dboreham

Based on email I got from another big hosting provider, they're all patching for the same checksum metadata vulnerability (the CVE they mentioned is the same). There is however a root RCE PoC according to the researcher so...potentially bad.

Current models are amazing but production code incorporates unknowable information through decades of diagnosis and bug fixing (and sometimes the opposite: working around bugs in other software that it talks to). Put even the most amazing coder that was ever born onto improving a complex old codebase, and you can guarantee they are going to break stuff. AI is better but not infinitely better.

I think we can all agree that the task as set forth in the PR puff piece is impossible. That said however, current AI tools are amazing for cleaning up and reanimating old codebases. I've been using Claude on a very large Java protocol proxy product and it's been able to do amazingly useful things for me. I originally wrote much of the code but Claude now knows much more about it than I do today, because people forget stuff over decades. It will sometimes remind me "as you noted in November 2016 this feature was designed to...", based on its analysis of the code and git commit messages.

It's good, but it can't create information that is undiscoverable.

Indeed. Making a perfect clone of such software is I suspect provably impossible because you have no way to assemble all the test cases. There might be some peer box out in the wild somewhere that is the only thing that will exercise some code path. You have no idea what that box is or what it does.

Like it was written by PR people's AI.

Plus: publicity!

No but their no doubt highly paid lawyers should have sought relief from their trademark being infringed, and demanded the extension was pulled long ago.

No, you misunderstand (not surprising since 99% of the coverage on this story is wrong). What happened is: someone published an extension called "Anthropic.claude-code". That someone was not Anthropic and never was Anthropic. They just used the string "Anthropic" in the name of their extension. The comment you are responding to is saying that Cursor (the organization that manages the extension marketplace) should have prohibited someone from using a popular AI lab's name in the title of their mystery meat extension. They're probably right about that.

No. You'd need to know how Binance worked in some very deep level of detail. E.g. that there's a way to force signing of high value transactions with no rate limiting or countersignature, then how to mount an attack on that code through lax controls via a developer machine. That's not something you learn through casual scanning.

And almost certainly an inside job given the knowledge of Binance systems required.

Binance is a bank.

Yes, but as someone who worked in the cryptocurrency industry for a few years: that's not how it actually works. Smart contracts have bugs, it isn't peer to peer so someone has to run and pay for big servers, humans are sometimes criminals or Faustian bargain takers.