Anonymous GitHub account mass-dropping undisclosed 0-days • Hacker News Board

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#141

Post by topgrain2 » Sat, Jun 27, 2026, 6:27 PM UTC

Syntonicles wrote: post #114

jackp96 wrote: post #103

Earlier quoted context omitted.

They're just so handy! I do think LLMs tend to use them in a specific way, though. So maybe tweaking your usage (ex. no spaces around them) or using a technically incorrect en-dash might offer the desired effect while subtly signaling that your message isn't AI-generated. I still use them — mostly for pauses — but I'd like to think my voice sounds distinct enough from an AI that people can tell.

I for one am striving for clarity and couldn't care less about being confused with AI. However I've only ever used regular dashes. How do you type an em-dash? Is it OS specific? I've taken to using Emacs insert-char with a list of frequently used ones in my scratch buffer. My memory for Unicode is unreliable.

Keyboard layout specific. Macs with their default English layout use “option-shift-dash” which is really easy to remember (and relatively discoverable, as such things go) which is why using proper m-dashes (not just double-dashes) used to be a strong indicator a poster was using a Mac, before LLMs took the character over.

On iOS you type it by pressing dash and holding until alternative options come up, same way you type e.g. accented characters.

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#142

Post by woodruffw » Sat, Jun 27, 2026, 6:29 PM UTC

Scaled wrote: post #130

woodruffw wrote: post #88

Earlier quoted context omitted.

The Gitea one looks marginally interesting, but is probably not exploitable in practice (unless Gitea or whoever else isn’t properly isolating jobs on dedicated VMs). I suspect GitHub Actions has similar behavior and is not considered exploitable because the user is assumed to already have local, non-namespaced root access.

Gitea action runner has a bunch of different ways to setup and doing the isolation properly looks tricky. The documentation doesn't provide any isolation tests to administrators, either. The biggest mitigation is that gitea documentation discourages you from using action runners from untrusted users. Not flawless security, but it's something...

> The biggest mitigation is that gitea documentation discourages you from using action runners from untrusted users.

This recommendation seems incompatible with third-party collaboration, at least on its face!

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#143

Post by cubefox » Sat, Jun 27, 2026, 6:34 PM UTC

DANmode wrote: post #124

grayhatter wrote: post #112

Earlier quoted context omitted.

I said "doesn't matter" to someone once... the resulting lesson came in the form of a reply from the whitehat researcher ( waves , hi brian!) a 16step exploit chain resulting in a one click full account takeover. I'm equally annoyed and over the alarmist takes. But I don't think it's fair to group mine into it. I'm annoyed at seeing discard respect for others into the same void everyone is happy to toss quality. Do t…

That’s a whole lot of “we” to not mention which company you’re at that supposedly plays well with security researchers/has a proper bug bounty.

Even if the company doesn't have a big bounty publishing exploit code without warning them is unethical. Moreover, a lot of these projects are FOSS without a company which could pay bug bounties.

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#144

Post by void-star » Sat, Jun 27, 2026, 6:37 PM UTC

stonogo wrote: post #77

unnouinceput wrote: post #71

Earlier quoted context omitted.

all vulnerabilities are just bugs.

But not the other way around, which makes them different.

Actually, Mudge of the l0pht (and later DARPA) once famously made the claim that all bugs are security issues waiting to be exploited in some way (I’m probably paraphrasing). I kind of agree. Although, the bugs on this dump are indeed mostly pretty lame, which is exactly what I’ve seen you get a lot of when you let an llm go bug hunting with no human vetting and confirmation in the loop.

It’s possible/likely that whomever is running this experiment is keeping the non slop bugs to themselves. It’s probably what I’d do.

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#145

Post by zkmon » Sat, Jun 27, 2026, 6:39 PM UTC

AI is always a bit eager to report everything as an issue because the "number" of findings is seen as a measure of it's intelligence. Same happens with code review as well. It reports lots of non-issues. I suspect even Mythos output could have the same bloat, and the number (instead of severity) of the issues it reported could have scared people.

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#146

Post by midtake » Sat, Jun 27, 2026, 6:42 PM UTC

xlayn wrote: post #100

I want to rush to git clone, but as things are, the odds are extremely high that this kind of things that are too good to be real are honeypots and something there will compromise your machine or make your llm start working for someone else...

You can just download the zip over HTTPS

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#147

Post by dpark » Sat, Jun 27, 2026, 6:43 PM UTC

zkmon wrote: post #145

AI is always a bit eager to report everything as an issue because the "number" of findings is seen as a measure of it's intelligence. Same happens with code review as well. It reports lots of non-issues. I suspect even Mythos output could have the same bloat, and the number (instead of severity) of the issues it reported could have scared people.

This is not what I heard from folks who worked directly with mythos. I was told that the vulnerabilities it generated were largely real and meaningful.

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#148

Post by hackermailman » Sat, Jun 27, 2026, 6:45 PM UTC

ryandrake wrote: post #57

silversmith wrote: post #45

Earlier quoted context omitted.

Hang on, can you actually do something nefarious with just the bank account number?

If someone has your bank account and bank’s routing number (which is also not secret), they can make fraudulent ACH transfers and payments from your account. Of course it will most likely be caught as fraud some time after the fact, but just those two bits of not-secret info are enough to grief someone.

Knuth had to stop sending real checks for errors spotted in his books because they would post pics of the check and thieves abused the account https://www-cs-faculty.stanford.edu/~knuth/news08.html

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#149

Post by 0gs » Sat, Jun 27, 2026, 6:45 PM UTC

998244353 wrote: post #131

rogerrogerr wrote: post #86

Earlier quoted context omitted.

I used to be an em-dash user, but now my opinion is that I’d rather be perceived as someone who does not want to be confused with an LLM. So I’ve changed my writing style.

I now use "ASCII em-dashes" by using two hyphens -- like this. Or--if you prefer no spaces--like this.

the nn dash remains the goat. the arg dash

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#150

Post by jazzyjackson » Sat, Jun 27, 2026, 6:46 PM UTC

silversmith wrote: post #45

ryandrake wrote: post #27

Earlier quoted context omitted.

We need our infrastructure to stop treating bank account numbers and social security numbers as secrets. At least in the US, bank account numbers appear on physical checks and are required to be shared in order to do an ACH transfer, and a social security number is not supposed to be used as an identifier (unless to the Social Security Administration itself) or as a secret password. Ideally, nothing nefarious should…

Hang on, can you actually do something nefarious with just the bank account number?

Yes but there are steep penalties for bank fraud so it is not especially common