[flagged]
Microsoft's open source tools were hacked to steal passwords of AI developers
171–180 of 211 posts
Re: Microsoft's open source tools were hacked to steal passwords of AI developers
#172Earlier quoted context omitted.
Instead of learning from past mistakes, it seems we need to keep making the same ones over and over.
It has all happened before and it will all happen again :)
I just finished watching that series, so I can pick up these references. Nothing like being 20 years late to the party
Re: Microsoft's open source tools were hacked to steal passwords of AI developers
#173Wasn't there some directive within Microsoft to fix their security issues?
How many other OSS repos of similarly sized companies get compromised like this?
No one ever got fired for choosing IBM or AWS - but apparently Microsoft has a decades long free pass everywhere.
Insane.
Re: Microsoft's open source tools were hacked to steal passwords of AI developers
#174I strongly suspect this is a case of classic personal access tokens being used in an unclean way. If you are going to be handing tokens to AI agents on weird openclaw contraptions, you should try to use the fine grained variants. My GitHub account spans 3 organizations with wildly differing policies. The fact that classic tokens are even still allowed blows my mind a bit. You should be required to manually opt in eac…
If classic PATs were to blame, doesn't this mean further private repos could be at risk as well? (apart from the GitHub ones the other day).
Re: Microsoft's open source tools were hacked to steal passwords of AI developers
#175Remember folks Microsoft has Mythos access
No, it's Mythos that has access to Microsoft now :-)
Re: Microsoft's open source tools were hacked to steal passwords of AI developers
#176Earlier quoted context omitted.
I created a mitigation tool that can be used to fix/remove the worm from all infected repositories, and did a writeup about this. On Monday, the Hades campaign introduced Composer, Go and Pip support. Before that it had only support for NPM and AI assistant editors. (Well, and Ruby btw but nobody uses Rubygems anymore it seems). What even Microsoft gets wrong: This is the first worm that runs on all platforms in the…
It only spreads if you run the code...
No, it spreads if you open a folder. That's the point why developers all underestimate the worm's capabilities.
Re: Microsoft's open source tools were hacked to steal passwords of AI developers
#177Earlier quoted context omitted.
Just to clarify, and I know you weren't saying they are related, but this has absolutely nothing to do with AI or vibe coding or manager code. It's a continuation of the Shai Halud worm and the lack of security around developer dependnecy installations, which has existed for a very long time. Hackers have figured out that developers themselves are an ideal target due to how easy it is to trick them into installing so…
> due to how easy it is to trick them into installing something You have tools from large corporations where the official installation procedure involves copy pasting a command from a random blog post, run it with sudo and watch it download and execute a script from a random filehost. This is somehow deemed acceptable by everyone involved. Meanwhile I can't use teams in our meeting rooms, since any form of internet a…
> This is somehow deemed acceptable by everyone involved
By some, not all. It's been crazy from the start and it is still crazy to pipe a script to bash!
Re: Microsoft's open source tools were hacked to steal passwords of AI developers
#178Earlier quoted context omitted.
Why do most developers not like it? Is it because the browser is a terrible platform for text editors since there is no proper key mapping, or access to proper debuggers, or there is too much latency, and no access to cli tools? You make it sound like you are surprised, but everyone who has tried this knows it's crap and a band aid at best.
I really tried to give vscode an honest shot. I couldn't find anything about it that was even half as good as a real text editor. It made writing code feel like a chore. I usually love writing code.
What is a real text editor, by your estimation? NVim? Emacs? Genuinely curious.
I use VSCode/Codium since I maintain a GUI stack for general usage. But I have all the terminal tools installed for my work there as well. I hate customizing things too, which I find is necessary if you want to get the most out of terminal text editors. VSCode is pretty good out of the box, with terminal access and everything built in.
Jeez, I hope this doesn't turn into a text editor flame war...
Re: Microsoft's open source tools were hacked to steal passwords of AI developers
#179Earlier quoted context omitted.
It feels to me like AI agents should be their own security principals and use access tokens generated speficically for them on the repos or orgs that they need access to. Handing an AI agent an access token "minted" for a human's account feels to me like the new "write the password on a post-it".
Not just AI agents... basically, if you cd Projects/foo, that should be it's own user (for running npm, etc) that should not have access to parent user data (probably including github tokens, etc).
> basically, if you cd Projects/foo, that should be it's own user
Agreed. I went further and turned that into its own isolated virtual machine. The credentials problem is really annoying though. AI agents need the access in order to be useful.
Re: Microsoft's open source tools were hacked to steal passwords of AI developers
#180Earlier quoted context omitted.
Instead of learning from past mistakes, it seems we need to keep making the same ones over and over.
Time is a flat circle
Time is a cube.