Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Incident Report: CVE-2024-YIKES

nesbitt.io

Post reply on HN
Print view View original

151–160 of 187 posts

Re: Incident Report: CVE-2024-YIKES

#151

Post by fallpeak »

scared_together wrote: post #121
bklosky wrote: post #58

According to Pangram, this is likely AI generated, surprised that no one has pointed this out

I never used Pangram before today, but since I've seen it mentioned many times on HN and I enjoyed reading the OP, I decided to try it. I am only using the free plan so let me know if I'm missing something. I am assuming the parent was referring to the tool hosted at pangram.com and not some other tool of the same name. Pangram indeed claims the OP is 76% AI-generated. It has "high confidence" (EDIT: some parts are "…

[dead]

Re: Incident Report: CVE-2024-YIKES

#153

Post by cbolton »

b40d-48b2-979e wrote: post #117
duped wrote: post #97

Earlier quoted context omitted.

sys crates are also mostly generated and lack a lot of eyeballs. Sneaking something into the build.rs of a sys crate would not be difficult and would land in the builds of everything downstream of it.

would not be difficult Surely that's why we see evidence of all these build script attacks, since it's so easy?

Remember the XZ backdoor? Or do you mean that Rust build script attacks are less likely? (Probably true but not much comfort)

Re: Incident Report: CVE-2024-YIKES

#154

Post by inventor7777 »

bpavuk wrote: post #53

the Karen one gave me a good laugh :D ;) reminds me of a `make`-based build script I once got when reviewing a classmate's project - it attempted to `rm -rf` my home folder if the hostname contains `bpavuk`. that was in seventh grade!!

That seems _awfully_ extreme LOL

Re: Incident Report: CVE-2024-YIKES

#155

Post by kibwen »

MarsIronPI wrote: post #109
kibwen wrote: post #61

Earlier quoted context omitted.

Contrary to what the article here presents, Rust does not have a culture of microlibraries like NPM does. The author and their LLM are cargo-culting a criticism of Rust made by people whose only experience is with the Node ecosystem. The Rust stdlib may not be especially "wide" compared to languages like Python, but it is quite deep, with the objective of making it so that you don't feel the need to publish single-pu…

What are you talking about? Every Rust project I see seems to have 5 dependencies that do some simple thing that should be in the standard library, or at least in some centrally-audited monolibrary of utilities.

Perhaps you're referring to things like regex and rand (each of which is itself multiple crates for the purpose of code organization), which are all first-party crates provided by the Rust organization itself, simply shipped and versioned separately from the standard library? If you trust the Rust organization enough to install and run the provided toolchain binaries on your machine, then you trust them enough to depend upon the dozens of crates that are provided under the umbrella of the Rust project.

Re: Incident Report: CVE-2024-YIKES

#156

Post by brazzy »

dasyatidprime wrote: post #139
yellowapple wrote: post #105

Earlier quoted context omitted.

Which then, inexplicably, pulls left-justify as a recursive dependency.

The dependency cycle is actually the functional mechanism of the code, because they subvert the dedup mechanism in the package manager using a random generation trick. Each recursive copy of the dependencies takes up a little bit more space, which ultimately gets converted to the spaces inserted into the original datum; the caller is expected to adjust the cache settings to signal the desired amount. That's also why…

So you're saying dependency resolution is Turing complete?

Re: Incident Report: CVE-2024-YIKES

#157

Post by red-iron-pine »

jmusall wrote: post #130
fvv wrote: post #126

Earlier quoted context omitted.

Just because it's not important to pay attention to CVEs, why not waste the readers' time by creating "fictional" CVEs without a disclaimer in the first line? Just because it's not already difficult to scrape through the information and noise on this internet... especially if it appears on the front page of hackernews

Could one mistake this > Status: Resolved (accidentally) > Severity: Critical → Catastrophic → Somehow Fine for a real CVE report?

next level NIST enrichment in action

Re: Incident Report: CVE-2024-YIKES

#158

Post by mwigdahl »

bakugo wrote: post #75

> Day 1, 03:14 UTC — Marcus Chen, maintainer of left-justify The dreaded Marcus Chen strikes again. https://www.reddit.com/r/ClaudeAI/comments/1o3b4q2/just_rece... https://news.ycombinator.com/item?id=47153675

That was the first thing that jumped out at me also...

Re: Incident Report: CVE-2024-YIKES

#159

Post by usui »

smsm42 wrote: post #93
lynndotpy wrote: post #12

For anyone confused, this is (very good imo) fiction about supply-chain incidents. It had me very worried during a brief scan that it was real though, which made me read it more attentively :)

Searching for CVE-2024-YIKES also provides a gallery of AI slop blogs that AI-rewrite the content of this post while being absolutely stone cold serious about it.

lmao https://youtu.be/-4-lDiCH0s8 https://youtu.be/ENYYI6eq4w0

pure slopnet

Re: Incident Report: CVE-2024-YIKES

#160

Post by isityettime »

fvv wrote: post #126
lynndotpy wrote: post #12

For anyone confused, this is (very good imo) fiction about supply-chain incidents. It had me very worried during a brief scan that it was real though, which made me read it more attentively :)

Just because it's not important to pay attention to CVEs, why not waste the readers' time by creating "fictional" CVEs without a disclaimer in the first line? Just because it's not already difficult to scrape through the information and noise on this internet... especially if it appears on the front page of hackernews

I saw a comment very similar to this on a blog post testing the Copy Fail exploit, where someone was complaining that without a tl;dr at the top, it took too much effort for them to find out whether the blog post documented a new exploit. In fact, reading less than a paragraph already showed that couldn't be the case; the table of contents is enough.

If a glance at the CVE number that isn't a number doesn't do it, a minute or less of skimming this article likewise reveals it to be satire on a blog that's actually pretty thoughtful when it comes to supply chain attacks.

Idk how else to characterize this except as a literacy problem. Learn to skim. It should be unacceptable to characterize a few minutes of reading as unbearable toil. If your time is really so precious that (although you can surf Hacker News) you can't spare 1-3 minutes to read, surely you have someone else to whom to delegate the responsibility of watching for supply chain attacks.

Why am I seeing this crop up over and over?

Post reply on HN