211–220 of 244 posts
Earlier quoted context omitted.
The exploit is there either way.
The exploit depends on changing the config to execute a .rb file. And the config was supplied by a PR.
Earlier quoted context omitted.
Any language that supports constexpr, like Rust's const fn [0], can execute arbitrary code at compile time. [0] https://github.com/rust-lang/rust/issues/57563
Rust's const fns run in a restricted interpreter that does not allow for things like non-determinism, syscalls, unsound behavior, etc. They can neither read from nor write to "the environment" in any meaningful way. They don't even expose things like the host's pointer-size to the code being run.
It can call unsafe blocks. They are more limited unsafe blocks, but they are still unsafe blocks.
I cancelled my coderabbit paid subscription, because it always worries me when a post has to go viral on HN for a company to even acknowledge an issue occurred. Their blogs are clean of any mention of this vulnerability and they don't have any new posts today either. I understand mistakes happen, but lack of transparency when these happen makes them look bad.
Both articles were published today. It seems to me that the researchers and coderabbit agreed to publish on the same day. This is a common practice when the company decides to disclose at all (disclosure is not required unless customer data was leaked and there's evidence of that, they are choosing to disclose unnecessarily here). When the security researchers praise the response, it's a good sign tbh.
The early version of the researcher's article didn't have the whole first section where they "appreciate CodeRabbit’s swift action after we reported this security vulnerability" and the subsequent CodeRabbit talking points.
Refer to the blue paragraphs on the right hand site at https://web.archive.org/web/diff/20250819165333/202508192240...
Earlier quoted context omitted.
https://www.coderabbit.ai/blog/our-response-to-the-january-2...
That post happened after the HN post?
https://web.archive.org/web/diff/20250819165333/202508192240...
From the CEO's response: > On January 24, 2025, security researchers from Kudelski Security disclosed a vulnerability to us through our Vulnerability Disclosure Program (VDP). The researchers identified that Rubocop, one of our tools, was running outside our secure sandbox environment—a configuration that deviated from our standard security protocols. Honestly, that last part sounds like a lie. Why would one task run…
Not sure why it seems like a lie. Oversights like this happen all the time.
They only published a proper [2] disclosure post later once their hand was forced after the researcher's post hit the HN front page.
[1]: https://news.ycombinator.com/item?id=44954242
[2]: I use that term loosely as it seems to be AI written slop.
Earlier quoted context omitted.
The LLM tics are strong in this writeup: "No manual overrides, no exceptions." "Our VDP isn't just a bug bounty—it's a security partnership"
Wow, you hit a nerve with that one. There have been some quick edits on the page. Another: > Security isn't just a checkbox for us; it's fundamental to our mission.
> The researchers identified that Rubocop, one of our tools, was running outside our secure sandbox environment — a configuration that deviated from our standard security protocols.
This is still ultra-LLM-speak (and no, not just because of the em-dash).
Earlier quoted context omitted.
For anyone following along in the comments here. Code Rabbit's CEO posted some of the details today, after this post hit HN. The usual "we take full responsibility" platitudes.
I would love to know the acceptable version.
CodeRabbit response - https://www.coderabbit.ai/blog/our-response-to-the-january-2...