ievans

6 ms·

1.
by ievans 1mo ago
It's crazy to me is that the Github API for this is so nascent for something that has such a large attack surface. E.g., even if you pin your actions directly, there's still no equivalent of an action lockfile* so all the transiti
2.
by ievans 3mo ago
Last year I thought that AI-generated code would be scanned the same way as human-generated code. What I realized from working on Guardian was that being in the agent loop is an unfair advantage: you can ask the agent to switch to a secure
3.
by ievans 5mo ago
Top comment has a great explicit refutation: > This plan works by letting software supply chain companies find security issues in new releases. Many security companies have automated scanners for popular and less popular libraries, with
4.
by ievans 7mo ago
Not super surprising that Anthropic is shipping a vulnerability detection feature -- OpenAI announced Aardvark back in October ( https://openai.com/index/introducing-aardvark/ ) and Google announced BigSleep in Nov
5.
by ievans 8mo ago
"Staged publishing: A new publication model that gives maintainers a review period before packages go live, with MFA-verified approval from package owners. This empowers teams to catch unintended changes before they reach downstream us
6.
Poisoning Attacks on LLMs Require a Near-Constant Number of Poison Samples(arxiv.org)
2 points by ievans 11mo ago|0 comments
7.
Dayssincelastsupplychainattack.com(dayssincelastsupplychainattack.com)
2 points by ievans 1y ago|0 comments
8.
Dayssincelastsupplychainattack.com(dayssincelastsupplychainattack.com)
3 points by ievans 1y ago|1 comments
9.
by ievans 1y ago
This is explicitly not the conclusion Pascal drew with the wager, as described in the next section of the Wikipedia article: "Pascal's intent was not to provide an argument to convince atheists to believe, but (a) to show the fall
10.
Chromium Security: The Rule of 2(chromium.googlesource.com)
2 points by ievans 1y ago|0 comments
11.
by ievans 2y ago
Do you store your SSDs powered? They can lose information if they're not semi-frequently powered on.
12.
by ievans 2y ago
For C, you might be interested in https://github.com/weggli-rs/weggli or https://github.com/semgrep/semgrep (I work on the latter). Both are also tree-sitter based.
13.
by ievans 2y ago
Looks like the `ets` readme has a direct comparison: > The purpose of ets is similar to that of moreutils ts(1), but ets differentiates itself from similar offerings by running commands directly within ptys, hence solving thorny issues l
14.
by ievans 2y ago
I wrote up a Semgrep rule as a comparison to add! (also tree-sitter based, `pip install Semgrep`, https://github.com/semgrep/semgrep , or play with live editor link: https://semgrep.dev/playground/
15.
by ievans 2y ago
So the argument is because the vulnerability lifetime is exponentially distributed, focusing on secure defaults like memory safety in new code is disproportionately valuable, both theoretically and now evidentially seen over six years on
16.
98% of PyMySQL forks are vulnerable to SQL Injection(cramhacks.com)
1 points by ievans 2y ago|0 comments
17.
Semgrep: Semantic Grep for Code(github.com)
2 points by ievans 2y ago|0 comments
18.
by ievans 2y ago
Absolutely agreed, and copying from a comment I wrote last year: I think the fact that tree-sitter is dependency-free is worth highlighting. For context, some of my teammates maintain the OCaml tree-sitter bindings and often contribute to g
19.
Semgrep Secrets(semgrep.dev)
3 points by ievans 3y ago|0 comments
20.
The Evolution of Open Source Business Models(tomtunguz.com)
3 points by ievans 3y ago|0 comments
21.
White House RFI on Open-Source Software Security and Memory Safe Languages(whitehouse.gov)
17 points by ievans 3y ago|2 comments
22.
Guardrails for PromQL Using Semgrep(semgrep.dev)
14 points by ievans 3y ago|0 comments
23.
by ievans 3y ago
I'm surprised there are so many negative comments on this release, which I suppose is timed for discussion at Blackhat/Defcon. The report's identifies its audience as four groups of stakeholders: (1) federal civilian executiv
24.
New Fellowship: How Sequoia Is Supporting Open Source(sequoiacap.com)
4 points by ievans 3y ago|0 comments
25.
Crosscompiling OCaml to JavaScript and WASM to Make Semgrep Playground Fast(semgrep.dev)
5 points by ievans 3y ago|0 comments
26.
Critical vulnerability in Node vm2 Error.prepareStackTrace (CVE-2023-29017)(nvd.nist.gov)
2 points by ievans 3y ago|0 comments
27.
by ievans 4y ago
I was relying on backup codes until I recently learned (via a PSA on HN) that you should actually backup the TOTP QR codes and not rely on the 2fa backup codes because they may not provide the same level of access. Specifically, the HN post
28.
Semgrep Code: SAST designed and built for engineers(semgrep.dev)
2 points by ievans 4y ago|0 comments
29.
Need for speed: static analysis version(semgrep.dev)
2 points by ievans 4y ago|0 comments
30.
Trojanized Windows 10 Operating System Installers Targeted Ukrainian Government(mandiant.com)
3 points by ievans 4y ago|1 comments

More ›