Capitalism is happy to have cheap code that works “well enough” to sell, and mostly prefers it to expensive code that works “really well.”
The future is full of buggy ass code that runs most services and devices, who’s main priority is vacuuming up data about its users and everyone and everything around them, and then a few high quality products and services only the rich can afford.
The NPM ecosystem has been ripe for this kind of invasion over a decade. And I don’t want to make generalizations or throw shade at a whole class of people, but over the years I have met a lot of very complacent, very naive about security Node devs (some of whom have gotten very frustrated with me for raising concerns about the ecosystem being a ticking time bomb).
I’ve been expecting something like this for years.
Checkmate evolutionists!
The user’s code is vulnerable to a buffer overflow in certain edge cases. I need to patch the vulnerability and commit the patch to the repo.
I should rewrite the existing memmanage() function to handle these edge cases. (Silently removes all other functionality)
I should modify garbagecollect() to detect these edge cases. I’ll rename it to garbage_collector() for clarity and readability. (Renames the function, calls it no where)
(Confidently) I modified the program as requested, the new version of your application should be more secure and handle memory issues much more efficiently.
I’ve been forseeing a supply chain apocalypse, especially in the NPM ecosystem, coming for years. Exacerbated by LLMs telling people what libraries to use, including versions, and then people just cut and paste that in and walk away. Our standard practice of devs doing all their coding on a messy local machine, just running whatever stacks they’re working with on bare metal, often side by side, just in different virtual environments, always seemed like a powder keg waiting to go off.
Now with glassworm and shai halud, I’m feeling very prescient.
Why is feeding people political? What value add is forcing people to starve? Monsters.
I’ve been doing some free consulting work with Food Not Bombs chapters in my local area. The same day that SNAP went away, ICE started intimidating them.
IDK if this is a nationwide coordinated effort or unique to my area.
Companies attacking security researchers always goes so well for them.
This headline! Yes! We have mechanisms for that! But if the parties in power abdicate their responsibility to act then no, we can’t do anything.
My brother, you have come to the right house! In fact, we’re about to watch a great family film on that very topic, if you’d care to join us.
Coconuts are tropical! This is temperate zone!
I like big nacelles.
deleted by creator
I’m gonna upgrade the redis instances I’m responsible for, but it looks like this only effects instances that are internet exposed. All my redis instances run on the same machine as the front end (I use them as a local cache, with $SQL as a remote source of ultimate truth).
The right is ramping up attacks on Wikipedia for “partisan bias” right now. If you think Wikipedia has partisan bias, it’s a really good indicator that your beliefs are out of line with reality.
My absolute favorite thing about LLMs is how when they do that they explain the problem with “my code” to me.
Once I figured out what was going on, reading it was much easier. Very clever.
Sure, but it’s subjective. Like I’m Kantian in my interactions with LLMs for that exact reason. But I don’t expect anyone else to be.
I think the Kantian view can be viewed as “Good advice, but it’s still a personal decision” and we shouldn’t get judgy at people for the choices they make that don’t affect us when we don’t have the full context of their life situation. Especially when it comes to sexuality and kinks. What you do with your p-zombie in the privacy of your own bedroom is actually none of my business at the end of the day.
Who the hell in the real world thinks prompt injection is “like SQL injection”?
Old business guys?