Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira

wiz.io

Post reply on HN
Print view View original

81–90 of 179 posts

Re: AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira

#81

Post by saghm »

inahga wrote: post #37

I probably would have made the same mistake. It is negligent to write GitHub Actions without using static analysis. Use zizmor in CI https://github.com/zizmorcore/zizmor error[template-injection]: code injection via template expansion --> .github/workflows/jira_issue.yml:24:29 | 22 | run: | | --- this run block 23 | # Escape special characters in title and body 24 | TITLE=$(echo '${{ github.event.issue.title }}' | se…

Shell scripts on their own already are so perilous without static analysis. I'll never understand how we ended up deciding that embed them in yaml instead of requiring an external script file was a reasonable idea.

Re: AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira

#82

Post by jeroenhd »

doix wrote: post #46
procone wrote: post #19

YAML is a nightmare fuel spec. In its quest to make markup "human readable", it has created countless footguns. I honestly prefer XML at this point.

Yeah, the YAMLification of everything kinda killed my ability to understand "everything". Previously, if you knew the Linux userland well, I felt like you could figure anything out with enough digging. Take CI for example, it was Jenkins and it ran a csh/bash/zsh whatever script and captured the output. Nice and simple (even if the scripts sometimes got insane). GitHub actions is nothing like that. Weird home grown e…

The things done in yaml today would've been obscure bash oneliners had YAML not existed.

Jenkins still exists and it's no less complicated than Github Actions. The complexity gets hidden in obscure script files, obscure tabbed UI, and remote services for doing things Jenkins itself can't do. Defaulting to system tooling makes it almost impossible to predict what a job will do unless you know exactly how paths and tooling are set up (and what versions they're running).

None of my personal experiences with Jenkins had scripts that ran locally, they all relied on pre-installed software on the server because that was the thing people would do before the great YAMLification. You could copy-paste the Jenkins job, but unless you have Jabberwocky v2018.3 installed in /home/JabberWock/RELEASE, the script will fail.

The entire software development flow has been made incredibly complex by hooking up automations into every nook and cranny.

All of these complications need to be enabled manually, though. If your flow is complicated, you can cut it down to manageable size by doing a few more processes manually.

Luckily, all of the simplication and reproduction steps for Github also apply to Jenkins. Github YAML files are just scripts with different syntax, after all. Just like you can run bash locally, you can run act and reproduce whatever Github trigger you need. From there, you can simplify pipelines, stop curl2bashing "plugins", and so on.

Re: AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira

#83

Post by jeroenhd »

hutattedonmyarm wrote: post #80
xgulfie wrote: post #48

Earlier quoted context omitted.

I've seen people put "//" keys in their json lol

There _is_ a json variant with comments, so that’s what you’ve seen. Not all parsers support that though

It's non-standard JSON, so you can probably just assume most patsers don't support any given commented parser.

At least XML permitted comments, fhe shift to JSON on everything almost makes me nostalgic.

Re: AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira

#84

Post by IncreasePosts »

inahga wrote: post #37

I probably would have made the same mistake. It is negligent to write GitHub Actions without using static analysis. Use zizmor in CI https://github.com/zizmorcore/zizmor error[template-injection]: code injection via template expansion --> .github/workflows/jira_issue.yml:24:29 | 22 | run: | | --- this run block 23 | # Escape special characters in title and body 24 | TITLE=$(echo '${{ github.event.issue.title }}' | se…

Is that project named after the serial nyc subway advertising dermatologist?

Re: AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira

#85

Post by cryo32 »

inahga wrote: post #37

I probably would have made the same mistake. It is negligent to write GitHub Actions without using static analysis. Use zizmor in CI https://github.com/zizmorcore/zizmor error[template-injection]: code injection via template expansion --> .github/workflows/jira_issue.yml:24:29 | 22 | run: | | --- this run block 23 | # Escape special characters in title and body 24 | TITLE=$(echo '${{ github.event.issue.title }}' | se…

Proof that LLMs are trained on mediocre shit. That is by definition, mediocre shit.

Re: AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira

#86

Post by woodruffw »

btown wrote: post #44
inahga wrote: post #37

I probably would have made the same mistake. It is negligent to write GitHub Actions without using static analysis. Use zizmor in CI https://github.com/zizmorcore/zizmor error[template-injection]: code injection via template expansion --> .github/workflows/jira_issue.yml:24:29 | 22 | run: | | --- this run block 23 | # Escape special characters in title and body 24 | TITLE=$(echo '${{ github.event.issue.title }}' | se…

This is a really cool tool! Would zizmor have caught the below as well? From the article: > The workflow had an if: condition that appeared protective: > if: (github.event_name == 'issues' && github.event.pull_request.user.login != 'whitesource-for-github-com[bot]') > However, on issues events, github.event.pull_request is always null. So the condition reduces to (null != 'whitesource-for-github-com[bot]'). This is a…

zizmor wouldn’t catch that condition at the moment, although it does have similar checks for other unsound conditions and incorrect/vulnerable bot actor checks. This one wouldn’t be too hard to add, though.

(Source: I am zizmor’s maintainer.)

Re: AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira

#87

Post by xgulfie »

hutattedonmyarm wrote: post #80
xgulfie wrote: post #48

Earlier quoted context omitted.

I've seen people put "//" keys in their json lol

There _is_ a json variant with comments, so that’s what you’ve seen. Not all parsers support that though

Are you denying what I've seen with my own eyes? I am saying it was an object like this:

{ "//":"make sure these are divisible by 8", "width": 640, "height": 480 }

Re: AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira

#88

Post by tingletech »

IncreasePosts wrote: post #84
inahga wrote: post #37

I probably would have made the same mistake. It is negligent to write GitHub Actions without using static analysis. Use zizmor in CI https://github.com/zizmorcore/zizmor error[template-injection]: code injection via template expansion --> .github/workflows/jira_issue.yml:24:29 | 22 | run: | | --- this run block 23 | # Escape special characters in title and body 24 | TITLE=$(echo '${{ github.event.issue.title }}' | se…

Is that project named after the serial nyc subway advertising dermatologist?

yes, it says "Now you can have beautiful clean workflows!" and links to a youtube video of a TV ad for a dermatologist.

Re: AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira

#89

Post by ljm »

ctoth wrote: post #50
fg137 wrote: post #39

Earlier quoted context omitted.

I have seen plenty of "my backlog has never been shorter" comments here. I'm interested in how that turns out 6 months later. In my team, we have plenty of enhancement requests from users. We address those that make obvious sense and are trivial to do but withhold from others, even though the code change itself is likely small. Because we don't know if there is more than a single user that can actually benefit from i…

> but withhold from others, even though the code change itself is likely small. Prediction: programming is going to change massively not only because the cost of creating code will go down, but because people are so tired of this sort of gatekeeping "we know better" from programmers.

This describes a product with no vision or purpose.

People have to take 'no' for an answer sometimes, even if they don't accept it. You can't really 'gatekeep' your own product.

Re: AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira

#90

Post by otterley »

rafram wrote: post #40
rawgabbit wrote: post #31

Earlier quoted context omitted.

Help me understand. Snowflake configured their Github repo to allow auto fixes by Copilot. It got merged automatically without anyone's review? And introduced essentially script-injection vulnerability through the title field? If this is the case, I would say Snowflake should shut down its repo and get off Github asap.

No. A Snowflake maintainer opened a PR, Copilot suggested a change (introducing a vulnerability), the maintainer accepted and committed it to their PR, and another Snowflake maintainer approved and merged the PR.

I don't see anything in the article that says that two maintainers, let alone one, reviewed the PR manually and approved it before merging. Where are you getting this information from?
Post reply on HN