False Security

#1

Post by peterohler » Wed, May 13, 2026, 12:51 PM UTC

I got bitten yesterday by a PR submitted by Orbis Security that was a one line change that actually did nothing but was used to trumpet what an amazing fix it was for a blog article which was also full of inaccuracies.

The PR was useful though as it show that the supposed fix was in a function that was never called. I removed it this morning.

The PR if anyone is interested is https://github.com/ohler55/oj/pull/1011

Re: False Security

#2

Post by selectedambient » Wed, May 13, 2026, 1:13 PM UTC

that's just obnoxious, do you have a link to the article they created about it?

Re: False Security

#3

Post by peterohler » Wed, May 13, 2026, 3:17 PM UTC

I was contacted by the submitter and they apologized and removed the blog entry. It was AI generated. It was nice to see they were upstanding enough to correct it. That's a plus in my book.

Re: False Security

#4

Post by peterohler » Wed, May 13, 2026, 5:29 PM UTC

Well, blog entry is still there at https://orbisappsec.com/blog/critical-buffer-overflow-in-ojs... but it is total nonsense and a hallucination.

Re: False Security

#5

Post by selectedambient » Wed, May 13, 2026, 10:48 PM UTC

peterohler wrote: post #3

I was contacted by the submitter and they apologized and removed the blog entry. It was AI generated. It was nice to see they were upstanding enough to correct it. That's a plus in my book.

it is good to hear that they at least admitted to it and complied.