331–340 of 359 posts
Earlier quoted context omitted.
Disabling vscode/cursor extensions auto-updates also makes sense
Can that even be done? Even if there are knobs you can turn to disable auto updates, does that cover everything that decides to change your software behind your back?
Earlier quoted context omitted.
does it have some kind of sandboxing for its extensions?
The extension capability is much less powerful than VSCode (no embedded web view) so it's a lot harder to pull off crazy stuff. All of the language support is done via language servers.
That's the reason I stopped installing random extensions and even themes in VS Code, they are too dangerous.
How hard would it be to have one installation step to be to have Claude read through all the code to the extension and strip out anything that looks risky (ie. Calls out to external servers).? Do that automatically for all code downloaded from the web and run outside a sandbox. Maybe won't catch everything, but should catch most evil stuff, especially if a variety of models and prompts are used.
Unfortunately if it was from a compromised extension this is going to be more justification for creating closed environments like what Google is doing with android and Apple has already done with iPhone.
In the age of LLMs, vetting can even be done in a CI/CD. What's the big deal?
- Use Static analysis for GHA to catch security issues: https://github.com/zizmorcore/zizmor - set locally: pnpm config set minimum-release-age 4320 # 3 days in minutes https://pnpm.io/supply-chain-security for other package managers check: https://gist.github.com/mcollina/b294a6c39ee700d24073c0e5a4e... - add Socket Free Firewall when installing npm packages on CI https://docs.socket.dev/docs/socket-firewall-free#git…
Pre-AI, having access to code (e.g. if it leaked or even just open source) could allow hackers to more easily discover exploits. I wonder if that threat is now much more severe in the age of AI. Thankfully GitHub have probably themselves run their code through many AI security tools so any vulnerabilities would have already been found and patched. Hopefully.
I just had a disturbing thought. What if the LLM providers start blocklisting certain codebases? “I’m sorry Dave, I can’t do that. This codebase has been identified as proprietary.”
If you work at github can you see everyone's private repos?
Well yeah, they need that to do maintenance work. They can see my company's private repos from our enterprise contract, so they can absolutely see your personal ones.
Earlier quoted context omitted.
Where is this list from?
Everytime it is BreachForums: https://breached.st/threads/internal-github-source-code.8739...
I'm sorry for Sophie.
Earlier quoted context omitted.
I’m in a location where Apple Maps is significantly better than Google’s. So I’m unsure if you mean ”it’s Apple Maps meme bad” or if you just mean ”it’s rather meh, could be better, could be worse”.
I think bad: https://youtu.be/tVq1wgIN62E?is=GOTAfXSie70pln-W
Earlier quoted context omitted.
> they got some alert that the app was attempting to access browser credentials :( That sounds pretty specific.
According to the email I initially received for this alert, zed.exe was attempting to access its own folder within the AppData directory. Nothing more normal than that, no? No idea how that related to what I was told by the sec people shortly afterwards.