Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We got admin access to Baseten's production GitHub

strix.ai

Post reply on HN
Print view View original

51–60 of 202 posts

Re: We got admin access to Baseten's production GitHub

#51

Post by jazzpush2 »

sublinear wrote: post #46
manquer wrote: post #39

Earlier quoted context omitted.

Swag packages like these are a token of appreciation not a reward. The front page post in HN here is worth far more than few thousand dollars , don’t think either organization is operating under purely financial transactional nature . Most people who find a dropped wallet will return it without evaluating the market value of your compromised identity or the contents of the wallet . Grateful owners may buy you a beer…

[flagged]

It's nice to wax poetic, but they should absolutely pay the researchers here.

Re: We got admin access to Baseten's production GitHub

#52

Post by DaSHacka »

calvinmorrison wrote: post #34

> We build Strix, an autonomous hacking again. > But... we're a security company. > So... we pointed Strix at *.baseten.co and let it run without credentials or source code. lawyers wet dream. and a perfect case. A security company who KNOWS the law unleashed an AI agent to violate the laws

A lawyers wet dream is when a security company.... Finds an issue, does not abuse it, and reports it to the affected party for it to be patched?

I feel like people like you are more of a lawyers wet dream, in that they'll happily litigate a frivolous case for you while billing you hourly.

Re: We got admin access to Baseten's production GitHub

#53

Post by [deleted] »

manquer wrote: post #39
mtlynch wrote: post #16

Earlier quoted context omitted.

Good in terms of prompt communication and fix. Absurdly bad in terms of reward. Earlier in the article, it mentions that Baseten is valued at $13B. They can't dig into their couch cushions to give a few thousand dollars to the researcher privately disclosing a bug that let an attacker escalate to admin in their GitHub org? This sends the message that honest researchers should not waste their time looking for vulnerab…

Swag packages like these are a token of appreciation not a reward. The front page post in HN here is worth far more than few thousand dollars , don’t think either organization is operating under purely financial transactional nature . Most people who find a dropped wallet will return it without evaluating the market value of your compromised identity or the contents of the wallet . Grateful owners may buy you a beer…

[deleted]

Re: We got admin access to Baseten's production GitHub

#55

Post by usewik »

calvinmorrison wrote: post #34

> We build Strix, an autonomous hacking again. > But... we're a security company. > So... we pointed Strix at *.baseten.co and let it run without credentials or source code. lawyers wet dream. and a perfect case. A security company who KNOWS the law unleashed an AI agent to violate the laws

Agreed. Pretty sure you are supposed to ask for permission before pentesting someone. Hopefully they, being a security company, know that.

Re: We got admin access to Baseten's production GitHub

#56

Post by usewik »

DaSHacka wrote: post #52
calvinmorrison wrote: post #34

> We build Strix, an autonomous hacking again. > But... we're a security company. > So... we pointed Strix at *.baseten.co and let it run without credentials or source code. lawyers wet dream. and a perfect case. A security company who KNOWS the law unleashed an AI agent to violate the laws

A lawyers wet dream is when a security company.... Finds an issue, does not abuse it, and reports it to the affected party for it to be patched? I feel like people like you are more of a lawyers wet dream, in that they'll happily litigate a frivolous case for you while billing you hourly.

Feelings don't really matter in the legal world. Statements and actions do.

Re: We got admin access to Baseten's production GitHub

#57

Post by flaunf221 »

manquer wrote: post #39
mtlynch wrote: post #16

Earlier quoted context omitted.

Good in terms of prompt communication and fix. Absurdly bad in terms of reward. Earlier in the article, it mentions that Baseten is valued at $13B. They can't dig into their couch cushions to give a few thousand dollars to the researcher privately disclosing a bug that let an attacker escalate to admin in their GitHub org? This sends the message that honest researchers should not waste their time looking for vulnerab…

Swag packages like these are a token of appreciation not a reward. The front page post in HN here is worth far more than few thousand dollars , don’t think either organization is operating under purely financial transactional nature . Most people who find a dropped wallet will return it without evaluating the market value of your compromised identity or the contents of the wallet . Grateful owners may buy you a beer…

Wallets usually belong to real people with lives. We can empathize with them. Companies are not people. And they also don't and can't empathize with you.

Re: We got admin access to Baseten's production GitHub

#58

Post by calvinmorrison »

DaSHacka wrote: post #52
calvinmorrison wrote: post #34

> We build Strix, an autonomous hacking again. > But... we're a security company. > So... we pointed Strix at *.baseten.co and let it run without credentials or source code. lawyers wet dream. and a perfect case. A security company who KNOWS the law unleashed an AI agent to violate the laws

A lawyers wet dream is when a security company.... Finds an issue, does not abuse it, and reports it to the affected party for it to be patched? I feel like people like you are more of a lawyers wet dream, in that they'll happily litigate a frivolous case for you while billing you hourly.

if i find someones key on the ground and take the key and walk into their house and poke around, and make sure to leave a letter, this is a good thing?

Re: We got admin access to Baseten's production GitHub

#59

Post by r_lee »

mtlynch wrote: post #16
swyx wrote: post #4

> Baseten handled this well. The timeline was: > July 13, 11:10 PM: I reported the live basetenbot token, the public Harbor project, and the repository permissions. > July 14, morning: Baseten made the Harbor project private. I flagged that the token itself still worked. > July 14, 4:34 PM: Anton from Baseten Security confirmed the issue as critical and said they had made the Harbor project private and rotated the to…

Good in terms of prompt communication and fix. Absurdly bad in terms of reward. Earlier in the article, it mentions that Baseten is valued at $13B. They can't dig into their couch cushions to give a few thousand dollars to the researcher privately disclosing a bug that let an attacker escalate to admin in their GitHub org? This sends the message that honest researchers should not waste their time looking for vulnerab…

of course not, all they can do is a lil "thx"

> This sends the message that honest researchers should not waste their time looking for vulnerabilities in Baseten, but it's a good target for criminals who want to monetize these vulnerabilities.

of course, these companies want you to sell vulns to brokers and other orgs. they don't care about bug reports.

otherwise they'd pay as much or even more, right?

Re: We got admin access to Baseten's production GitHub

#60

Post by taoh »

swyx wrote: post #4

> Baseten handled this well. The timeline was: > July 13, 11:10 PM: I reported the live basetenbot token, the public Harbor project, and the repository permissions. > July 14, morning: Baseten made the Harbor project private. I flagged that the token itself still worked. > July 14, 4:34 PM: Anton from Baseten Security confirmed the issue as critical and said they had made the Harbor project private and rotated the to…

I’d treat a vibecoded agent like an untrusted CI job, not like a junior employee: repo-scoped identity, read-only by default, no inherited Actions token or production secrets. Any operation that turns a read into a write should require approval outside the agent’s control and produce an auditable diff. Network egress belongs in the boundary too. Read-only access is not much protection if the agent can send everything it reads to an arbitrary endpoint.
Post reply on HN