Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Over 100k Infected Repos Found on GitHub

apiiro.com

Post reply on HN
Print view View original

151–160 of 187 posts

Re: Over 100k Infected Repos Found on GitHub

#151

Post by fsflover »

prmoustache wrote: post #143
fsflover wrote: post #141

Earlier quoted context omitted.

Are you using an Nvidia GPU? https://github.com/QubesOS/qubes-issues/issues/5104 https://github.com/QubesOS/qubes-issues/issues/7591 If not, try this: https://github.com/QubesOS/qubes-issues/issues/6880#issuecom... There is no tearing on my Librem laptops.

Nope, but regarldess of drivers, xorg has never been pixel perfect and tearing do happens. You are just probably used to it but it is obvious once you have started using wayland how smoother your desktop becomes. It is the first time I hear about that Tearfree option and I am wondering. If it exists and it isn't the default behavior, it means there must be some annoying drawbacks right?

Perhaps I might be used to it, won't deny it. No idea about drawbacks from the workaround. Wayland transition is planned though: https://github.com/QubesOS/qubes-issues/issues/3366

Re: Over 100k Infected Repos Found on GitHub

#152

Post by butlike »

lolbullshit wrote: post #144
dns_snek wrote: post #86

Earlier quoted context omitted.

I'm less worried about backdoors accidentally appearing in LLM output and more worried about backdoors being placed into LLM output by 3 letter agencies. Maybe not today, but certainly in a few years time.

the government doesnt need to produce viruses anymore. They have escrow services and remote access to radios, processors, firmware chips. All that technology is leased to private investigators who are private entities and then they go after people using the tools. It allows distance between the government and spying, lower salaies and infrastructure costs. The greatest danger from LLMs is people who beleive they are…

One of the more useful settings I have is: "If the answer cannot be stated as it's been blocked upstream, please just respond with 'The answer has been blocked upstream.'"

I've gotten that a few times and it's nice to know it's not a limitation of the LLM.

Re: Over 100k Infected Repos Found on GitHub

#153

Post by zitterbewegung »

dspillett wrote: post #65

As well as this being our regular reminder to be careful what you pull from public repositories and other sources, and to verify your dependency trees, it raises another question: If malware is massively prolific in public repos, how much does this affect LLMs and other automation tools that are trained using the contents of such resources? What are the chances that we'll see copilot & friends occasionally emit malwa…

Datasets will probably move toward a curated datasets instead of scraping everything from the Internet. Also you could add a tool that would have the purpose of identifying malware and reject the output like using virustotal

Re: Over 100k Infected Repos Found on GitHub

#154

Post by thriftwy »

zitterbewegung wrote: post #153
dspillett wrote: post #65

As well as this being our regular reminder to be careful what you pull from public repositories and other sources, and to verify your dependency trees, it raises another question: If malware is massively prolific in public repos, how much does this affect LLMs and other automation tools that are trained using the contents of such resources? What are the chances that we'll see copilot & friends occasionally emit malwa…

Datasets will probably move toward a curated datasets instead of scraping everything from the Internet. Also you could add a tool that would have the purpose of identifying malware and reject the output like using virustotal

Why not just ask LLM whether it thinks the snippet is kooky, before adding it into LLM training set?

You don't need tools in the age of AI, just ass an AI pipeline step.

Re: Over 100k Infected Repos Found on GitHub

#156

Post by pants2 »

pantulis wrote: post #45

In the good old days you could check the MD5 checksums of mostly everything you downloaded. But then you had to trust the website that published the checksums themselves.

On the flip side, you would hope that the malicious binaries in these packages have already been flagged by antivirus providers.

Re: Over 100k Infected Repos Found on GitHub

#157

Post by richbell »

yencabulator wrote: post #107
justinclift wrote: post #88

Wonder if the whole curl + sudo shell script installer thing is going to come to an end any time soon? aka the whole "just run 'curl https://somesite/install.sh ' | sudo sh" to install our software Seems like it'd go very hand in hand with this infected stuff mentioned in the article.

Unfortunately `npm i` has the same power. `go get` is the only common dependency downloader I am currently aware of where hostile code doesn't run at install or build time. I think we need better tooling for working in sandboxes, to at least compartmentalize the explosion. ChromeOS's "virtual machines can open Wayland windows on the main desktop" trick is neat, but the code needed to do that was less than clean or re…

> `go get` is the only common dependency downloader I am currently aware of where hostile code doesn't run at install or build time.

Maven is the same way, AFAIK.

Re: Over 100k Infected Repos Found on GitHub

#158

Post by [deleted] »

mgii wrote: post #115
hollerith wrote: post #56

Earlier quoted context omitted.

Although finding over 100k infected repos is not good, it does not mean github is failing because the kind of programmer who would include an infected repo can find many other ways to create an insecure product if there weren't infected repos on github.

To be fair, the kind of programmer who would include an infected repo is almost everyone. Many infected repos have no indicators except for username to help you notice without a careful examination, especially in niche repos. When you have to move fast, it's natural to make such mistakes.

[deleted]

Re: Over 100k Infected Repos Found on GitHub

#159

Post by legohead »

lolbullshit wrote: post #144
dns_snek wrote: post #86

Earlier quoted context omitted.

I'm less worried about backdoors accidentally appearing in LLM output and more worried about backdoors being placed into LLM output by 3 letter agencies. Maybe not today, but certainly in a few years time.

the government doesnt need to produce viruses anymore. They have escrow services and remote access to radios, processors, firmware chips. All that technology is leased to private investigators who are private entities and then they go after people using the tools. It allows distance between the government and spying, lower salaies and infrastructure costs. The greatest danger from LLMs is people who beleive they are…

If you're going to make a wild claim like that on HN you should source it.

Re: Over 100k Infected Repos Found on GitHub

#160

Post by bastardoperator »

UrineSqueegee wrote: post #61
silvestrov wrote: post #54

Github is failing the same way usenet failed: everybody could post stuff to usenet just like everybody can create a github repository and there is nothing that sets an official repository apart from a spammers repository. When Amazon has "the everything store" as main strategic goal, they get hit by "90% of everything is junk". So they end up being a store of mostly junk. Github should figure out if their product is…

I don't think you truly grasp how small this number is, this is actually good, like really really good. Github has about half a billion repositories.

Exactly, GitHub claims to have 400M+ repos making this number 0.025% of repos. I'm sure they could get it lower but less than half of 1% is pretty damn good.

As a developer I have to do some due diligence about where I'm getting my data from. If I'm slurping in random repos because the name matches that's a people problem, not a github specific problem.

Post reply on HN