Today in InfoSec Job Security News:

[keith_lawson@mastodon.social]

@GossiTheDog This was literally the first major security mistake I made in my early days as a Perl developer and I don't imagine it's that uncommon. Claude has probably been trained with a truckload of code with these vulnerabilities.

That's okay because we run everything in single-purpose Docker containers now though, right? /s

[bradley@techhub.social]

@da_667 @GossiTheDog

[spinnyspinlock@infosec.exchange]

@GossiTheDog I see it, could probably start a threat intelligence business off the claude feed ‍️

[carpetbomberz@mastodon.online]

@GossiTheDog

That Claude is a "clod", and boy does Claude get around I tell ya'.

Claude is everywhere you want an exploit to be.

[badsamurai@infosec.exchange]

@draeath

These MFers yeet DIRFT (Do it right the first time) and TQM principles to play hooky on the plinko and demand you call them a genius.

@da_667 @GossiTheDog

[abucci@buc.ci]

@GossiTheDog@cyberplace.social An instance of eating the seed corn, I'd say ( https://buc.ci/abucci/p/1705679109.757852 ).

[iagox86@infosec.exchange]

@badsamurai @da_667 @GossiTheDog Hey, as somebody writing a CTF, it's handy to get randomly introduced vulnerabilities!

[joshbressers@infosec.exchange]

@hughsie @GossiTheDog It’s the circle of life. Extra points if the fix has new vulnerabilities in it!

[confuseacat@mastodon.social]

@draeath @nihkeys @DJGummikuh @GossiTheDog not if you want to understand the system.
https://en.wikipedia.org/wiki/The_purpose_of_a_system_is_what_it_does

[trivernis@social.funkyfish.cool]

@spinnyspinlock@infosec.exchange @GossiTheDog@cyberplace.social If github lists claude (or other LLMs) as one of the top contributors I consider that a red flag

[wgwz@hachyderm.io]

@GossiTheDog which framework?

[pinkforest@hachyderm.io]

@GossiTheDog I feel sorry for all the persons named Claude https://github.com/search?q=claude&type=commits

[vikonava@bijaiv.com]

@GossiTheDog this happens when people don’t care nor use AI responsibly… we have to do proper reviews EVERY SINGLE TIME

[chengdulittlea@mastodon.art]

@GossiTheDog but... Do these repositories all not have any review processes for their PRs?

[fritzadalis@infosec.exchange]

@GossiTheDog
So just make a bot that goes around behind claude and files a vuln bug and lists the revert as the fix.

[fritzadalis@infosec.exchange]

@GossiTheDog
Nvm these are commits, not prs.

[seism0saurus@infosec.exchange]

@GossiTheDog

Is there a cwe (common weakness enumeration) for AI slop usage already?

[sassinake@mastodon.social]

@GossiTheDog

fuck.

[apples_and_pears@mastodon.world]

@GossiTheDog I'm anti-AI. I used program generators long ago - they didn't work. They aren't maintainable. Major updates required complete rewrites.

Now there's AI. It's a manager's wet dream...until it isn't.

...but look how productive AI is. It can whip out code as fast as a gossip can spread noise. Sure, there will be glitches, but they'll be fixed when found.

What about the $$$$$ liability of glitches that are not found?

[carpetbomberz@mastodon.online]

@funnymonkey @GossiTheDog We don't need Skyntr becoming sentient to trigger the End o' Days.

We got Claude, happily vibing/making 2.1M commits while we were asleep.