This is impressive and something a human will never bother to find. But please stop saying Strix then did, Strix then went, Srix then this, then that. My monkey brain just can’t accept an LLM being referred to as if it is a living being with autonomy. It’s not.
I’ll accept when we actually see AI models.
We got admin access to Baseten's production GitHub
161–170 of 202 posts
Re: We got admin access to Baseten's production GitHub
#162This is impressive and something a human will never bother to find. But please stop saying Strix then did, Strix then went, Srix then this, then that. My monkey brain just can’t accept an LLM being referred to as if it is a living being with autonomy. It’s not. I’ll accept when we actually see AI models.
>something a human will never find
Eh, yes it is. And something that humans find all the time.
They even call out a non-AI tool that helped.
Re: We got admin access to Baseten's production GitHub
#163This is impressive and something a human will never bother to find. But please stop saying Strix then did, Strix then went, Srix then this, then that. My monkey brain just can’t accept an LLM being referred to as if it is a living being with autonomy. It’s not. I’ll accept when we actually see AI models.
>something a human will never find Eh, yes it is. And something that humans find all the time. They even call out a non-AI tool that helped.
Corrected
Re: We got admin access to Baseten's production GitHub
#164This did not need an AI agent at all...could have been discovered with deterministic pen-testing tools that have been around forever...
Re: We got admin access to Baseten's production GitHub
#165Earlier quoted context omitted.
+1 -- kudos to the Baseten team for their super professional response to all of this, it is clear why they are a generational company (-- Alex from Strix)
What distinguishes their response from non-generational companies? Do others fail to rotate their exposed github secrets that have admin access?
I think that many other companies (especially larger ones, I suppose) don't respond as promptly to security issues.
Re: We got admin access to Baseten's production GitHub
#166Earlier quoted context omitted.
I’d treat a vibecoded agent like an untrusted CI job, not like a junior employee: repo-scoped identity, read-only by default, no inherited Actions token or production secrets. Any operation that turns a read into a write should require approval outside the agent’s control and produce an auditable diff. Network egress belongs in the boundary too. Read-only access is not much protection if the agent can send everything…
Can you please not post AI-generated or AI-edited comments to HN? It's not allowed here - see https://news.ycombinator.com/newsguidelines.html#generated and https://news.ycombinator.com/item?id=47340079 . Of course, it's impossible to know for sure what was LLM processed or not, but some of your posts (like this one) have been getting classified that way.
[deleted]
Re: We got admin access to Baseten's production GitHub
#167> So Strix enumerated hosts, looked through certificate logs, mapped the full surface. If there is anything that you should do while setting up infrastructure... it is getting rid of single-host SSL certificates. If you're on Amazon... just let it issue wildcard certificates and place an ALB in front of hosts that terminates the SSL connection. The very second a subdomain appears in any of the CT logs directly, you'v…
> A human, you can hold accountable, and you can keep them at a good security posture with short-lived session tokens. You can do this too (and better) with a repo: OIDC/Workload identity trust relationship between github and aws for short lived tokens + a github environment setup that requires manual approval. Bonus: It also gives you an audit trail with a github action log as opposed to a sysadmin running something…
This is the way. And the benefit that still makes it more worth it today, is the fact that you can have truly self-service and peer reviewed infra provisioning and don't depend on a single sys admin or several of them colliding on their machines.
Re: We got admin access to Baseten's production GitHub
#168> Baseten handled this well. The timeline was: > July 13, 11:10 PM: I reported the live basetenbot token, the public Harbor project, and the repository permissions. > July 14, morning: Baseten made the Harbor project private. I flagged that the token itself still worked. > July 14, 4:34 PM: Anton from Baseten Security confirmed the issue as critical and said they had made the Harbor project private and rotated the to…
Shouldn't the first step have been to roll the token?
Re: We got admin access to Baseten's production GitHub
#169> So Strix enumerated hosts, looked through certificate logs, mapped the full surface. If there is anything that you should do while setting up infrastructure... it is getting rid of single-host SSL certificates. If you're on Amazon... just let it issue wildcard certificates and place an ALB in front of hosts that terminates the SSL connection. The very second a subdomain appears in any of the CT logs directly, you'v…
GitOps offers more benefits than downsides if configured correctly. It is more secure and scalable and auditable than manual apply from workstations. However it should be using short lived (e.g. workload identity), minimum privilege credentials, not broad admin level grants.
Also IaC is not just about terraform. Much of the action is usually in the kubernetes manifests via ArgoCD, flux, and etc. Good luck to anyone keeping track of all those manual helm installs, and then rebuilding or upgrading a cluster without these tools.
Re: We got admin access to Baseten's production GitHub
#170Earlier quoted context omitted.
> Our logs confirm You retain all logs back through to (at least) March 2023?
You don't? For some stuff, I've got logs going back to 1993...
Many companies only keep logs as long as they're legally required to. It can't be discoverable if it doesn't exist ...