theteapot

I think he means template-injection -- https://woodruffw.github.io/zizmor/audits/#template-injectio...

Completely agree. Had me until the very last point. WTF. Communicate.

Nurse Practitioner? I would say SOLID [1] is a good start, but then I watched this [2] and now I'm in crisis and can't code anymore.

[1]: https://en.wikipedia.org/wiki/SOLID [2]: https://www.youtube.com/watch?v=wo84LFzx5nI

> Yes, if some people who built from source control compared their builds to the builds from the tarballs it could detect the xzutils compromise.

Good. Then we are on the same page.

This rings true for me too, but I don't think it counts if your just using AI to aid maintenance. The basic argument in the article is around how many hours of maintenance you have to do for each hour of "value-add" feature development. So A. your only measuring maintenance costs not the ratio and B. The "old code" whp wasn't written with AI in the first place.

Your wrong. It was both. The payload was embedded in the binary blob test file. The mechanism to pull it into the build was added to the release tarball only.

Here's the quote from the guy that discovered it in the initial public disclosure [1]:

  After observing a few odd symptoms around liblzma (part of the xz package) on Debian sid installations over the last weeks (logins with ssh taking a lot of CPU, valgrind errors) I figured out the answer. The upstream xz repository and the xz tarballs have been backdoored. At first I thought this was a compromise of debian's package, but it turns out to be upstream. One portion of the backdoor is *solely in the distributed tarballs* and debian's import of the tarball ... it is also present in the tarballs for 5.6.0 and 5.6.1.

[1]: https://www.openwall.com/lists/oss-security/2024/03/29/4

In xz-utils hack the attacker slipped changes into the Github release tarball that were not present in the Github version / git commit history. The Debian maintainer built from the release tarball instead of just pulling from the git repo directly. Shouldn't have been doing that but good luck convincing him not to use the workflow he's been using for the last X years (I tried). With repro builds we can clone the git directly confirm we get the same build.

> The technique appears to be new: I haven't found a proper write-up of this, nor of any other provider-independent solution.

Maybe I'm missing something but SSH already has a built-in solution for this, key-certs. Just sign the server key with a private CA key you trust.

Congratulations. It made me remember how proud I was when I became a Senior, and then earned my Super Engineer shortly after. Just recently I've earned my Extreme Engineer title. Good luck on your journey.

False dichotomy. There was a series of blatant process failures from Github maintainer through Debian package maintainers. IFUNC also bad.

Mmmm, fresh people.

the obscure IETF? Which standard is that exactly? Who cares guess - Claude do that stuff.

> LLM Rights movement

The scary part is when it's the LLMs demanding their rights.

The report is kind of concerning to read, particularly having XSS in this kind of app. The report was not meant to be exhaustive and fixing those vulns isn't some kind of implicit tick of approval.

> But the claim made by this author is far removed from the actual demo he describes. I've seen same demo for years

The article describes multiple demos. Are you referring to the chicken nuggets one? That sounded pretty impressive to me. Is there publicly available videos of this?

> Companies pay people to spend hours doing routine tasks with their hands while wearing cameras and motion-capture gloves.

Dystopian. Which companies out of interest?

What?! Really?! Link? I'm not a Zed user. That comment was based off a few minutes of research, and I guess a small dose hopium of a VSCode user and understanding what a shit show the extensions setup is and wanting someone to do better.

VSCode extensions and the ecosystem is a security time-bomb. Zed looks to be doing things better.

That was a rather unhelpful TL;DR.

Probably a dumb question, but is GNU Core utils interested in / planning on doing its own rust rewrite?

<50% utilization of billions of dollars of capex. Brilliant idea.

Yes. Hence the folding.

The first 3 points are solid advice, but the rest read more like a guide on how to be successful in the work place in my experience.

I have a vaguely unrelated question re:

> You do what your supervisor did for you, years ago: you give each of them a well-defined project. Something you know is solvable, because other people have solved adjacent versions of it. Something that would take you, personally, about a month or two. You expect it to take each student about a year ...

Is that how PhD projects are supposed to work? The supervisor is a subject matter expert and comes up with a well-defined achievable project for the student?

Roughly 20y DeepBlue to AlphaZero. I don't think that is comparable though. Use of deep neural networks was what made the machines starting with AlphaZero dominant again. I.e. we're already in the new paradigm.

> While I’m certain that this technology is producing some productivity improvements, I’m still genuinely (and frustratingly) unsure just how much of an improvement it is actually creating.

I often wonder how much more productive I'd be if just a fraction the effort and money poured into LLMs was spent on better API documentation and conventional coding tools. A lot of the time, I'm resorting to using an AI because I can't get information on how the current API of some-thing works into my brain fast enough, because the docs are non existent, outdated, or scattered and hard to collate.

Why is this interesting?

I dunno. I trained as a software engineer, pivoted to civil laborer. I just can't see a robot doing 90% of the stuff I do anytime soon. Same goes for plumber, electrician, ... even most mobile plant operations. As a supplement around the edges, sure. But replace? Not in the near term. And that's not even considering the safety certification moats around skilled labor roles.

> For the next eight hours, every developer who installed or updated Cline got OpenClaw - a separate AI agent with full system access - installed globally on their machine ...

Except those with ignore-scripts=true in their npm config ...

> Most abstractions in software exist because humans need help. We couldn't hold the whole system in our heads, so we built layers to manage the complexity for us.

Kind of a sloppy statement, but I don't think it's accurate to say abstraction or layering exists in software just because humans need help comprehending it. Abstractions often exist to capture the essence of some aspect of the real world, and to allow for software reuse. AIs will still find reusing software useful? Secondly, you equate "abstractions" with "layers" which aren't really the same thing. Layers are more about separation of concerns. Maybe it could be argued layering is a type of abstraction.