reassess_blind

I run a few small scale SaaS products. This is a scary time.

How is it possible that Binance doesn't have a system that disallows massive simultaneous withdrawals without some kind of two-key manual override or something?

StackOverflow helped build the LLMs that replaced it.

Reminds me of a bug I found in a very popular browser testing service that spun up iOS vm's/devices for on-device testing.

I copied the clipboard from the device, and my clipboard was full of another users credentials that they were obviously trying to paste into their own VM. Their devices were leaking clipboard data to each other.

I reported the vulnerability and asked if there was any bounty program (I wasn't looking for vulnerabilities but didn't hurt to ask), to which they said no, but they could send me a signed letter thanking me of my contributions. I said, great, thanks - and never heard back.

All pretty disappointing.

I thought this was about Cloudflare Warp.

Yeah, for now. I sense sentiment shifting against these frameworks lately, it might be reflected in their training in a few models time. Or, it’s possible I’m completely off the mark.

I feel like these large frameworks will slowly die out with the advent of agents.

The big selling point of them was a fast, convenient dev experience with many features (most often unused) being built-in.

Now, those built-in features are becoming a security risk as more vulnerabilities are being found in their 1000s of lines of code, and the developer experience benefit is being nullified by agents whittling away the human involvement anyway.

Domains aren’t

That wasn't me, that was Churchill.

Show me a perfectly secure complex system, and with enough time, I'll show you a vulnerability.

I really doubt that. If these models continue to improve, they will be producing higher quality code than, maybe not the best human developers, but certainly the average human developer who would have typically been writing code on these systems.

Pre-2024 code is full of human-written vulnerabilities.

None of this matters if you zoom out.

Very true with the food analogy. I’m not eating whatever this persons concoction is, but I’ll make it myself at 3am and chew it gloomily.

Democracy is the worst form of government, except for all the others.

Because AI-assisted hacking is not something we should allow to run rampant with the most advanced models, prior to AI-assited cybersecurity catching up.