Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Roblox cheat and one AI tool brought down Vercel's platform

webmatrices.com

Post reply on HN
Print view View original

141–150 of 186 posts

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#141

Post by apgwoz »

lemagedurage wrote: post #80
apgwoz wrote: post #4

Earlier quoted context omitted.

You pretty much have to assume someone is going to put sensitive data in an input like this. Encryption by default is the only sensible choice.

But the encrypted API key doesn't work, it needs to be decrypted first. Let's give the server access to the private key so it can decrypt the API key. We can do this by putting the private key in an env var. But now the private key is unencrypted. Ah, it doesn't work.

You’re thinking too much. When you run the app, the system decrypts the secrets and makes them available as env vars (or some other mechanism).

In an admin ui, you list the names of secrets only, and provide a “reveal” or a “replace” on each one. They are never decrypted unless explicitly asked for.

Is this perfect? Absolutely not. The key is controlled by the company, but it can be derived in a manner that doesn’t allow for the dump of everything if it’s leaked.

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#143

Post by kstrauser »

skywhopper wrote: post #100
kstrauser wrote: post #16

I think this is wrong about what “sensitive” means here. AFAIK, all Vercel env cars are encrypted. The sensitive checkbox means that a develop looking at the env var can’t see what value is stored there. It’s a write-only value. Only the app can see it, via an env var (which obviously can’t be encrypted in such a way that the app can’t see it, otherwise it’d be worthless). If you don’t check that box, you can view th…

But if they are readable to the “developer” then they are readable to anyone who gets access to the developer’s Vercel credentials. If Vercel provides a way to avoid that that didn’t get used, that’s the failure. Sure, you can quibble with the exact understanding of the author over whether they were “encrypted” or not. That’s not really the key factor here.

There are appropriate uses for both. Your database password should be write-only and not viewable later. Your time zone should be read-write for easy debugging when things to wrong. Vercel gives you both options. The user chose badly here, and IMO that’s not Vercel’s fault.

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#145

Post by SAI_Peregrinus »

cyanydeez wrote: post #98
ErroneousBosh wrote: post #62

Earlier quoted context omitted.

Exactly. How do you play back the encrypted DVD without having the decryption key right there on the player for everyone to find?

Keepass has an option to "encrypt in memory" certain passwords, sensitive information. The point of encryption is often times about what other software or hardware attacks are minimized or eliminated. However, if someone figures out access to a running system, theres really no way to both allow an app to run and keep everything encrypted. It certainly is possible, like the way keepass encrypts items in memory, but if…

Even Keepass's "encrypt in memory" option leaves that encryption key in memory, so it can auto-type or copy passphrases into form fields. It's an extra step, but not unbreakable.

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#146

Post by FatherOfCurses »

nippoo wrote: post #124

"I went through about a dozen AI tools I've personally authorized in the last year after reading this. Nine of them have Google Workspace OAuth permissions that include reading all emails and accessing all Drive files. Nine. I authorized every one of them without reading the permissions because the onboarding flow asked and I was in a hurry." Do other (tech-literate) people do this?! Giving anything access to my emai…

Boss: "Just slap something together for the meeting with the Big Cheese this afternoon."

(Engineer internal monologue) "OK I'll just agree to everything during setup, I can just tear it all down later."

Six months later the slapped together demo is the production release.

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#147

Post by syntaxing »

FatherOfCurses wrote: post #146
nippoo wrote: post #124

"I went through about a dozen AI tools I've personally authorized in the last year after reading this. Nine of them have Google Workspace OAuth permissions that include reading all emails and accessing all Drive files. Nine. I authorized every one of them without reading the permissions because the onboarding flow asked and I was in a hurry." Do other (tech-literate) people do this?! Giving anything access to my emai…

Boss: "Just slap something together for the meeting with the Big Cheese this afternoon." (Engineer internal monologue) "OK I'll just agree to everything during setup, I can just tear it all down later." Six months later the slapped together demo is the production release.

As the engineering saying goes, nothing more permanent than a temporary solution

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#148

Post by [deleted] »

StilesCrisis wrote: post #104
ethin wrote: post #5

This looks really really AI-generated even if the author did try to hide it by making some grammar elements improper. Idk if that diminishes it's accuracy though.

I had to stop reading. I have become overly sensitive to LLMisms. This is definitely "ChatGPT, read this article and rewrite it in a casual tone" with little to no actual authorship. On HN we should try to get primary sources for this sort of thing.

[deleted]

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#149

Post by pxc »

sitkack wrote: post #67
ErroneousBosh wrote: post #63

Earlier quoted context omitted.

Right? This isn't "A Roblox cheat and an AI tool", this is a failure of basic basic basic opsec across two organisations. One for which the Context.ai employee needs to have their arse booted up and down the car park for.

What about the context.ai security team? You can blame individuals, but security is a property of the system.

I doubt they had one. Context.ai got acquihired by OpenAI when it was still a very small company. I think they were winding down the original business, so it's unlikely that it grew after that.

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#150

Post by ethin »

post_below wrote: post #70
ethin wrote: post #5

This looks really really AI-generated even if the author did try to hide it by making some grammar elements improper. Idk if that diminishes it's accuracy though.

It's absolutely LLM prose, though not all of it. Maybe the author rewrote parts. The thing that concerns me is that even at a site like HN, where a lot of people are very familiar with LLMs, it seems to be passing. I hate to think this will become the norm but it's not the first HN linked post that's gotten a lot of earnest engagement despite being AI generated (or partly AI generated). I'm very comfortable with AI g…

The author did change some things to try to pass the LLM test. For example, they removed the apostrophe from I've. The problem, of course, is that this isn't enough to actually pass it, and the author would need to practically rewrite it in their own words to actually come off as natural.

And yes, I agree with you: it's sad seeing LLM-generated slop taking over the front page. I (possibly naively) hope that this trend starts reversing itself sometime soon, as HN is a valuable resource for me to discover new and fascinating things.

Post reply on HN