Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft's open source tools were hacked to steal passwords of AI developers

techcrunch.com

Post reply on HN
Print view View original

141–150 of 211 posts

Re: Microsoft's open source tools were hacked to steal passwords of AI developers

#141

Post by doubled112 »

renegade-otter wrote: post #121
wolvoleo wrote: post #117

Earlier quoted context omitted.

> Now in many places it is encouraged by coders and managers to vibe stuff on their own devices. Soon or later it will become a problem, especially for those that have no idea what they are doing. Yes in our place too. "You better do as much as possible with AI or you will be left behind" dogmas etc. It's the stupid IoT hype all over again. No concern for security, just trying to be the first in the pack.

"MongoDB is the hottest thing! No default creds, who cares about that! ONWARD TO PRODUCTION, SOLDIERS!"

Instead of learning from past mistakes, it seems we need to keep making the same ones over and over.

Re: Microsoft's open source tools were hacked to steal passwords of AI developers

#142

Post by wolfi1 »

dgellow wrote: post #29
wolfi1 wrote: post #23

Earlier quoted context omitted.

a friend of mine has a very different solution: he codes everything by hand. he says that the time you need to research to include a new package you can actually use to code the piece you need. and he for sure doesn't have the problems of transitive dependencies

I assume that means he genAIs all his deps? Rather than writing by hand

he does not use them

Re: Microsoft's open source tools were hacked to steal passwords of AI developers

#143

Post by josefx »

watty wrote: post #103
_pdp_ wrote: post #13

What follows next is purely speculation and it is based on my own observations and thoughts but based on what I've seen the old RBAC models, while being almost broken before, now it is fully broken, with the fact that now coding assistants and engineers are working on multiple unrelated projects simultaneously - especially working on wild experiments they had no time for previously. The risk of supply chain issue has…

Just to clarify, and I know you weren't saying they are related, but this has absolutely nothing to do with AI or vibe coding or manager code. It's a continuation of the Shai Halud worm and the lack of security around developer dependnecy installations, which has existed for a very long time. Hackers have figured out that developers themselves are an ideal target due to how easy it is to trick them into installing so…

> due to how easy it is to trick them into installing something

You have tools from large corporations where the official installation procedure involves copy pasting a command from a random blog post, run it with sudo and watch it download and execute a script from a random filehost. This is somehow deemed acceptable by everyone involved.

Meanwhile I can't use teams in our meeting rooms, since any form of internet access was deemed a security risk in rooms where customer projects could be discussed. This is in a day and age where 90% of customer meetings are done over the internet.

Anyone trying to follow sane practices in this industry just asks to end up in a padded cell.

Re: Microsoft's open source tools were hacked to steal passwords of AI developers

#144

Post by wolvoleo »

doubled112 wrote: post #141
renegade-otter wrote: post #121

Earlier quoted context omitted.

"MongoDB is the hottest thing! No default creds, who cares about that! ONWARD TO PRODUCTION, SOLDIERS!"

Instead of learning from past mistakes, it seems we need to keep making the same ones over and over.

It has all happened before and it will all happen again :)

Re: Microsoft's open source tools were hacked to steal passwords of AI developers

#145

Post by marcosdumay »

sph wrote: post #54
antiloper wrote: post #4

Earlier quoted context omitted.

AI;DR: Azure (49) azure-functions-agents-runtime azure-functions-connector-extension azure-functions-core-tools azure-functions-docker azure-functions-dotnet-extensions azure-functions-dotnet-worker azure-functions-durable-extension azure-functions-durable-js azure-functions-durable-powershell azure-functions-durable-python azure-functions-extension-bundles azure-functions-golang-worker azure-functions-host azure-fun…

There is such a thing as too much software.

Microservices have got all the attention, but at around the same time there existed the microlibraries fashion too.

And just like the other one, the people proposing those microlibraries knew what they were doing and had actually reasonable ideas. But masses of FAANG developers took it and run wild.

Re: Microsoft's open source tools were hacked to steal passwords of AI developers

#146

Post by yoyohello13 »

I had to reset my personal Microsoft account password yesterday because I got a two factor alert about a log in attempt from Romania. I can’t figure out how they got my password though because the only Microsoft product I own is an Xbox. Even before ai though Microsoft leaks like a sieve. I wish my company would move off them, but we are locked in.

Re: Microsoft's open source tools were hacked to steal passwords of AI developers

#148

Post by ndsipa_pomu »

doubled112 wrote: post #141
renegade-otter wrote: post #121

Earlier quoted context omitted.

"MongoDB is the hottest thing! No default creds, who cares about that! ONWARD TO PRODUCTION, SOLDIERS!"

Instead of learning from past mistakes, it seems we need to keep making the same ones over and over.

Time is a flat circle

Re: Microsoft's open source tools were hacked to steal passwords of AI developers

#149

Post by ashishb »

Bnjoroge wrote: post #112
ashishb wrote: post #51

Nobody should do 'npm install' or 'pip install' on their machine. Using a proper sandboxing( https://github.com/ashishb/amazing-sandbox ) regularly will drastically limit the blast radius of these attacks.

Docker isn’t a serious sandboxing strategy

This has been responded to in the past by another HN poster: https://news.ycombinator.com/item?id=47612726

Furthermore, you can use native sandboxing on macOS if you prefer.

If neither looks serious to you, then please educate me on a better sandboxing approach.

Re: Microsoft's open source tools were hacked to steal passwords of AI developers

#150

Post by ashishb »

8organicbits wrote: post #104
ashishb wrote: post #51

Nobody should do 'npm install' or 'pip install' on their machine. Using a proper sandboxing( https://github.com/ashishb/amazing-sandbox ) regularly will drastically limit the blast radius of these attacks.

Is there a detection component here too? Sandboxing development is great, but the next step is to deploy to production. How do you know if something malicious happened in the sandbox, such that you don't deploy the malware further?

I have some ideas around it. And indeed that's one likely direction of this project in the future.
Post reply on HN