• 1 Post
  • 129 Comments
Joined 3 years ago
cake
Cake day: March 22nd, 2024

help-circle



  • I agree that this is more plausible, but it’s still almost as baffling, since it suggests that the existence of some people who can afford a (hypothetical) bed-making robot implies the nonexistence of people who can’t. Like, at least Ovacado toast in a cafe was a vaguely affordable luxury that someone could conceivably stretch their means to occasionally purchase. This is more like “all you need to do to stop being poor is cut back on having your chauffer paint himself in gold leaf to match your limo”.



  • I need someone with more actual software dev knowledge to back me up on something. It looks like there’s a new zero-interaction remote code execution vulnerability in most major vibe code generators. I’ve seen it called Plugin4Shell because apparently we’re still doing marketing names instead of actually getting CVE numbers for these things. The link there seems like a decent overview.

    The bug, dubbed Plugin4Shell, breaks SHA pinning, the mechanism developers rely on to lock an installed plugin to a specific, reviewed version of its code. Pinning is supposed to mean that once a plugin passes review, it cannot change without the developer’s knowledge.

    AIR’s researchers found that every one of the four agents checks out the pinned commit without verifying the checkout landed there, letting an attacker swap in malicious code while the pin still looks intact.

    So if I’m reading this right, the mechanism to cryptographically ensure that your AI agents are using the code they say they are just was straight-up not being checked? This feels like it should go on the big board of incredibly obvious failures, but I’m not familiar enough with the git side of things to be absolutely confident in that. Like, if a person tried to pass off software that did this it would have significant career implications, right? Or am I misunderstanding something somewhere?











  • I feel like there’s got to be a decent middle ground between a pinned post that pushes this in front of everyone and requires further mod comments to try and stave off harassment and silently letting anyone who notices find the mod logs and make their own judgements of everyone involved. Like, in the absence of an actual announcement I think people would absolutely come to their own much more inflammatory conclusions if/when they noticed regardless of what the removed mod does, and the removed mod could make things into an absolute shit storm (which they don’t appear to be trying to do as far as I can tell, to their credit). But on the flip side, the way this post is set up is also an escalation in its own right and represents a more aggressive use of power by the remaining mods than was absolutely necessary.

    If blahaj.zone has an instance business forum then making the full statement there (where it won’t get pushed out of sight as fast as the 196 churn would do to a non-stickied post) and linking it may have been wiser, since it preserves the immediate statement without shoving it to the top of everyone’s plate, and would still allow a stickied post on 196 itself if the situation escalated and it became more necessary.

    I dunno, mod shit is hard and I’m glad I get to armchair quarterback it rather than actually making these decisions in real time. Props to the full mod team for keeping the chaos of 196 from turning toxic and destructive for however long it’s been here.