rietta

Do publishers not sign their packages before it gets to Cursor for distribution? Does Cursor itself apply and enforce any package integrity?

Yup, I give them a custom entry in ~/.ssh/config like:

``` host claudebox hostname 192.168.122.105 user developer IdentityFile ~/.ssh/id_rsa ```

``` host codexbox hostname 192.168.122.106 user developer IdentityFile ~/.ssh/id_rsa ```

I drop only my public key inside the VM. Then I set up the ~/Projects folder with the code the bot is working on any any authorized samples.

Then in my local on my host clone of the repository, I add another remote like

``` git remote add codexbox ssh://codexbox/home/developer/Projects/hello-world ```

Then git push codexbox.

Then I just SSH in or use the vm gui and interact with the agent there. I like to keep it running in byobu so I can remote in more easily when I am on the laptop out and about.

I am doing similar with Debian 13 images in QEMU. Only access is to code specifically SSH in. On some, I am taking it a step further and my SSH key is not present at all on the bot. I add it as a git remote from my host into the VM and push and pull from there and then push to GitHub myself. So the agent has no path to GitHub either.

Reading the report alone: "First, the payload makes sure ~/.ssh exists and appends an attacker-controlled Ed25519 public key to ~/.ssh/authorized_keys, setting permissions to 0700 on the directory and 0600 on the file."

A system where ~/.ssh/authorized_keys has not been modified might be a hint that this did not execute - the article does not mention self cleanup/reverting to previous status behavior by the malware. By default /var/log/auth.log is only of marginal value because outbound SSH connections are not logged by default.

I have wondered about this as well. To what extent am I influenced by the LLM output. It is a load bearing question for sure. ;-p

Clearly, but of all the ways to manage authorized keys on a fleet of endpoints was this particular methodology the only or best? Were there other ways to activate and deactivate keys without introducing the same complexity and brittleness. Clearly the ACL methodology provided a false sense of security in this instance in the presence of this bug.

It worked in 2008 - 18 years ago. I have other options now like said cloudflare tunnel.

I am fairly glad I have stuck with stock OpenSSH that ships with Linux. This incident proves I am glad with that choice.

Over the decades, I have maintained remote access through port forwarding on my router - at one point in 2008 I put SSH on port 80 so I could access it from the restricted wifi network at the hospital my grandmother was at. I have also used openvpn. I have also used cloudflare tunnels. But in the end, I always connect to hardened openssh with key only authentication.

They don’t want to be behind Google and Bing which all these businesses already let index.

Cancer is the enemy! I am so sorry to learn of Eric's passing. Sometimes you don't have as much time as you think. We all should do so well as to document everything for our spouses and loved ones. I had a friend who died from cancer and we never truly unraveled all of his accounts for his widow. Live has moved on but stuff including precious memories were lost as cloud accounts were shuttered. Also do not underestimate how many organizations will not transfer accounts to the surviving spouse.

I actually spoke up about this at a local chamber meeting today during my 30 second elevator pitch. I decided to give a brief cybersecurity awareness month pitch about having backups for your 2FA and to be wary of passkeys because you will be locked out on device changes.

I think they are a trap. A usability nightmare. So, I acquiesce to a passkey to a site while on my iPhone and now I cannot log onto it from my work desktop in Firefox. An older person sets it up on his or her Google account, gets a new phone (iPhone to Android) or Android to iPhone doesn't matter and loses access. We know that Google won't help a regular consumer with anything.

Syncing may be a thing in theory but the friction is huge.

Neat! I am behind the times. My last major Visual C++ work was version 6.0 when I was a teenager. Then went to Georgia Tech which was 100% into Unix. Then my career never converged back into C/C++ work on any platform.

It's been a long time since I have tried to do Windows work in C/C++. Is this Win32 the actual Win32 API of yesteryear or something else. I thought CMoke was a Unix tooling.

Importantly this change as well as the court ruling that lead to it are not based on a Second Amendment claim.

This was a taxing authority case.

However, as more of these items are purchased and kept, they can will become “in common use by Americans for lawful purposes,” which will enhance a second amendment element in the future.

I am not a lawyer.