aj3

They must know who downloaded radare and IDA as well then.

Yeah, that's bullshit. For NSA-proof personal tech stack you'd rely more on tamper-evident blocks that's all. Also, security in depth and security through obscurity are much more applicable if you're a person and not an organization. Finally, +20 years head start does not mean much if you distrohop and FOMO into bleeding edge stuff like a tech podcaster.

Actually hacking systems is easier than (some) individuals. It's pretty obvious if you think about it. ICS are operated by group of people, they have well defined accessibility and availability requirements, some sort of documentation exists, internal processes have large inertia.

On the other hand individual security professionals might have wildly different ideas about risk tolerance and convenience, which they also have privilege to change on the whim.

It's a huge code base, of course there are security issues. Same way IDA and radare have security issues. People who reverse malware take that into account.

But it's hosted on Github. And some distros have ghidra in official repos.

CSRF tokens have overhead and they have to be implemented for all inputs which isn't trivial (judging by amount of CSRF related vulnerabilities disclosed in hacker one reports). I think the intention here is to make cross site requests stand out so that they can be dealt with in a more streamlined/uniform fashion.

It's not FUD. There are protections, but csrf tokens are a workaround while these headers are more akin to proper solution. Also, it won't magically make CSRF obsolete same way Origin header and CORS didn't make CSRF obsolete, but it's another tool in the appsec toolbox.

That’s not much of a router with just two ports and no WiFi.

There's no indication that company was doing anything illegal though.

She’s not a native English speaker, fine. That doesn’t seem like a disqualifier to me.

Even makefiles are Turing complete.

Even if hypothetically there was such a strange bug in your piano and you decided to exploit it by recording copyrighted music and redistributing it, you would be accountable for it, not a piano.

This analogy train went too far, don't you think? All examples that I've seen on Twitter require quite an intentional manipulation by human for Copilot to produce something copyrighted. It does not recite Linux code by pressing 1 key.

There are plenty of SAAS that use GPL'd code on the backend. That's fine.

You're giving AI too much credit, it's just a tool, it does not have it's own intentions.

I.e. if you buy a piano or a guitar, you could play and record copyrighted music on it. That's not piano's or guitar's fault though, it's yours.

Moreover, some prefer both. I know because I am one of them.

Really enjoyed the opportunity to wfh before the pandemic and am really excited about the office now. I guess I just like the change of the scenery.

Say humans went extinct and some alien species revived us from collected germ cells. Even if they could work out all the genetic quirks to make new population sustainable, 40000 years of social progress would be lost. Resurrected population wouldn't have benefit of any scientific advances, nor would they have any sense of rational thinking, philosophy, religion, social structures, not even language and writing.

Humanity wiped out multiple species' social history and that change is irrevocable.

LTSB is already not supported by various games, Adobe products and even MS Office.

Mozilla doesn't have an incentive to add RSS since they would prefer larger Pocket adoption.

The whole saga with the outside oversight is also a complete red herring. USA would never sign a treaty that required them to show their own facilities.

Case in point: biological weapons convention. A few years back there was a very popular proposal to add “teeth”, i.e. random inspections and stuff. Guess who bailed out and passed a Hague invasion act instead?

EDIT: grammar

Ubiquity introduced new vulns while fixing that fiasco from last year: https://www.zerodayinitiative.com/blog/2021/5/24/cve-2021-22...

On the other hand, all of the other networking HW sucks just as much. E.g. here are Netgear vulnerabilities published just this week: https://www.microsoft.com/security/blog/2021/06/30/microsoft...

Yes they do get compromised and the information is published regularly. E.g. here is a news item from just this week: https://www.reuters.com/technology/denmarks-central-bank-exp...

Solarwinds was distributed by a malicious patch (through legit channels). So all orgs were unpatched and in fact all got at least first stage downloaded (if they patched during that window).

SolarWinds affected 100% of installations that updated their deployments during that 8 month window. Your 1% comes from the ratio of networks that were specifically targeted and received 2nd stage with all the goodies.

The reason why 2nd stage was only given to (relatively) small number of organizations - because the attack wasn’t ransomware, attackers didn’t have economical motives (in fact they were spooks on a government payroll).

EDIT: I can’t spell

I disagree with this attitude. Many demos such as this one with Quake code are intentionally looking for (funny) outliers by bending the rules. But this is not how anyone would use the system in a real scenario (no one should select license by typing "// Copyright\t" and selecting whatever gets auto-completed), so it doesn't really demonstrate any new limits besides what you could reasonably expect anyway (and what's mentioned on the Copilot's landing page).

Basically, in order to fall victim for this "code theft" (or any other "footguns" from Twitter threads) you'd need to be actively working against all the best practices and common sense. If you actually use it as a productivity tool (the way it is marketed) you'll remain in full control of your code.

I don't work for Github (nor MS) and do not represent Copilot.

In a real world scenario you wouldn't be mindlessly pressing Tab right after linebreak and accepting the first suggestion that comes your way. While entertaining, nobody gets paid to do that.

What you get paid is to write your own code. When you write your own code, generally you think first and then type. Well, with Copilot you think first and then start typing a few symbols before seeing automatic suggestions. If they are right, you accept changes and if they happen to be similar to any other code out there, you deal with it exactly the same as if you typed those lines yourself.

Code completion that can suggest the whole line instead of a single word (e.g. often it guesses function parameters and various math operations when you haven't even typed function name yet).

If you use it as a programming partner it will simply autofill whatever you're writing line-by-line. You're not forced to use code completion at a whole-function level and it's not even the suggested use-case.

Depends. If you find useful code on Github, Stack Overflow or anywhere else in the internet, you still need to check whether it is suitable with your licensing or not.

Then write the code yourself. It's not like you're forced to use this demo.