the rm -rf's will continue until morale improves
-
@neurovagrant In 2005, we had a rookie security consultant doing a penetration test for our client. To demonstrate that the client's app was vulnerable to SQL injection, he ran
drop table users;via injection.Twenty years of progress means we can make the rookie mistakes faster and with fewer employees.
@paco @neurovagrant imho, if LLMs are what make developers finally care about cybersecurity, that's the first thing about them one might consider 'good'
-
@rail @paco @neurovagrant Depends on how aggro the client wants to be.
Also depends on how well written your contact with the client is.
-
the rm -rf's will continue until morale improves
@neurovagrant I'm pushed to use claude at work... Three possible takeaways from this:
- Don't use auto mode and review the commands.
- Sandbox claude so that the fallout of such an oppsie is more limited.
- Do nothing and have a claude-free afternoon while I restore my profile.
-
A simple
select * from userswould've been fine just to prove the point.@jrdepriest @jztusk @paco @neurovagrant that shows access but not, whatsit, that the injected query has `drop table` privileges, I forget the term for it
-
@neurovagrant thats why dev machines are VM's for me and before I start to "dev" you make a backup. I think its time we teach about backups now.
@computernut43 @neurovagrant You mean one of the things that AI has just made unreasonably expensive?
-
the rm -rf's will continue until morale improves
@neurovagrant still waiting for the bad news
-
@neurovagrant @paco I don't think you can get your sysadmin certification without showing the scars where you dropped tables in production
-
@neurovagrant @paco I don't think you can get your sysadmin certification without showing the scars where you dropped tables in production
I once took out Nespresso's factory by DoSing its firewall until it fell over. On a Friday at 5pm. With no one on call. Oops.
-
I once took out Nespresso's factory by DoSing its firewall until it fell over. On a Friday at 5pm. With no one on call. Oops.
@webhat @neurovagrant @paco
They lost a couple of tons of roasting beans...To be fair, it was my boss's fault for not allowing me to sniff the network with the systems at rest.
-
@neurovagrant I realize that formal verification is a real pain; but I can't help but get the strong impression that software's experiments with downright belligerent levels of dumb empiricism might be going badly.
It's like watching civil engineers overcome with excitement at the velocities achievable under "hold my beer" standards and practices.
@fuzzyfuzzyfungus @neurovagrant for whatever it is worth this is our belief as well
-
the rm -rf's will continue until morale improves
@neurovagrant In case this hasn't been linked yet in this thread, relevant @davidrevoy comic:
https://framapiaf.org/@davidrevoy/116211515986568390 -
the rm -rf's will continue until morale improves
-
If you ask a human to explain an action, they think back to what they were thinking at the time. LLMs don't do that, because LLM's don't think.
GenAI engines are chatbots. They generate text. They match your prompt against some subset of the billions of rules they have and the combination of rules that trigger most strongly determines the response, one word at a time.
The only honest explanation for “why this behaviour and not that behaviour” would be “these rules triggered more strongly than those rules”.
@BenAveling @bartholin @neurovagrant "I was about to switch off the stove, but then the doorbell rang and I forgot."
-
@webhat @neurovagrant @paco
They lost a couple of tons of roasting beans...To be fair, it was my boss's fault for not allowing me to sniff the network with the systems at rest.
In a meeting with all the bigwigs at a foreign top secret missile manufacturing HQ while I was troubleshooting a problem there I mentioned that I had sniffed their network. One of the network engineers stood up and shouted "Arrest that man!". I replied "If you like, but I found your problem". They invited me back another time for another issue they were having.
The lesson here, kids, is don't ask for permission first.
-
the rm -rf's will continue until morale improves
@neurovagrant I wonder if there's a correlation between this happening to people who also don't have backups.
-
@neurovagrant @paco I don't think you can get your sysadmin certification without showing the scars where you dropped tables in production
@webhat As they say: if that first cup of coffee doesn’t wake you up in the morning, try dropping a table in production.
@neurovagrant -
@quinn @neurovagrant someone rm'ing themselves because they gave claude too much access, who self-identifies as a cto, strikes me as one of those "php ceo" types, who does a lot of talking but never really produces stuff or makes anything interesting or worthwhile.
@Viss @quinn @neurovagrant Oh, they produce a lot now. So much. Productive bigly. Lots for others to review.
-
@computernut43 @neurovagrant You mean one of the things that AI has just made unreasonably expensive?
-
@neurovagrant In 2005, we had a rookie security consultant doing a penetration test for our client. To demonstrate that the client's app was vulnerable to SQL injection, he ran
drop table users;via injection.Twenty years of progress means we can make the rookie mistakes faster and with fewer employees.
-
the rm -rf's will continue until morale improves
@neurovagrant@masto.deoan.org and then there's my uncle not knowing how to upload images to ChatGPT or how to log in again after an update. It ain't the devs alone who have no sense. That said my uncle is basically a chud. That said, for AI to
rm -rf /is so fucking awful, given that it's the "erase absolutely everything on this computer, yes, I am absolutely sure" command.
