Today in InfoSec Job Security News:

[n1xnx@tilde.zone]

@GossiTheDog
Aaaahhh!
Who is giving clankers commit privileges to their repositories? Seems like an obvious failure of project management.

[n1xnx@tilde.zone]

@keith_lawson @GossiTheDog

I keep pointing out to my coworkers that these clankers are trained on StackOverflow posts that contain code examples followed by "here's what I wrote, why doesn't it work?"

[crypticrainfall@app.wafrn.net]

This is just starting to sound like a cyber attack.

[gmoore@thepit.social]

@GossiTheDog This kind of basic stuff is easily caught by any free static analysis tool. There's no excuse to not be running one in one's repo, vibe-coded or not.

[crazyeddie@mastodon.social]

@Drat @da_667 @GossiTheDog It does. In the form I was really fond of it's $50 per 750 ml and makes you say stupid shit like, "GASP...that's really smooth...." and then shove your head up your ass.

But I'm actually sick to death of that kind of oblivion. The shit I have to unsee just keeps adding up as does the shame of letting shit pass by unopposed.

[benroyce@mastodon.social]

@crazyeddie @Drat @da_667 @GossiTheDog

strangely poetic

and absolutely true

[crazyeddie@mastodon.social]

@n1xnx @GossiTheDog Especially earlier in my career, I could easily have been taken in by thinking I'm getting actual help from a "friend" who wants to join me on the project and I'd have not really looked into it too much.

A lot of these projects are just peoples' hobbies that blow up...you know, or fail to. When they do blow up the developer(s) can end up severely overworked and frankly inexperienced for dealing with the management part.

So yeah...this is going to be a disaster.

[fooker@infosec.exchange]

@fuzzyfuzzyfungus is the question not more "why is anyone using such unreliable tools in the first place?" They've proven time and time again that the result is less than sub par, they create as many if not more issues than they fix, they've fucked up ram prices and soon storage prices, they use too much energy.. i could go on but fuck, if that's not enough i don't know what to say.

[n1xnx@tilde.zone]

@crazyeddie @GossiTheDog
Sigh. Yes, that makes perfect sense.

I remember reading commentary back in the 1980s to the effect that automating a (business) process doesn't make it BETTER, it just makes its existing failure modes happen FASTER, often with the result that the humans who were able to cope with those failures when they came at a human rate are now overwhelmed by them occurring at the speed of computer processing.

It was true then for paper-based accounting, and it's true now for collaborative software projects.

[scy@chaos.social]

@GossiTheDog But think about the AI-powered "security researchers". They can now use their AI models to find these vulnerabilities and create 8.2 severity issues to fix it again.

It's like that picture with the circular economy between Nvidia and OpenAI and Microsoft, but with 0days!

[crazyeddie@mastodon.social]

@vlkr @GossiTheDog I get the same behavior here and can go to other profiles just fine :p

No public repos. Something went wrong.

I guess it could just be that I picked a particularly irrelevant profile to compare against but it did show up just fine without any error.

Could also be that it's too sudden a shift in interest in that particular user.

[zarchasmpgmr@infosec.exchange]

@da_667 @GossiTheDog and I’ve been seeing several posts in the past 48 hours that say that A”I” vuln scanners aren’t finding most of them.

Almost makes me wonder if there’s a two-pronged attack here. Introduce them and ignore them.

[zarchasmpgmr@infosec.exchange]

@da_667 @GossiTheDog I have 5 500MB HDDs that are now probably worth thousands.

[wdeborger@toot.community]

@GossiTheDog could you explain what the vulnerability is?

[pier@infosec.exchange]

@fennix @thomasfuchs @GossiTheDog If climate change is not fixed there will also be no more cancer.

[bellegraylane@universeodon.com]

@da_667 @GossiTheDog every single arsonist would love to be a fireman. Now with Claude you can too. Lol

[hittitezombie@mastodon.me.uk]

@GossiTheDog
This is more and more feels like a coordinated attack on FOSS by the big software.

[naikrovek@hachyderm.io]

@c64whiz @GossiTheDog not possible; these places are not coordinated enough for even one of them to orchestrate something like this, much less invent the poison pill they intend to give everyone. forget about any cross-company collaboration on something like this. people fight over C++ ISO committee decisions, and they WANT to work together, and they already know what is needed, there is no way any for-profit businesses came up with "AI", got people to buy into it (more than their own products even) and trick everyone into introducing bugs into their own code.

[joeyh@sunbeam.city]

@GossiTheDog protip, go to https://github.com/claude and click on Block User and you will see a helpful warning banner on any github repo that contains code from it.

[mike805@noc.social]

@n1xnx @crazyeddie @GossiTheDog That was a classic problem with "computerize this workflow." The consultants would go in and document the formal process. Then they would draw their flowcharts and data flow diagrams, and the coders would replicate the formal process in code.

But with the paper process, you could write notes in the margins of the form, and the code didn't capture that.

You could line out wrong entries, but the program didn't capture that.

So the code wasn't usable, and you 1/3