Live data from Hacker News

How we rooted Copilot

research.eye.security

31–40 of 147 posts

Re: How we rooted Copilot

#31

Earlier quoted context omitted.

I'll never understand why people do free dev work for multinational trillion dollar conglomerates.

Could say the same thing about open source software.

It's why I don't understand why people believe in "open source". Why would I contribute free dev work to a billion dollar corporation? I do believe in "Free Software" which is contributing free dev work to my fellow man for the benefit of all man mankind.

Re: How we rooted Copilot

#32
post #4

> We reported the vulnerability to Microsoft in April and they have since fixed it as a moderate severity vulnerability. As only important and critical vulnerabilities qualify for a bounty award, we did not receive anything, except for an acknowledgement on the Security Researcher Acknowledgments for Microsoft Online Services webpage. I guess it makes sense that a poor little indie company like Microsoft can't pay bu…

I'll never understand why people do free dev work for multinational trillion dollar conglomerates.

It's still good for reputation. This is by a researcher at a company, so a benefit for both of them. Plus if we didn't have bug bounty programs, they'd have to willingly work at Microsoft to do this research.

Re: How we rooted Copilot

#33
post #4

> We reported the vulnerability to Microsoft in April and they have since fixed it as a moderate severity vulnerability. As only important and critical vulnerabilities qualify for a bounty award, we did not receive anything, except for an acknowledgement on the Security Researcher Acknowledgments for Microsoft Online Services webpage. I guess it makes sense that a poor little indie company like Microsoft can't pay bu…

I'll never understand why people do free dev work for multinational trillion dollar conglomerates.

It mostly pays in career benefits. Same reason why plenty intern for free.

Re: How we rooted Copilot

#34

Earlier LLMs used to be a goldmine for company secrets (when it learned documents that shouldn't be on public internet). Most of it seem to be scrubbed now.

When companies (non-"tech") started adopting them they also had no "guardrails" for content outside what the intent of such products were (dunno what the standard term for this is).

There was a boba tea company that had a free, no-sign-in required LLM that I used to generate a few bash scripts before ChatGPT free-tier started.

Re: How we rooted Copilot

#35

Earlier LLMs used to be a goldmine for company secrets (when it learned documents that shouldn't be on public internet). Most of it seem to be scrubbed now.

> Earlier LLMs used to be a goldmine for company secrets (when it learned documents that shouldn't be on public internet).

Sounds fake. LLMs don't usually memorize things that appear once in their training set anyway, nor have I heard about major issues accidentally training on a bunch of non-public data.

I can see how someone would believe it to be true though, since LLMs can easily hallucinate in a way that looks like this is true.

Re: How we rooted Copilot

#36
post #4

> We reported the vulnerability to Microsoft in April and they have since fixed it as a moderate severity vulnerability. As only important and critical vulnerabilities qualify for a bounty award, we did not receive anything, except for an acknowledgement on the Security Researcher Acknowledgments for Microsoft Online Services webpage. I guess it makes sense that a poor little indie company like Microsoft can't pay bu…

As you’ll see elsewhere, “root” got them literally nothing. They tried but there was nothing to be had.

Re: How we rooted Copilot

#37

Earlier quoted context omitted.

Could say the same thing about open source software.

It's why I don't understand why people believe in "open source". Why would I contribute free dev work to a billion dollar corporation? I do believe in "Free Software" which is contributing free dev work to my fellow man for the benefit of all man mankind.

This may be a misconception. "Free software" (e.g. Linux) also benefits billion-dollar corporations and "open source" also benefits all mankind.

Re: How we rooted Copilot

#38

Earlier quoted context omitted.

Could say the same thing about open source software.

It's why I don't understand why people believe in "open source". Why would I contribute free dev work to a billion dollar corporation? I do believe in "Free Software" which is contributing free dev work to my fellow man for the benefit of all man mankind.

I think the argument is that when big companies make use of stuff, it gets more scrutiny and occasionally they contribute back improvements, and the occasional unicorn gets actual man hours paid for improving it. So if your project gets big enough, it's beneficial. But you have to have a MIT/BSD license usually, because companies will normally stay away from GPL.

Re: How we rooted Copilot

#39

Earlier quoted context omitted.

It's why I don't understand why people believe in "open source". Why would I contribute free dev work to a billion dollar corporation? I do believe in "Free Software" which is contributing free dev work to my fellow man for the benefit of all man mankind.

This may be a misconception. "Free software" (e.g. Linux) also benefits billion-dollar corporations and "open source" also benefits all mankind.

Free software and open source are two ideologies for the same thing. Free Software is the ideology of developing the software for the benefit of mankind (it's sometimes termed a "political" stance but I see it as an ethical stance). Open source is the ideology of saving money at a corporation by not paying the developers. Sure open source can benefit mankind but will only develop corporate software for money. When developing on my own time, I will focus on software that either personally benefits me or benefits other regular people.

Re: How we rooted Copilot

#40

Earlier quoted context omitted.

It's why I don't understand why people believe in "open source". Why would I contribute free dev work to a billion dollar corporation? I do believe in "Free Software" which is contributing free dev work to my fellow man for the benefit of all man mankind.

This may be a misconception. "Free software" (e.g. Linux) also benefits billion-dollar corporations and "open source" also benefits all mankind.

at least under some licenses like GPL/AGPL you get some code back.
Post reply on HN