Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Incident Report: CVE-2024-YIKES

nesbitt.io

Post reply on HN
Print view View original

141–150 of 187 posts

Re: Incident Report: CVE-2024-YIKES

#141

Post by freakynit »

Root Cause: "A dog named Kubernetes ate a YubiKey."

Technically... that's not even a joke... that really is what kicked off this entire chain of events lol.

This post reads like an actual movie lol. Someone seriously needs to make one based on this.

It has everything:

the missing key that starts the chaos, the scam nobody sees coming, one tiny mistake turning into a full-on domino disaster, sleep-deprived people making very confident bad decisions, the guy who disappeared to a farm living his best life while holding a critical piece of the puzzle... and somehow, in the final act, a completely unrelated villain accidentally saves everyone.

Imma 100% watch it..

Re: Incident Report: CVE-2024-YIKES

#142

Post by ninjalanternshk »

furyofantares wrote: post #69
peyton wrote: post #67

Earlier quoted context omitted.

The author suddenly began writing a post per day around November 2025. They’re all tongue-in-cheek. I believe you are wrong.

Huh, neat. I will take a look at those. And actually I see it clearly now, it has a bunch of signs I have called out multiple times myself. (It is entirely made out of lists of various types, and never states an opinion.) Just my ego getting hold of me because I didn't realize it on my own.

I’m also struggling with this being AI. The blog owner is a real person who’s made significant contributions to the community for years. His post timeline is organic - wayback machine confirms they were published on the dates they show. So it’s definitely not a bot running the blog.

Whether (or to what extent) he uses AI to generate the content he posts is a valid question.

I agree with your earlier reasoning that this is far more clever than anything I’ve seen AI produce yet. Lots of AI humor is dad-joke level at best. If it is AI then he’s trained it on a hand-curated collection of top-shelf satire.

Re: Incident Report: CVE-2024-YIKES

#143

Post by ChrisSD »

MarsIronPI wrote: post #109
kibwen wrote: post #61

Earlier quoted context omitted.

Contrary to what the article here presents, Rust does not have a culture of microlibraries like NPM does. The author and their LLM are cargo-culting a criticism of Rust made by people whose only experience is with the Node ecosystem. The Rust stdlib may not be especially "wide" compared to languages like Python, but it is quite deep, with the objective of making it so that you don't feel the need to publish single-pu…

What are you talking about? Every Rust project I see seems to have 5 dependencies that do some simple thing that should be in the standard library, or at least in some centrally-audited monolibrary of utilities.

Can you name 5 as an example?

Re: Incident Report: CVE-2024-YIKES

#144

Post by pocksuppet »

cassianoleal wrote: post #32
david_shaw wrote: post #27

Earlier quoted context omitted.

He certainly popularized it (maybe coined it), but I've seen a lot of organizations and developers repeat that mantra. Even without the specific words, look to product teams debating tradeoffs of going to market vs. waiting for better security controls. They're pushing for faster product release every time, at pretty much every org.

In any case, not really a hacker's creed. This has always been withinin the realm of corporations, especially Silicon Valley or adjacent.

Hackers were moving fast and breaking things first. Faster than any corporation in fact. We didn't notice because their computers weren't powering anything useful. How do you think projects like GNU happened?

Re: Incident Report: CVE-2024-YIKES

#145

Post by rmoriz »

ineedasername wrote: post #83

>"The legitimate maintainer has won €2.3 million in the EuroMillions and is researching goat farming in Portugal..." > "Root Cause: A dog named Kubernets ate a Yubikey Ah, yes, irresponsible to get taken in by one of the well-known classic exploits. The 'ol "distract someone with a lottery windfall & make a dongle irresistibly tasty to another person's pet". When will people learn.

I switched to EuroJackpot /s

Re: Incident Report: CVE-2024-YIKES

#147

Post by CoastalCoder »

zahlman wrote: post #100
lynndotpy wrote: post #12

For anyone confused, this is (very good imo) fiction about supply-chain incidents. It had me very worried during a brief scan that it was real though, which made me read it more attentively :)

"left-justify" absolutely slayed me :)

Would explain why most of the download traffic comes from the Middle East :)

Re: Incident Report: CVE-2024-YIKES

#148

Post by CoastalCoder »

pornel wrote: post #80
zbentley wrote: post #24

Earlier quoted context omitted.

Why? Honest question. Commons, Guava, Spring, and more seem to take this approach successfully (as in, the drawbacks are outweighed by the benefits in convenience, quality, and security) in Java. Are benefits in binary size really worth that complexity? And before someone says “just have a better standard library”, think about why that is considered a solution here. Languages with a large and capable standard library…

Why? It's the essence of "Simple Made Easy": you don't have other code to complect with. You have a smaller interface, focused on a singular goal. When a library has to work as a standalone project, it can't be accidentally entangled with other components of a larger project. Smaller implementations are also easier to review against malware, because there are fewer places to hide. You don't have to guess how a compon…

Tangent, but thanks for adding "complect" to my vocabulary!

Re: Incident Report: CVE-2024-YIKES

#149

Post by asah »

asah wrote: post #36
cassianoleal wrote: post #32

Earlier quoted context omitted.

In any case, not really a hacker's creed. This has always been withinin the realm of corporations, especially Silicon Valley or adjacent.

MFABT is about survival. Don't hate the player, hate the game.

[flagged]
Post reply on HN