Security-focused blog covering vulnerabilities, tech company claims, and critiques of AI firms, Cloudflare and Tesla safety statistics.
HN commenters cite it for Okta's security problems, Tesla death-rate comparisons, claims about Elon Musk's motives, and details of a software package integrity breach.
It's not so much that Copilot is a threat because it could produce tight, elegant code that handles all the edge cases and so on, but because employers still see coders as expensive keyboard jockeys whose code is not significantly better than what a Copilot user could cargo-cult into existence.
Blaming Copilot feels a bit like the wrong target. Like the Luddites, the real question is the relationship between employer and employee, and how the presence of the machine empowers or endangers the worker. To put it another way. Suppose a perfect Copilot existed, that required a human to drive it but made that human a 10x developer. Do you think they would get paid 10x as much? Or would the worker stay where they were, perhaps under threat of replacement, and the employer take the spoils?
https://www.flyingpenguin.com/?p=28925
Edit: to be clear, I am actually a big fan of Copilot for increasingly one's personal productivity, rather like a super-Google or a non-snarky-Stack Overflow. But I remain rather cynical about how those benefits might work in the new corporate environment.
How about the boy who called nonsense security vulnerabilities. This is the same author who posts with incredulity that the ability to change a config file with a shell command in it gives you the ability to run the shell command you posted and wants it treated as some big CVE. Absolutely inconceivable that you might already have your harness in a sandbox where this is okay, and inconceivable that anyone might have a threat model that says that someone who can edit configuration of a tool can make that tool do arbitrary things allowed by its config.
https://www.flyingpenguin.com/ox-security-report-anthropic-mcp-is-execute-first-validate-never/
The developer responsible for breaking the integrity of this commonly used software package is known as Brandon Nozaki Miller. It is public information that he is the maintainer. I think we will have to wait for him to announce if he personally did this or was hacked.
TURN OFF AUTO UPDATES FOR DEPENDENCIES.
One good thing is that this bad actor will just bring more light to better practices for dependency management.
https://www.flyingpenguin.com/?p=38727
Edit: you can read his responses here
https://github.com/RIAEvangelist/node-ipc/issues/233
Good but not necessarily better that was is already pay-as-you-go available today. ref. https://www.flyingpenguin.com/the-boy-that-cried-mythos-verification-is-collapsing-trust-in-anthropic/
This AISLE benchmark is interesting in this matter: https://aisle.com/blog/ai-cybersecurity-after-mythos-the-jagged-frontier
And the recently discovered Copy Fail by Xint code is another proof that the gating is overblown: https://xint.io/blog/copy-fail-linux-distributions
Okta has been plagued by security issues [1], never heard of Ping Identity, Azure only makes sense if you get a sweetheart deal and are willing to deal with Azure's crap, and I'd never recommend anyone to use anything Google any more.
[1] https://www.flyingpenguin.com/?p=54722
They also crash way more often[1] and have disproportionally more deaths[2].
1. https://www.forbes.com/sites/stevebanker/2023/12/18/tesla-has-the-highest-accident-rate-of-any-auto-brand/?sh=14b3f97a2894 2. https://www.flyingpenguin.com/?p=35819