Today in InfoSec Job Security News:

[zarchasmpgmr@infosec.exchange]

@da_667 @GossiTheDog I have 5 500MB HDDs that are now probably worth thousands.

[wdeborger@toot.community]

@GossiTheDog could you explain what the vulnerability is?

[pier@infosec.exchange]

@fennix @thomasfuchs @GossiTheDog If climate change is not fixed there will also be no more cancer.

[bellegraylane@universeodon.com]

@da_667 @GossiTheDog every single arsonist would love to be a fireman. Now with Claude you can too. Lol

[hittitezombie@mastodon.me.uk]

@GossiTheDog
This is more and more feels like a coordinated attack on FOSS by the big software.

[naikrovek@hachyderm.io]

@c64whiz @GossiTheDog not possible; these places are not coordinated enough for even one of them to orchestrate something like this, much less invent the poison pill they intend to give everyone. forget about any cross-company collaboration on something like this. people fight over C++ ISO committee decisions, and they WANT to work together, and they already know what is needed, there is no way any for-profit businesses came up with "AI", got people to buy into it (more than their own products even) and trick everyone into introducing bugs into their own code.

[joeyh@sunbeam.city]

@GossiTheDog protip, go to https://github.com/claude and click on Block User and you will see a helpful warning banner on any github repo that contains code from it.

[mike805@noc.social]

@n1xnx @crazyeddie @GossiTheDog That was a classic problem with "computerize this workflow." The consultants would go in and document the formal process. Then they would draw their flowcharts and data flow diagrams, and the coders would replicate the formal process in code.

But with the paper process, you could write notes in the margins of the form, and the code didn't capture that.

You could line out wrong entries, but the program didn't capture that.

So the code wasn't usable, and you 1/3

[longplay_games@mastodon.gamedev.place]

@joeyh @GossiTheDog Oh no

*well*
Guess I'm staying on the version I have.

[mike805@noc.social]

@n1xnx @crazyeddie @GossiTheDog spent a couple of years and a lot of money modifying the code to handle all the exceptions that humans just took care of.

I ran into that at a restaurant. Tried to order online and there was no way to do any ingredient substitutions, so I had to call in and explain to a human.

Computer based processes also let badguys exploit holes in the exception handlers that humans would notice. The book "Catch Me If You Can" is a classic example with check routing. 2/3

[fennix@infosec.space]

@pier @thomasfuchs @GossiTheDog

That was the joke; I was using a different form of the word "fixed".

Either way, gallows humour.

[mike805@noc.social]

@n1xnx @crazyeddie @GossiTheDog You could change one digit to route a "local" check clear across the country, and then it would be mailed back, taking over a week for the check to bounce. Funds were available in three days.

The best automations are not based on cloning the old process, but rather a rethink of the entire problem. Ex: container shipping. They did not invent a robot longshoreman, but instead reconsidered the problem of moving stuff.

Or you automate only the easy part: ATMs. 3/3

[aristot73@infosec.exchange]

@Drat @da_667 @GossiTheDog pay llm to introduce bugs then pay llm to find and fix and then pay llm to detect the ones they didn't find and fix. win win win.

[prefec2@norden.social]

@GossiTheDog @deliberately_me @perigee GitHub is also the training set for many different AIs including Copilot.

Maybe it is also an attack on Copilot.

As a global repo, we should try to go elsewhere - like Codeberg.

[unusnemo@friendica.rogueproject.org]

@GossiTheDog

Claude contributes 0% of any of the repos I use. Though, I will keep an eye on that. Why are pull requests being accepted without analysis? These repos themselves are suspect that they we do so.

[cxj@phpc.social]

@zarchasmpgmr @da_667 @GossiTheDog Or msybe introduce 20 vulnerabilities and show off by then finding 10 of them giving a false sense of competence.

[ndevenish@mas.to]

@GossiTheDog @davidgerard I asked it to put an OIDC flow into a confidential app. It worked! I mean, it also sent all of the secrets and access keys via the client… but someone not paying attention would probably just take it.

We’re going to see the dumbest security issues of our lives in the next couple of years, aren’t we.

[musevg@23.social]

@violetmadder @nihkeys @DJGummikuh @GossiTheDog
It targets the concept of FLOSS as a whole. And the good ole idea of "Open Source means better software because everyone can read the source code".

Flood the zone with slop.

[jti42@infosec.exchange]

@GossiTheDog 5%? I'm seriously surprised that it's so little.
Eh, infinite job security I guess? (Nobody talks about pleasant jobs, just secure ones here 😆)

[peteypetepete@mastodon.social]

@GossiTheDog
Is there a way to report this bot and revert the damage? And make projects safer from these types of slop?