Today in InfoSec Job Security News:

[draeath@infosec.exchange]

@badsamurai @da_667 @GossiTheDog I've seen setups that run tests and such all in a closed loop, I suppose if one really wanted to "use" this shit, they could implement that sort of thing too.

It'll cause a shedload more token use (and electrical waste) but might mitigate some of the idiocy.

[alan@mindly.social]

@cR0w @GossiTheDog Where "a sufficient number" is defined as 125% of all existing and future security practitioners, certified or not.

[draeath@infosec.exchange]

@nihkeys @DJGummikuh @GossiTheDog I don't think that phrase allows for incompetency in design. The purpose is what was intended, not what actually results. There is a distinction.

[dlakelan@mastodon.sdf.org]

@GossiTheDog
The real question is why does a bot have commit privileges on a "major web framework"?

i mean the answer is probably because google owns the repo probably... but why?

[draeath@infosec.exchange]

@s_bergmann @GossiTheDog I like how AIDER uses co-authors, so you can't escape from blame. All these tools should be doing similar!

[violetmadder@kolektiva.social]

@nihkeys @DJGummikuh @GossiTheDog

The damage is the point.

It's a weapon.

Not sure I'd call it a "targeted" attack, when the goal is to flood absolutely EVERYTHING with shit everywhere.

[ftp_alun@infosec.exchange]

@GossiTheDog fault injection into production code at scale. Nice.

[spinnyspinlock@infosec.exchange]

@GossiTheDog I became used to checking projects I am checking out for claude (etc) in the source files and commits really fast

[ptesarik@infosec.exchange]

@etchedpixels Bug bounties? You know nothing about business…
You set up a giant scam tool, let venture capital pay for its development, then use it to hack the world and sell all of it:

• license use of the tool,
• hacking applications,
• vulnerability scanning,
• protection racket from affected companies.

That' how real capitalists do business.
The tool is called Claude.
@GossiTheDog

[tarheel@mstdn.io]

@etchedpixels @GossiTheDog

Gahhh. Takes a little effort to imagine LESS rewarding work.

[keith_lawson@mastodon.social]

@GossiTheDog This was literally the first major security mistake I made in my early days as a Perl developer and I don't imagine it's that uncommon. Claude has probably been trained with a truckload of code with these vulnerabilities.

That's okay because we run everything in single-purpose Docker containers now though, right? /s

[bradley@techhub.social]

@da_667 @GossiTheDog

[spinnyspinlock@infosec.exchange]

@GossiTheDog I see it, could probably start a threat intelligence business off the claude feed ‍️

[carpetbomberz@mastodon.online]

@GossiTheDog

That Claude is a "clod", and boy does Claude get around I tell ya'.

Claude is everywhere you want an exploit to be.

[badsamurai@infosec.exchange]

@draeath

These MFers yeet DIRFT (Do it right the first time) and TQM principles to play hooky on the plinko and demand you call them a genius.

@da_667 @GossiTheDog

[abucci@buc.ci]

@GossiTheDog@cyberplace.social An instance of eating the seed corn, I'd say ( https://buc.ci/abucci/p/1705679109.757852 ).

[iagox86@infosec.exchange]

@badsamurai @da_667 @GossiTheDog Hey, as somebody writing a CTF, it's handy to get randomly introduced vulnerabilities!

[joshbressers@infosec.exchange]

@hughsie @GossiTheDog It’s the circle of life. Extra points if the fix has new vulnerabilities in it!

[confuseacat@mastodon.social]

@draeath @nihkeys @DJGummikuh @GossiTheDog not if you want to understand the system.
https://en.wikipedia.org/wiki/The_purpose_of_a_system_is_what_it_does

[trivernis@social.funkyfish.cool]

@spinnyspinlock@infosec.exchange @GossiTheDog@cyberplace.social If github lists claude (or other LLMs) as one of the top contributors I consider that a red flag