Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft's open source tools were hacked to steal passwords of AI developers

techcrunch.com

Post reply on HN
Print view View original

191–200 of 211 posts

Re: Microsoft's open source tools were hacked to steal passwords of AI developers

#191

Post by romaniv »

LastTrain wrote: post #101
axegon_ wrote: post #66

Earlier quoted context omitted.

> Do they don't have any code reviews? I have a good friend that works for one of the giants(I can't say which one for obvious reasons but S&P 500). He's been working there for quite a while now, so far he hasn't seen what the project he works on looks like, has the repo cloned and knows what language is used but nothing beyond that. Everything is slopped together. His project is the authentication and authorization…

> have a good friend that works for one of the giants(I can't say which one for obvious reasons but S&P 500). I can’t think of any obvious reason other than this being embellished / made up? Those companies have tens of thousands of employees you aren’t going to “out” anyone by naming the company.

First, it's not made up. I've heard numerous stories of this sort (maybe a bit less extreme) from people I have known for many years working for large and mid-sized companies. Second, large companies have entire teams for monitoring social media and they absolutely will try to zero in on you and fire you if you speak too much about their crappy internal processes. This goes double for anything in S&P 500.

Re: Microsoft's open source tools were hacked to steal passwords of AI developers

#192

Post by wolvoleo »

abustamam wrote: post #188
wolvoleo wrote: post #186

Earlier quoted context omitted.

Has it been 20 years already? Wow. Yeah it was a good one (though a little too gritty for me sometimes)

Apparently I'm late to the party too! What is this from?

Battlestar Galactica remake

Re: Microsoft's open source tools were hacked to steal passwords of AI developers

#193

Post by mattfields »

cookiengineer wrote: post #176
philipwhiuk wrote: post #130

Earlier quoted context omitted.

It only spreads if you run the code...

No, it spreads if you open a folder. That's the point why developers all underestimate the worm's capabilities.

This ^

Re: Microsoft's open source tools were hacked to steal passwords of AI developers

#195

Post by narrator »

RetroTechie wrote: post #92
narrator wrote: post #21

Earlier quoted context omitted.

What if this is "The Great Filter?" [Ominous music plays in the background]

That would be when we've automated stuff to the point where [machinery breaking down] causes a large majority of humans to die from starvation. And then go on to repeat that mistake by re-building without using the lessons from previous catastrophe(s). Sadly that last part sounds fairly common for humans... 8-| So yeah. Maybe. Possible.

We're already there since without the Haber–Bosch process billions would starve.

Re: Microsoft's open source tools were hacked to steal passwords of AI developers

#196

Post by mattfields »

bilekas wrote: post #18

The phrasing of the title is loaded and the content phrases it as some kind of fault of open source. Then, which I find the most amusing, proceeds to blame MicroSlop for the attempted suuply chain attack, > Microsoft did not immediately provide the specific number of customers affected, when asked by TechCrunch. Yeah, because that's how open source works. Tech crunch doing hard work no not explain that. > This is Mic…

That's the thing: they do bear responsibility in allowing the situation to get to this point and are very pointedly not connecting the dots with their response.

Microsoft which owns GitHub, has been washing their hands if any responsibility in helping to resolve the ongoing supply chain catastrophe which is hosted and spread nearly entirely via Github repositories: not responding to security researchers flagging malware hosted on GitHub; doing nothing to address the proliferation of open source malware across their platform, giving no recourse for action, not applying their tremendous resources to the problem, fiddling as the open source community burns and leaving the devs to fend for themselves. Let's not mention the recent very hostile and trust-erodibg behavior towards bug bounty security researchers.

The *&$@ finally spread all the way up to the top of the hill in a compromise of Microsoft's own repos, which I think highlights the scale of the problem.

And in response, they offer a watery corporate platitude, "a few customers were affected in a recent incident, and we're looking into it."

Re: Microsoft's open source tools were hacked to steal passwords of AI developers

#197

Post by mattfields »

JdeBP wrote: post #5

These seem related: * https://news.ycombinator.com/item?id=48418318 ( The Blight Reaches Microsoft: 73 Repos Disabled in 105 Seconds ) * https://news.ycombinator.com/item?id=48450543 ( Miasma Worm Hits Microsoft Again: Azure Functions Action and 72 Other Repositories Disabled After Supply Chain Attack Targeting AI Coding Agents ) * https://news.ycombinator.com/item?id=48416155 * https://news.ycombinator.com/item?id=4…

Yep. This is the thing that Microsoft is not mentioning in their watery response there.

Re: Microsoft's open source tools were hacked to steal passwords of AI developers

#198

Post by whattheheckheck »

johnisgood wrote: post #185
whattheheckheck wrote: post #170

Earlier quoted context omitted.

Anecdotal. 13 million swe roles with .01% is 130,000 compromised devices. Process problem

I think that the numerical example you gave appears to be wrong unless you intended 1% rather than 0.01%. In any case, fair enough. The concern is that organizations will build processes around AI where many people do not review outputs carefully. I do not disagree with this. I also agree that my particular workflow is anecdotal and does not work at scale.

Yes my bad I even checked it in the calculator but then typed in .01 again but added % again. I meant to do it to serve as an example of how bad humans are at thing.... right...

Yes 1%

Re: Microsoft's open source tools were hacked to steal passwords of AI developers

#199

Post by cookiengineer »

mattfields wrote: post #196
bilekas wrote: post #18

The phrasing of the title is loaded and the content phrases it as some kind of fault of open source. Then, which I find the most amusing, proceeds to blame MicroSlop for the attempted suuply chain attack, > Microsoft did not immediately provide the specific number of customers affected, when asked by TechCrunch. Yeah, because that's how open source works. Tech crunch doing hard work no not explain that. > This is Mic…

That's the thing: they do bear responsibility in allowing the situation to get to this point and are very pointedly not connecting the dots with their response. Microsoft which owns GitHub, has been washing their hands if any responsibility in helping to resolve the ongoing supply chain catastrophe which is hosted and spread nearly entirely via Github repositories: not responding to security researchers flagging malw…

Microsoft's introduction of 2 hour latencies for vscode extension installations to mitigate the ongoing worm spread is absolutely bonkers.

They did not read the source code of the worm implant and have absolutely no clue how the worm works, if that is their response.

The only way to meaningfully stop the worm is by requiring manual confirmations for git commit/push actions and for the auto-executed hooks in all IDEs. Also, these scripts should be sandboxed to only be allowed to run and interact with files inside the same opened project folder.

Well, that, or setting the host system language to Russian. Which I am kind of expecting Microsoft to do next...

Re: Microsoft's open source tools were hacked to steal passwords of AI developers

#200

Post by johnisgood »

whattheheckheck wrote: post #198
johnisgood wrote: post #185

Earlier quoted context omitted.

I think that the numerical example you gave appears to be wrong unless you intended 1% rather than 0.01%. In any case, fair enough. The concern is that organizations will build processes around AI where many people do not review outputs carefully. I do not disagree with this. I also agree that my particular workflow is anecdotal and does not work at scale.

Yes my bad I even checked it in the calculator but then typed in .01 again but added % again. I meant to do it to serve as an example of how bad humans are at thing.... right... Yes 1%

I do agree.
Post reply on HN