111–113 of 113 posts
Trying to understand better where the JWT vulnerability was here, you said: “So you could log in with my username and password, grab the JWT, and then send that along with your request.”
Am I understanding here that you weren’t validating the sub/userId or role in the JWT? I.e. any user with a valid JWT could hit the admin api endpoints? Or did I misunderstand that?
Earlier quoted context omitted.
it's just incompleteness -- a human issue. most in-use LLMs prompted with a simple "You're in charge of infrastructure security, let's review possible problem points" would have uncovered this. I wouldn't fault a compiler for erring when someone left out a period; i'd tell the person to start including it -- but for some reason the expectation for LLMs is hands-off work ; I guess we're just in that phase of the hype…
> for some reason the expectation for LLMs is hands-off work The expectation is the same as the expectation for self driving: users expect it to be fully hands off, even when they are explicitly told they need to keep their hands on the wheel. This is because it's tricky, tedious, and unejoyable to thouroughly vet the actions of a machine in realtime.
Earlier quoted context omitted.
> for some reason the expectation for LLMs is hands-off work The expectation is the same as the expectation for self driving: users expect it to be fully hands off, even when they are explicitly told they need to keep their hands on the wheel. This is because it's tricky, tedious, and unejoyable to thouroughly vet the actions of a machine in realtime.
very interesting- i actually enjoy monitoring claude code and telling it when it is going the wrong way on something. i also don’t mind monitoring the car doing its lane keeping, perhaps it is an autism trait?