Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft's open source tools were hacked to steal passwords of AI developers

techcrunch.com

Post reply on HN
Print view View original

41–50 of 211 posts

Re: Microsoft's open source tools were hacked to steal passwords of AI developers

#41

Post by nicce »

wolfi1 wrote: post #23
zihotki wrote: post #16

And the best recommendation security teams can give - keep your SBOM strict, use min release age policy (sounds more like band-aid). That's a scary world to live in.

a friend of mine has a very different solution: he codes everything by hand. he says that the time you need to research to include a new package you can actually use to code the piece you need. and he for sure doesn't have the problems of transitive dependencies

Depending of the scenario, it can be very fine. E.g. if you just need one or two function call from the dependency. However, for some complex binary protocols it might be better to stick with libraries.

Re: Microsoft's open source tools were hacked to steal passwords of AI developers

#42

Post by black_knight »

_pdp_ wrote: post #13

What follows next is purely speculation and it is based on my own observations and thoughts but based on what I've seen the old RBAC models, while being almost broken before, now it is fully broken, with the fact that now coding assistants and engineers are working on multiple unrelated projects simultaneously - especially working on wild experiments they had no time for previously. The risk of supply chain issue has…

Do you mean that role based access control (RBAC) should be replaced by something else? Or that just the specific RBAC models in use are broken?

I personally think the, perhaps confusingly named, capability based security models are the way of The Future.

Re: Microsoft's open source tools were hacked to steal passwords of AI developers

#43

Post by sourcecodeplz »

raincole wrote: post #26

> steal passwords of AI developers What does this even mean? The malware specifically steals passwords from developers who use AI? From those who develop AI tool? Or it steals API tokens, which serve a similar function as passwords do for humans? Is this what journalism looks like today? Just slap the two holy letters on the title and you get views? (Yes, I read the article. No, I still don't think the title makes se…

Do I remember correctly when techcrunch was charging $10k per month for a square banner on its website, 2005? And that was considered the top, for a tech blog. Even then they posted slop.

Re: Microsoft's open source tools were hacked to steal passwords of AI developers

#45

Post by _pdp_ »

sourcecodeplz wrote: post #35
_pdp_ wrote: post #13

What follows next is purely speculation and it is based on my own observations and thoughts but based on what I've seen the old RBAC models, while being almost broken before, now it is fully broken, with the fact that now coding assistants and engineers are working on multiple unrelated projects simultaneously - especially working on wild experiments they had no time for previously. The risk of supply chain issue has…

one could also vibe-code vanilla, no dependencies.

You can vibe code safely for sure.

I am not saying vibe coding is the issue. The issue is that a typical developer might be working on a lot more projects that run concurrently then they used to. And because of the various nature of the project the risk is significantly increased.

Scale this across the workforce and you not just doubled the problem.

Re: Microsoft's open source tools were hacked to steal passwords of AI developers

#47

Post by test20201 »

bob1029 wrote: post #20

I strongly suspect this is a case of classic personal access tokens being used in an unclean way. If you are going to be handing tokens to AI agents on weird openclaw contraptions, you should try to use the fine grained variants. My GitHub account spans 3 organizations with wildly differing policies. The fact that classic tokens are even still allowed blows my mind a bit. You should be required to manually opt in eac…

You are correct but the issue is permission management with finegrained tokens is nighmare. It is not easy to decide what is correct and what is needed for some operation. Furthermore, often software devs think it is important to focus on code rather than permissions - as it is for someone else's responsibility....

Re: Microsoft's open source tools were hacked to steal passwords of AI developers

#48

Post by _pdp_ »

altairprime wrote: post #34
_pdp_ wrote: post #13

What follows next is purely speculation and it is based on my own observations and thoughts but based on what I've seen the old RBAC models, while being almost broken before, now it is fully broken, with the fact that now coding assistants and engineers are working on multiple unrelated projects simultaneously - especially working on wild experiments they had no time for previously. The risk of supply chain issue has…

I argued for years that we had too few workers for our total project count and management argued that most projects were idle and so it was fine to have so many per worker. Welp.

I think web-based IDEs like GitHub Codespaces (but even VSCode with tunnels) is part of the solution because at the very least you can get an isolated dev environment per project. I've been advocating for this for as long as I remember.

Unfortunately, most developers don't like them so it is a though sell.

Re: Microsoft's open source tools were hacked to steal passwords of AI developers

#49

Post by hsbauauvhabzb »

wolfi1 wrote: post #23
zihotki wrote: post #16

And the best recommendation security teams can give - keep your SBOM strict, use min release age policy (sounds more like band-aid). That's a scary world to live in.

a friend of mine has a very different solution: he codes everything by hand. he says that the time you need to research to include a new package you can actually use to code the piece you need. and he for sure doesn't have the problems of transitive dependencies

But now he needs to develop, test and maintain that code. Left pad is easily hand coded, react framework not so much.

Re: Microsoft's open source tools were hacked to steal passwords of AI developers

#50

Post by sunaookami »

protoman3000 wrote: post #9

And we trust these people with the root CA cert in our Secure Boot?

No one should be foolish enough to trust Microsoft with anything regarding security. They showed time and time again over the past 40 years that they don't care.
Post reply on HN