I will consider it legit when in next 24 hours MSFT blocks it.
Anonymous GitHub account mass-dropping undisclosed 0-days
191–200 of 407 posts
Re: Anonymous GitHub account mass-dropping undisclosed 0-days
#192Earlier quoted context omitted.
Gitea action runner has a bunch of different ways to setup and doing the isolation properly looks tricky. The documentation doesn't provide any isolation tests to administrators, either. The biggest mitigation is that gitea documentation discourages you from using action runners from untrusted users. Not flawless security, but it's something...
> The biggest mitigation is that gitea documentation discourages you from using action runners from untrusted users. This recommendation seems incompatible with third-party collaboration, at least on its face!
Potentially, but for many projects things like that are tools that you want to control access to anyway. Anyone wanting to update the CI/CD process who isn't a trusted part of the project should be having their changes properly reviewed by someone who is anyway, at which point the reviewer is the trusted user not the random external entity.
Re: Anonymous GitHub account mass-dropping undisclosed 0-days
#1930-days-vibes-vulns ? There should be a new category, for spotting and handling the em-dashes of this brave new world of vulns and making the old fossils like me only picking my head up for the old painfully still hand-crafted artisanal ones instead. A kind of label, like free-range for eggs, in sum.
..."and for the love of God, don't use M dashes when you write it"...input goes on for an hour droning about slop...
Re: Anonymous GitHub account mass-dropping undisclosed 0-days
#194There is going to be a flurry of this sort of stuff as the AIs get smart enough to find them. It will naturally die down as the legitimate ones are fixed. Yes, there will always be some level of this, but I’d expect it to be low and the exploits found to be increasingly complex. This is a time of transition.
> It will naturally die down as the legitimate ones are fixed. Every software update introduces and reintroduces them
Perhaps, but as the AI analysis becomes part of the release process (or even the CI process as prices fall), you’d expect those new issues to be caught before release and fixed. We’re seeing them caught post-release for now because the code is older than the AIs, so we’re catching up.
Re: Anonymous GitHub account mass-dropping undisclosed 0-days
#195Earlier quoted context omitted.
Yes, big pet peeve of the new world. Every em dash is apparently an AI trigger. Back in my day, they were a sign of great respect within my people.
I propose that humans use Unicode U+2E3B three em dash ⸻ it is an impressively long character.
> U+2E3B three em dash
I had to look up why this exists, and apparently it was added in Unicode 6.1 (2012) because some style guide required it, and using consecutive U+2014 em dashes isn't sufficient because that might not render as one continuous line.
Re: Anonymous GitHub account mass-dropping undisclosed 0-days
#196Earlier quoted context omitted.
I mean, that's how people get hacked. If vlc crashed on my computer, and every day I should raise thanks to my gods that I do not use vlc, I would immediately unplug it and thoughtfully consider the circumstances under which it would be safe to turn it back on.
> I mean, that's how people get hacked. ...when was the last documented case of an in-the-wild hack targeting VNC?
VLC != VNC
Re: Anonymous GitHub account mass-dropping undisclosed 0-days
#197Earlier quoted context omitted.
We need our infrastructure to stop treating bank account numbers and social security numbers as secrets. At least in the US, bank account numbers appear on physical checks and are required to be shared in order to do an ACH transfer, and a social security number is not supposed to be used as an identifier (unless to the Social Security Administration itself) or as a secret password. Ideally, nothing nefarious should…
It’s quite ridiculous that we haven’t been able to build a modern identification system capable of replacing SSNs in the last 30 years.
SSNv6. It will take 20 years for a 50% migration
Re: Anonymous GitHub account mass-dropping undisclosed 0-days
#198Earlier quoted context omitted.
I used to be an em-dash user, but now my opinion is that I’d rather be perceived as someone who does not want to be confused with an LLM. So I’ve changed my writing style.
What is the typical motivation to start using em-dashes? Why go the extra way to have a slightly elongated dash when a normal one would just as well do the job? I might be conpletely off here but I've never seen a situation where using a normal dash where a long one should be causes any sort of syntactic trouble.
Because ASCII minus instead of dash looks ugly. It's like using zero instead of "o".
Re: Anonymous GitHub account mass-dropping undisclosed 0-days
#199Earlier quoted context omitted.
I for one am striving for clarity and couldn't care less about being confused with AI. However I've only ever used regular dashes. How do you type an em-dash? Is it OS specific? I've taken to using Emacs insert-char with a list of frequently used ones in my scratch buffer. My memory for Unicode is unreliable.
Keyboard layout specific. Macs with their default English layout use “option-shift-dash” which is really easy to remember (and relatively discoverable, as such things go) which is why using proper m-dashes (not just double-dashes) used to be a strong indicator a poster was using a Mac, before LLMs took the character over. On iOS you type it by pressing dash and holding until alternative options come up, same way you…
Macs have two possible ways. If you have key repeat enabled, option+shift+dash. Some newer Mac users may have the mode on where holding a key pops up an iOS-style bubble of alternate options, in which case they will just hold hyphen.
Re: Anonymous GitHub account mass-dropping undisclosed 0-days
#200AI is always a bit eager to report everything as an issue because the "number" of findings is seen as a measure of it's intelligence. Same happens with code review as well. It reports lots of non-issues. I suspect even Mythos output could have the same bloat, and the number (instead of severity) of the issues it reported could have scared people.
I'm an OSS developer and I've received three "CWE" alerts in the last two weeks. While they were all valid, they were for very trivial things like "this debug logfile could overwrite a file if it were a symlink" and "if a user is able to put OSC screen codes into the Git output they could write arbitrary data to the screen"
These AI models are making *everything* sound like an exploit. Not sure if this is good for the ecosystem. It makes me question everything that comes in more carefully. Is this a real exploit, or someone farming for karma to claim "I opened 39 CWEs in the last week. Hire my 'security' company to audit your code."