staticassertion

7 ms·

181.
by staticassertion 6mo ago
> risks to national security Microsoft is the go to solution for every government agency, FEDRAMP / CMMC environments, etc. > People come in all the time crying that everything is broken and needs to be scrapped and rewritten b
182.
by staticassertion 6mo ago
Right, so it's "password manager is compromised" or "password is reused", right? I'm pretty skeptical of these mattering relative to phishing, which is radically more common.
183.
by staticassertion 6mo ago
> My password manager, as is standard for most of them, will not fill or show a password if the URL bring visited doesn't match the credential. Thus, a credential not showing is a huge red flag. The workflow is pretty standardized s
184.
by staticassertion 6mo ago
I'm confused. All an attacker has to do is phish you to get your password and TOTP. TOTP would cover cases like a compromised password manager or a reused password. That's it, right?
185.
by staticassertion 6mo ago
It's not much better than nothing. It basically solves "I reused my password across sites" exclusively, that's it. If you're going to go through the effort of TOTP, it seems odd that you wouldn't just use a uni
186.
by staticassertion 6mo ago
I'm assuming the author must have been grandfathered in to TOTP?
187.
by staticassertion 6mo ago
I really don't see how any clone is going to manage to do what localstack couldn't - maintain compatibility with tons of AWS services while not getting paid for it. If this were viable, why would it not have worked before? The onl
188.
by staticassertion 6mo ago
Sorry, I should have clarified that - you're correct. `cosign` is an example of a tool that makes this quite straightforward and proves that this sort of system can work today.
189.
by staticassertion 6mo ago
TOTP seems effectively useless for npm so that seems fine to me
190.
by staticassertion 6mo ago
The people building package managers are unaware of these problems going into it and it becomes extremely disruptive to start adding these things later on since your entire ecosystem is built on the assumption that they can do these things.
191.
by staticassertion 6mo ago
You don't want "project had X users so it's less safe" to suddenly transition into "now this software has X*10 users so it has to change things", it's disruptive.
192.
by staticassertion 6mo ago
There are many options. Here's a post just briefly listing a few of the ones that would be handled by package managers and registries, but there are also many things that would be best done in CI pipelines as well. https://n
193.
by staticassertion 6mo ago
Your account is separate from your publishing. That is, in order to go to my account to change configuration values, 2FA must be required. Publishing should be handled via something like Trusted Publishing, which would leverage short lived
194.
by staticassertion 6mo ago
Attackers going "low and slow" when they know they're being monitored is just standard practice. > Why do you believe that motivated threat hunters won’t continue to analyze and find threats in new versions of open source
195.
by staticassertion 6mo ago
No one was convinced to spend money to do the things you're saying. That's just disingenuous. People rent models because (a) it moves compute elsewhere (b) they provide higher quality models.
196.
by staticassertion 6mo ago
Yeah, NPM should be enforcing 2FA and likely phishing resistant 2FA for some packages/ this should be a real control, issuing public audit events for email address changes, and publish events should include information how it was publi
197.
by staticassertion 6mo ago
They're not a failed experiment. No one has ever "experimented" by making a safe package manager for their new language. And it is not that insane to do so. Very basic things will get you very far: 1. Packages should carry
198.
by staticassertion 6mo ago
> What do you base that on? The entire history of malware lol
199.
by staticassertion 6mo ago
That's true, but certainly that's limiting. Still, even then, `# SAFETY:` comments seem extremely helpful. "For every `unsafe`, determine its implied or stated safety contract, then build a suite of adversarial tests to verif
200.
by staticassertion 6mo ago
I suspect we'll see combinations of symbolic execution + fuzzing as contextual inputs to LLMs, with LLMs delegating highly directed tasks to these external tools that are radically faster at exploring a space with the LLM guiding based
201.
by staticassertion 6mo ago
I think the other side of that is that mismatches between intention and implementation are exactly where you're going to find vulnerabilities. The LLM that looks at closed source code has to guess the intention to a greater degree.
202.
by staticassertion 6mo ago
> Everything is up in the air. The industry is sold on memory-safe software, but the shift is slow going. We’ve bought time with sandboxing and attack surface restriction. How well will these countermeasures hold up? A 4 layer system of
203.
by staticassertion 6mo ago
> so long as it conforms to a style guide and is maintainable. Most people consider aesthetic values to align with these things.
204.
by staticassertion 6mo ago
Are you replying to the right person?
205.
by staticassertion 6mo ago
Yes, but then you said that you do what I'm suggesting is still critical to do, which is maintain the codebase even if you heavily leverage models. " we do indeed take care to ensure we’re building these things the right way.&quot
206.
by staticassertion 6mo ago
> https://degoes.net/articles/insufficiently-polymorphic lol this is not why people do "df1", "df2", etc, nor are those polymorphic names but okay. > it's coming... some places move slo
207.
by staticassertion 6mo ago
So you understand and you agree and confirm my experience?
208.
by staticassertion 6mo ago
I wonder if your background just has you fooled. I worked on a data science team and code was always a commodity. Most data scientists know how to code in a fairly trivial way, just enough to get their models built and served. Even data eng
209.
by staticassertion 6mo ago
Yes, I'm asking why they'd lock themselves into a contract around 5 9s of uptime since the parent poster mentioned that they won't do so. Of course, AWS actually does do this in some cases and they guarantee 99.99% for most t
210.
by staticassertion 6mo ago
Well, (a) why would they? (b) "uptime" has shifted from a binary "site up/down" to "degraded performance", which itself indicates improvements to uptime since we're both pickier and more precise.

More ›