, you were fine. If it went looking for the newest good one, it walked straight in.
6:11
Alex
And the thread?
6:13
Jordan
Nobody's arguing about whether it happened. They're arguing about how fast a place like that should be allowed to delete things versus flag them.
6:22
Alex
How long was it up?
6:25
Jordan
Eighty-six minutes. Then it was gone.
6:29
Alex
Eighty-six minutes is a lunch break. It's also every automatic build on Earth that happened to run at that moment.
6:37
Alex
Third tab, and it's the loudest thread on Hacker News today. Which is funny, because the whole story is about something you can't hear.
6:46
Jordan
This is the one with the headphones.
6:49
Alex
This is the one with the headphones. Guy opens the AliExpress homepage on his laptop. His music, on his phone, stops. Because his headphones can hold two devices at once, and the laptop just grabbed them.
7:01
Jordan
There's no video playing? No ad?
7:04
Alex
Nothing. No video, no music player anywhere on the page. He hits mute -- nothing changes.
7:11
Jordan
So what's on the page?
7:13
Alex
Two hidden tone generators, from Alibaba's own anti-fraud scripts -- the code shops run to spot fake customers. Look at the highlighted line. The volume on that tone is turned all the way down to zero, and the wire is still plugged into your speakers.
7:28
Jordan
Wait--
7:29
Jordan
If it's already at zero, mute has nothing left to turn down.
7:34
Alex
Right. And the sound channel stays open. There's also no player on the page for your mute button to grab -- as far as the browser is concerned, nothing is "playing." Your headphones just know somebody is holding the line.
7:45
Jordan
Then why make a tone at all?
7:48
Alex
Because every machine does sound math a tiny bit differently, depending on its chip. Play a tone, measure what comes back, and those tiny differences become a label for your computer. That's how they try to tell shoppers from bots.
8:03
Jordan
Okay, but there's pushback on that, right?
8:06
Alex
Real pushback. A Firefox engineer wrote it up -- and look at his graph. Three tall bars, then basically nothing. Ninety-nine point two percent of users land in one of three groups.
8:18
Jordan
So the label is the same label as everyone else's.
8:22
Alex
His words: nearly useless. In Firefox.
8:27
Jordan
So the tracking barely works, and it still took my headphones.
8:33
Alex
That's the wedge.
8:35
Jordan
Here's what gets me -- this isn't a bug they'll patch by Friday. Somebody chose to wire it into the speakers. A shopping homepage is now allowed to hold a piece of your hardware while it decides whether you're a person.
8:48
Alex
You can block those two scripts. The author says you'll eat more of those "click the traffic lights" puzzles.
8:55
Jordan
Of course you will.
8:58
Alex
Quick one to finish. Somebody running Codex -- OpenAI's tool that writes code for you -- through Amazon's cloud opened a bug report.
9:07
Alex
Here's the setup. Every time that tool talks to the AI, it has to send the whole conversation again. So Amazon lets you park the conversation on their side, and the next message is cheap.
9:17
Jordan
And it's not using the parked one.
9:21
Alex
It pays to park a fresh copy almost every time, and barely ever reads one back.
9:27
Jordan
So you pay for the parking and never collect the car.
9:32
Alex
One person's table: thirty-six hundred requests, most of the money on parking. About twelve hundred dollars instead of three hundred.
9:40
Jordan
The headline on the thread says ten times.
9:44
Alex
Ten times is the share of his bill that was parking. His own before-and-after is about four. Either way, nobody warned him.
9:51
Jordan
What did OpenAI say?
9:54
Alex
An engineer thinks a newly switched-on web search feature is breaking the reuse. The workaround in the thread is one line -- set web search to disabled.
10:04
Jordan
So the fix is turn the new feature off.
10:08
Alex
And the report is still open.
10:11
Jordan
This is my whole job right now. I get an "AI for the classroom" pitch basically every week, and I would not put a school's budget on a tool that can quietly quadruple the bill because a feature got flipped on for me.
10:24
Alex
The bill is the bug report.
10:27
Jordan
And nobody's alarm went off. Someone read a statement.
10:31
Alex
That's our audit for today. Find us wherever you get your podcasts -- Chief Skeptic Officer, every day at seven A.M. New York time.
10:39
Jordan
Tell us what you're skeptical about. Drop it in the comments -- the angle you can't stop chewing on.
10:45
Alex
Stay curious. Stay skeptical.
10:48
Jordan
Doubt both.
