Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft's open source tools were hacked to steal passwords of AI developers

techcrunch.com

Post reply on HN
Print view View original

111–120 of 211 posts

Re: Microsoft's open source tools were hacked to steal passwords of AI developers

#111

Post by ianmarcinkowski »

haute_cuisine wrote: post #55

Please, someone explain how it's possible to add obfuscated file to so many repositories? Do they don't have any code reviews? Also, the title is misleading, setup adds config to be auto executed by people who work on the repo. They would have to use vscode/cursor/claude/gemini. People who use codex / opencode / other harnesses are safe I guess. Details: https://www.stepsecurity.io/blog/miasma-worm-hits-microsoft-...

Coworker seriously asked "since we're generating most of our code now, who is actually reading all of the code?" We're at a small company, but the urge to trust The Oracle is almost spiritual with some people IMHO.

I read 90%+ of the code I generate by reviewing it like I would a junior developer. I'm heavily vibe-coding a new feature right now and it's going to get a thorough reading as soon as GitHub's PRs start working again

Re: Microsoft's open source tools were hacked to steal passwords of AI developers

#112

Post by Bnjoroge »

ashishb wrote: post #51

Nobody should do 'npm install' or 'pip install' on their machine. Using a proper sandboxing( https://github.com/ashishb/amazing-sandbox ) regularly will drastically limit the blast radius of these attacks.

Docker isn’t a serious sandboxing strategy

Re: Microsoft's open source tools were hacked to steal passwords of AI developers

#113

Post by raincole »

trumpdong wrote: post #74
raincole wrote: post #26

> steal passwords of AI developers What does this even mean? The malware specifically steals passwords from developers who use AI? From those who develop AI tool? Or it steals API tokens, which serve a similar function as passwords do for humans? Is this what journalism looks like today? Just slap the two holy letters on the title and you get views? (Yes, I read the article. No, I still don't think the title makes se…

> you can skip the slop and read the real information here: (link that is obviously written by AI)

And?

If the techchurch post is written by a human then I'll take this as an example that humans outslop AI.

Re: Microsoft's open source tools were hacked to steal passwords of AI developers

#114

Post by nosioptar »

63stack wrote: post #89
_pdp_ wrote: post #48

Earlier quoted context omitted.

I think web-based IDEs like GitHub Codespaces (but even VSCode with tunnels) is part of the solution because at the very least you can get an isolated dev environment per project. I've been advocating for this for as long as I remember. Unfortunately, most developers don't like them so it is a though sell.

Why do most developers not like it? Is it because the browser is a terrible platform for text editors since there is no proper key mapping, or access to proper debuggers, or there is too much latency, and no access to cli tools? You make it sound like you are surprised, but everyone who has tried this knows it's crap and a band aid at best.

I really tried to give vscode an honest shot.

I couldn't find anything about it that was even half as good as a real text editor.

It made writing code feel like a chore. I usually love writing code.

Re: Microsoft's open source tools were hacked to steal passwords of AI developers

#116

Post by SAI_Peregrinus »

trumpdong wrote: post #78
Zolomon wrote: post #32

Earlier quoted context omitted.

It was never safe to begin with, that is why the security community has been screaming for resources since the 80s.

If the security community had unlimited resources you wouldn't be able to do very much with computers. Security and usability are opposite ends of a spectrum. Either you can do a lot (usability) or you can do little (security).

Disagree, availability is part of security. That's why denial of service attacks are a security issue. Bad enough usability is indistinguishable from a DoS attack.

Re: Microsoft's open source tools were hacked to steal passwords of AI developers

#117

Post by wolvoleo »

_pdp_ wrote: post #13

What follows next is purely speculation and it is based on my own observations and thoughts but based on what I've seen the old RBAC models, while being almost broken before, now it is fully broken, with the fact that now coding assistants and engineers are working on multiple unrelated projects simultaneously - especially working on wild experiments they had no time for previously. The risk of supply chain issue has…

> Now in many places it is encouraged by coders and managers to vibe stuff on their own devices. Soon or later it will become a problem, especially for those that have no idea what they are doing.

Yes in our place too. "You better do as much as possible with AI or you will be left behind" dogmas etc.

It's the stupid IoT hype all over again. No concern for security, just trying to be the first in the pack.

Re: Microsoft's open source tools were hacked to steal passwords of AI developers

#118

Post by bdcravens »

opsnooperfax wrote: post #115

And the criminals found that Microsoft has yet to produce and AI worth stealing. A deeply ironic twist.

That makes for a funny tongue in cheek comment, but it's not MS's AI they're after, it's end user secrets, and the exploits target multiple LLMs. (by adding commands to relevant MD files)

Re: Microsoft's open source tools were hacked to steal passwords of AI developers

#119

Post by stogot »

shakna wrote: post #37
protoman3000 wrote: post #9

And we trust these people with the root CA cert in our Secure Boot?

You mean the company that failed their 2023 security review? [0] > Individually, any one of the failings described above might be understandable. Taken together, they point to a failure of Microsoft’s organizational controls and governance, and of its corporate culture around security. Microsoft’s products and services are ubiquitous. It is one of the most important technology companies in the world, if not the most…

Bonkers that this wasn’t bigger news

Re: Microsoft's open source tools were hacked to steal passwords of AI developers

#120

Post by vasco »

sourcecodeplz wrote: post #35
_pdp_ wrote: post #13

What follows next is purely speculation and it is based on my own observations and thoughts but based on what I've seen the old RBAC models, while being almost broken before, now it is fully broken, with the fact that now coding assistants and engineers are working on multiple unrelated projects simultaneously - especially working on wild experiments they had no time for previously. The risk of supply chain issue has…

one could also vibe-code vanilla, no dependencies.

You can also fork everything and maintain local versions that you much more easily resolve conflicts with upstream with AI and get the best of both worlds while you work through the backlog of internally reimplementing all dependencies, which even with AI will take a long time.
Post reply on HN