101–110 of 331 posts
Side note: Snyk (founded 2015, computer and network security) has nothing to do with @sneak (hacking since 1998, computer and network security). I was dismayed to learn about their choice of brand, and think it might cause confusion. :(
Earlier quoted context omitted.
cursor dev here. reasonable assumptions, but not quite the case. the snyk packages are just the names of our bundled extensions, which we never package nor upload to any registry. (we do it just like how VS Code does it: https://github.com/microsoft/vscode/tree/main/extensions ) we did not hire snyk, but we reached out to them after seeing this and they apologized. we did not get any confirmation of what exactly they…
> "pretty irresponsible" Wouldn't it be more like "pretty illegal"? They could have simply used body: JSON.stringify("worked"), i.e. not sent target machines’ actual environment variables, including keys.
Earlier quoted context omitted.
It's not about being a problem or not. It's a basic responsibility when doing security research: maintaining an isolated test environment is table stakes.
How should it have been done differently? How else is the researcher supposed to know if the attack works? "Hey random company, we have no proof it's going to work but we think maybe your system, which we can't see, is vulnerable! Go waste time and check!"
Then test the behaviour.
Earlier quoted context omitted.
cursor dev here. reasonable assumptions, but not quite the case. the snyk packages are just the names of our bundled extensions, which we never package nor upload to any registry. (we do it just like how VS Code does it: https://github.com/microsoft/vscode/tree/main/extensions ) we did not hire snyk, but we reached out to them after seeing this and they apologized. we did not get any confirmation of what exactly they…
[flagged]
I need to get serious about doing all development inside a virtual machine. One project per VM. There are just too many insidious ways in which I can ignorantly slip up such that I compromise my security. My only solace is that I am a nobody without secrets or a fortune to steal. IDEs, plugins, development utilities, language libraries, OS packages, etc. So much code that I take on blind faith.
Specifically I'm transitioning my Go and Zig development environments from an old mac to an M1 with Asahi Linux and getting a bit lost even finding replacements for Truecrypt and Little Snitch. Do these VM tools support encrypted VM's with firewall rules? I saw Vagrant mentioned here and that sounds like it might cover the network isolation, but what else would you suggest?
Earlier quoted context omitted.
cursor dev here. reasonable assumptions, but not quite the case. the snyk packages are just the names of our bundled extensions, which we never package nor upload to any registry. (we do it just like how VS Code does it: https://github.com/microsoft/vscode/tree/main/extensions ) we did not hire snyk, but we reached out to them after seeing this and they apologized. we did not get any confirmation of what exactly they…
[flagged]
Earlier quoted context omitted.
[flagged]
yes but there could be many possible reasons, for instance - it's muuch faster on mobile - you're aiming to convey litheness to potential target audiences who will know to recognize it as intentional litheness - you've gotten used to minimizing the amount of keystrokes necessary for communicating things, to the point it's second nature - you've worked a lot in the past with older nlp systems, where ignoring capitaliz…
Earlier quoted context omitted.
I think a lot of the issues in this particular example is the ease with which api keys, once leaked, are single factor passwords. If you ran a key logger on my machine you would never get into any major site with mfa. You couldn't watch me log on to the azure console with passkey and do much with it. But if you scrape a saved key with publish abilities bad things happen.
What's to stop me from installing custom certs and MITM your login session proxying the info. Or an extension to harvest the data after you login. I'm pretty sure if I have root it's game over one way or another. The surface is massive.
[EDIT: See the response by a Cursor dev below — looks like it was not authorized by them] Sounds to me like Cursor internally has a private NPM registry with those packages. Because of how NPM works, it's quite easy to trick it to fetch the packages from the public registry instead, which could be used by an attacker [0]. Assumably, this Snyk employee either found or suspected that some part of Cursor's build is misc…
Is there a link for the "githax" tool shown in the blog post, which seems to be quite useful? There's [1] but it's just a banner image. [1] https://www.githax.com/
The dev is https://github.com/6mile (same as author of the article) seems to be either a tool that isnt out yet or perhaps not available for free or the public.