rubendev

4 ms·

1.
by rubendev 28d ago
I don’t think we should just accept that the average developer doesn’t know about these very basic hardening methods. This is your chance to set yourself apart from LLM coding agents. If you want to call yourself a software “engineer” you n
2.
by rubendev 28d ago
I agree wholeheartedly. The solution is not to stop developing these so called “dangerous” AI models. The solution is to start properly engineering software.
3.
by rubendev 28d ago
I think the model was able to escape the sandbox and hack huggingface because they were incompetent or not giving enough priority to implementing basic cybersecurity principles. If they would have done so, there wouldn’t have been an escape
4.
by rubendev 28d ago
No we just need developers to do the bare minimum of effort to write secure software. Most hacks are not super complicated vulnerabilities chained together, but just utter failures where authentication and authorization was simply forgotten
5.
by rubendev 1mo ago
I think the main problem with this is that you can be paid/coerced to vote for someone and be able to easily prove that you voted for the person they wanted. It’s easier to vote for the person you actually wanted to vote for, and maint
6.
by rubendev 1mo ago
I can’t tell if the model card is written by AI or a parody of AI writing…
7.
by rubendev 3mo ago
I think at minimum you would need to understand which theorems you want to prove about your code, and how to express those in Lean. Otherwise you won’t be able to verify the output. It may have proven some statement that is machine checked
8.
by rubendev 3mo ago
This is really a self inflicted problem. If you host your backend on the same origin as your frontend (using a reverse proxy) you don’t need CORS at all and you can use the vanilla SOP, and strengthen it further with a strict CSP.
9.
by rubendev 5mo ago
What is your definition of faster to implement? Is it producing a plausible implementation, or is it faster at producing a correct and high quality implementation? Are you including time spent refactoring and fixing bugs in your metrics? If
10.
by rubendev 6mo ago
With a capable static analyzer that is not true. In many common cases they can deduce the possible ranges of values based on branching checks along the data flow path, and if that range falls within the buffer then it does not report it.
11.
by rubendev 7mo ago
If you say you need the data for security reasons that’s all well and good, but then you can only use the data for that specific purpose. So you cannot suddenly start using it for targeted advertising just because you already have the data.
12.
by rubendev 11mo ago
Please elaborate why you believe that? The ability to easily rotate encryption keys is considered an anti pattern?
13.
by rubendev 11mo ago
Also, I gave the link to the appendix because there was a specific question about Argon2 parameters. For general developer audiences, they need to look at the standard itself which is a lot more high level about how to properly implement cr
14.
by rubendev 11mo ago
Which one would you recommend instead? Referring dev teams to NIST standards or the like doesn’t work well in my experience.
15.
by rubendev 11mo ago
Yes it’s an audit checklist for when you need to know specifically what to use and with which parameters. It’s unfortunate if there are mistakes in there. The people at OWASP would be very happy to receive feedback on their GitHub I’m sure.
16.
by rubendev 11mo ago
Can you give some examples of such commonly used libraries for languages like Java / C# / C++? In my experience there are not many libraries like Google Tink around, and they are not in widespread use at all. Most applications doi
17.
by rubendev 11mo ago
Yes I fully agree. I’m a big fan of libraries like Google Tink that make you pick a use case and use the best implementation for that use case with built in crypto agility. Most crypto libraries are not built like that however. They just gi
18.
by rubendev 11mo ago
The OWASP ASVS appendix on Cryptography is one of the best and concise resources I know for this kind of thing: https://github.com/OWASP/ASVS/blob/master/5.0/en/0x92-Append...
19.
by rubendev 1y ago
If you only secure the login you will be sending your session cookies unencrypted for the other pages and they can be intercepted and used to impersonate you.
20.
by rubendev 2y ago
If the program has access to the credential, and the program is running on your computer, you also have access to the credential no matter how they try to obfuscate it. What the game dev is supposed to do is have an account system on their
21.
by rubendev 2y ago
You can set a CSP in the HTML head section using a meta http-equiv tag. It has similar functionality to X-frame-options IIRC.
22.
by rubendev 4y ago
A dark mode would be nice.