the rm -rf's will continue until morale improves

[somevegancheeseisok@mastodon.social]

@jrdepriest @jztusk @paco @neurovagrant no, drop tables *also* let's you demonstrate the presence or absence of effective backups. It's a two for one test!

[womble@infosec.exchange]

@jrdepriest @jztusk @paco @neurovagrant "oh, it's only data exfil, that's not so bad" Some people have very limited imaginations, and need an unequivocal demonstration.

[n_dimension@infosec.exchange]

@Taffer @neurovagrant

Nobody writes a CLAUDE.md to raise their pass rate on code issues. They write it so the agent follows the project's conventions. The study scored the first and got quoted as debunking the second.

There is a token overhead on compliance (about 20%?), it works for me, though I never run a project without it.

Edit: Though its the weakest counterpoint, AGENTS.md =\= CLAUDE.md and the fact the author doesn't seem to know that, irks me more than it should.

[viss@mastodon.social]

@neurovagrant @quinn cool now we get to see how well he handles disaster recovery and business continuity

[quinn@social.circl.lu]

@Viss @neurovagrant Letsss goooooo

[jztusk@mastodon.social]

@womble @jrdepriest @paco @neurovagrant

Exactly. "Well that's only showing they can read", whereas having an unrequested calculator sitting there on your desktop is very undeniable.

[jrdepriest@infosec.exchange]

@jztusk @womble @paco @neurovagrant

Mission accomplished with the table drop, then?

[viss@mastodon.social]

@quinn @neurovagrant someone rm'ing themselves because they gave claude too much access, who self-identifies as a cto, strikes me as one of those "php ceo" types, who does a lot of talking but never really produces stuff or makes anything interesting or worthwhile.

[kirakira@furry.engineer]

@neurovagrant apes gone

[paco@infosec.exchange]

@jztusk There are tons. Calculations or delays that indicate it was processed without doing anything to data.
@neurovagrant

[jztusk@mastodon.social]

@jrdepriest @womble @paco @neurovagrant

Well, you *can* then just close the calculator, though you can't deny that it was there.

I was wondering if the was some standard, like you create a table named "tag_youre_it", and insert "boop" in a CHAR(4) field. Reversible, but undeniable.

[huronbikes@cyberplace.social]

@Viss @neurovagrant @quinn rizaster decovery and business kindakablooey?

[jrdepriest@infosec.exchange]

@jztusk @womble @paco @neurovagrant

Like leaving an empty file called pwned on /.

[paco@infosec.exchange]

@jrdepriest It’s a true story, but I tell it a certain way to get a reaction. It was in a UAT environment, not prod. To be fair, it was a precious UAT environment that hundreds of people count on. It was not quick to rebuild. The client was pissed. But it wasn’t deleting real users from the real web site.

@jztusk @womble @neurovagrant

[womble@infosec.exchange]

@jztusk @jrdepriest @paco @neurovagrant CREATE TABLE l33th4x0rs (pwned bool default true); does seem like the least intrusive way to demonstrate the acquisition of significant privileges.

[jztusk@mastodon.social]

@jrdepriest @womble @paco @neurovagrant

Exactly!

(Is that a common file system POC sign?)

[kittenkoder@mastodon.social]

@neurovagrant I love seeing ai bros bitching about shit us older geeks warned would happen, especially those of us who worked on real AI.

They're using LLMs for shit it's not good at then bitching about the broken shit. I'm just going to keep eating my popcorn.

[senil@gts.social.senil.me]

@paco @neurovagrant Good ol' Little Bobby Tables.

[laukidh@infosec.exchange]

@neurovagrant I suspect his idea of a dev machine wouldn’t match mine.

[aizuchi@hachyderm.io]

@KittenKoder @neurovagrant This