Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Roblox cheat and one AI tool brought down Vercel's platform

webmatrices.com

Post reply on HN
Print view View original

181–186 of 186 posts

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#181

Post by baxtr »

Topfi wrote: post #88
baxtr wrote: post #87

Earlier quoted context omitted.

OP was talking about the security team. Not sure what you are proposing? Do you want to let any applicant be screened by the security team?

Any security team that gives unrestricted admin privileges to random employees is not a security team. So doing the most basic parts of their job, that would be my proposal. If specific to my hiring comment, was meant a bit facetious, though I will point out this line in their "compliance" report by "auditor" Delve: > The organization carries out background and/or reference checks on all new employees and contractors…

I think one of us misunderstood how the event happened.

In my understanding restricting local admin rights would not have change anything here.

The Vercel employee signed up for Context.ai (a third-party tool) using their work account and granted it "Allow All" access to their environment.

Maybe Admin-Managed Consent would have helped prevent context.ai access the environment but this is not configured locally on the employee's machine.

It is a cloud-level setting managed within their identity provider's administrative portal.

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#182

Post by bananaboy »

paganel wrote: post #51
progbits wrote: post #11

Earlier quoted context omitted.

I don't know why you are downvoted. The article is AI blogspam, it doesn't have any more factual information than eg https://www.darkreading.com/application-security/vercel-empl... and is full of empty LLMisms. It's depressing people are willing to read this.

That article you linked to didn't mention that Context.ai, from where this mess originated, is a YCombinator company. Most probably its founders are on this very web-forum.

Has the article been edited since these comments? I see "It was a Y Combinator company" in the text.

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#183

Post by ErroneousBosh »

SAI_Peregrinus wrote: post #145
cyanydeez wrote: post #98

Earlier quoted context omitted.

Keepass has an option to "encrypt in memory" certain passwords, sensitive information. The point of encryption is often times about what other software or hardware attacks are minimized or eliminated. However, if someone figures out access to a running system, theres really no way to both allow an app to run and keep everything encrypted. It certainly is possible, like the way keepass encrypts items in memory, but if…

Even Keepass's "encrypt in memory" option leaves that encryption key in memory, so it can auto-type or copy passphrases into form fields. It's an extra step, but not unbreakable.

And even then the passphrase is put into form fields in plaintext, so there's *got* to be some sort of attack to grab those. They must be in memory decrypted at some point.

It always comes back round to "you can't have your cake and eat it".

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#184

Post by SAI_Peregrinus »

inetknght wrote: post #136
SAI_Peregrinus wrote: post #135

Earlier quoted context omitted.

The app shouldn't see empty data, it should see statistically likely fake data.

While you're right, I'll be happy with just empty data for now. Generating statistically-likely false data is only recently available generally and turns out to be rather expensive.

For the most sensitive fields (names, addresses, phone numbers) it's quite simple. For names, you get a list of the (say) 1,000 most common names, and pick randomly from the list. For phone numbers, you generate random numbers with valid formatting (not all area codes are valid, etc.). For addresses, you pick randomly from a database of real addresses. Etc. No LLM-style generation needed.

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#185

Post by msdz »

GorbachevyChase wrote: post #169
StilesCrisis wrote: post #104

Earlier quoted context omitted.

I had to stop reading. I have become overly sensitive to LLMisms. This is definitely "ChatGPT, read this article and rewrite it in a casual tone" with little to no actual authorship. On HN we should try to get primary sources for this sort of thing.

If it’s not important enough to deserve thought in writing, it’s definitely not important enough to read.

"Writing is nature's way of letting you know how sloppy your thinking is." – Dick Guindon

If your text hasn't undergone that process, it's still sloppy thinking.

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#186

Post by burnished »

otabdeveloper4 wrote: post #179
lmz wrote: post #117

Earlier quoted context omitted.

Once it's networked you lose the "whitelist of systemd services" and it's then no different from any networked secret store.

No, this is a solved problem: https://spiffe.io/ You can do service attestation securely, even for networked services.

Nice. Really grateful for your participation in this comment tree
Post reply on HN