431–440 of 540 posts
When one OAuth token can compromise dev tools, CI pipeline, secrets and deployment simultaneously, something architectural has gone wrong. Vercel have had React2Shell (CVSS 10), the middleware bypass (CVSS 9.1), and now this, all within 12 months. At what point do we start asking questions about the concentration of trust in the web ecosystem? It's funny that at the engineering level we are continuously grilled in in…
Earlier quoted context omitted.
I love Hank, but he has such a weird EA-shaped blind spot when it comes to AI. idgi It is true that "more diversity in code" probably means less turnkey spray-and-pray compromises, sure. Probably. It also means that the models themselves become targets. If your models start building the same generated code with the same vulnerability, how're you gonna patch that?
> start building the same generated code with the same vulnerability This situation is pretty funny to me. Some of my friends who arent technical tried vibe coding and showed me what they built and asked for feedback I noticed they were using Supabase by default, pointed out that their database was completely open with no RLS So I told them not to use Supabase in that way, and they asked the AI (various diff LLMs) to…
This entire process is something anyone can test and reproduce; I was definitely steered towards both vercel and supabase by gemini. It isn't model specific.
This is why you pay a real provider for serious business needs, not an AWS reseller. Next.js is a fundamentally insecure framework, as server components are an anti-pattern full of magic leading to stuff like the below. Given their standards for framework security, it's not hard to believe their business' control plane is just as insecure (and probably built using the same insecure framework). Next.js is the new PHP,…
Next.js is the polar opposite of PHP, in a way. PHP was so simple and easy to understand that anyone with a text editor and some cheap shared hosting could pick it up, but also low level enough that almost nothing was magically done for you. The result was many inexperienced developers making really basic mistakes while implementing essential features that we now take for granted. Frameworks like Next.js take the com…
Earlier quoted context omitted.
> Still no email blast from Vercel alerting users, which is concerning. On the one hand, I get that it's a Sunday, and the CEO can't just write a mass email without approval from legal or other comms teams. But on the other hand... It's Sunday. Unless you're tuned-in to social media over the weekend, your main provider could be undergoing a meltdown while you are completely unaware. Many higher-up folks check company…
> On the one hand, I get that it's a Sunday, and the CEO can't just write a mass email without approval from legal or other comms teams This is not how things work. In a crisis like this there is a war room with all stakeholders present. Doesn’t matter if it’s Sunday or 3am or Christmas. And for this company specifically, Guillermo is not one to defer to comms or legal.
They just added more details: > Indicators of compromise (IOCs) > Our investigation has revealed that the incident originated from a third-party AI tool whose Google Workspace OAuth app was the subject of a broader compromise, potentially affecting hundreds of its users across many organizations. > We are publishing the following IOC to support the wider community in the investigation and vetting of potential malicio…
https://x.com/rauchg/status/2045995362499076169 > A Vercel employee got compromised via the breach of an AI platform customer called http://Context.ai that he was using. > Through a series of maneuvers that escalated from our colleague’s compromised Vercel Google Workspace account, the attacker got further access to Vercel environments. > We do have a capability however to designate environment variables as “non-sens…
Reads like the script of a hacker scene in CSI. "Quick, their mainframe is adapting faster than I can hack it. They must have a backdoor using AI gifs. Bleep bleep".
Earlier quoted context omitted.
It's interesting how many of the low-effort vibecoded projects I see posted on reddit are on vercel. It's basically the default.
I've done a ton of low-effort vibe-coded projects that suit my exact use cases. In many cases, I might do a quick Google search, not find an exact match, or find some bloated adware or subscription-ware and not bother going any further. Claude Code can produce exactly what I want, quickly. The difference is that I don't really share my projects. People who share them probably haven't realized that code has become che…
Earlier quoted context omitted.
Self fulfilling prophecy: You don't need to secure anything because it doesn't make a difference, as Mythos is not just a delicious Greek beer, but also a super-intelligent system that will penetrate any of your cyber-defenses anyway.
In some ways Mythos (like many AI things) can be used as the ultimate accountability sink. These libraries/frameworks are not insecure because of bad design and dependency bloat. No! It's because a mythical LLM is so powerful that it's impossible to defend against! There was nothing that could be done.
When one OAuth token can compromise dev tools, CI pipeline, secrets and deployment simultaneously, something architectural has gone wrong. Vercel have had React2Shell (CVSS 10), the middleware bypass (CVSS 9.1), and now this, all within 12 months. At what point do we start asking questions about the concentration of trust in the web ecosystem? It's funny that at the engineering level we are continuously grilled in in…
You have no idea how indifferent security officers can be-even when you point out critical issues. The other day, we flagged that a customer’s database had users with excessive privileges. Their only question: “Can this be exploited from the outside?” No, but most breaches today come from compromised internal accounts that are then used to break everything.