That’s exactly the thing. They call themselves PoCs, but most of the time the exploit chain that they “prove” relies on some extremely unrealistic condition, like the intruder already having elevated privileges. Or it’s just completely made up and the PoC only “works” because the AI changed the source code. It’s incredibly unreliable.
I think we should have one more meeting about how to best use AI for our work. Yes, one more meeting will fix everything. I have already booked a 3-hour time slot in the meeting room with the bad ventilation. You better be there.
It is kinda funny to hear the manager say “Brotli” as if it were some cursed ancient artefact tho. I’m down to not tell the managers that this is overblown bs. Let them think that we saved the system from certain doom.
I mean I’ll update my Node version, but until someone actually finds an exploit chain on a real system (instead of a vibecoded PoC) I don’t see any reason to panic. All these "could"s and "would"s in the article suggest that it’s kind of a nothing-burger imo
Fuck that. Emailing coworkers shouldn’t be a formal thing. Just wastes everyone’s time.
I wrote my last email today and it was literally just 3 sentences.
I could have had the company-mandated AI make it “professional” and unnecessarily long but nah, I’d rather be human.
My parents are coming over today because their ZorinOS installation suddenly started acting up after an Ubuntu Kernel update. Thanks Ubuntu.
Have you ever pressed F12? We technically weren’t allowed to see the config either, but LiteLLM literally returned a users password hash as part of the user data json in the version we were using. It was easy enough to see that it wasn’t salted.
Another fun thing it does is that any user can see their entire teams token spend trough the network tab, even if they technically shouldn’t be allowed to do that. Oh and LiteLLM had a CVSS score 9.9 vulnerability recently where any user with any sort of write privilege (including the “privilege” to change any of your own data, like your password) could just change their own role to admin 🤷
The pure incompetence of that software would be really funny if it wasn’t such a pain in the ass to be the person who has to convince coworkers to rotate compromised credentials…
Even better, LiteLLM does not salt their SHA256 password hashes by default. I had to make a huge fucking fuss over that fact until my org changed the configuration last month. Bet we’re in that leak, with password hashes that are easily cracked with a dictionary.
It really isn’t hard to get out of a docker container. Especially when its config is vibecoded.
based. So glad I moved there recently.
Fuck those glasses. But also, my brain can’t let go of the question of “How would I feel if I saw a woman wearing these?”. And honestly I’m not sure??? Like you could make an argument that at least they would deter creepy men?? Anyone got any thoughts on that?
There can be different reasons for different people. I personally have zero fear of being laid off (strong worker protection laws in Germany) and finding a new job this year was surprisingly easy (50-ish applications with no cover letters -> 3 interviews -> 3 offers) and I still feel the exact dread that is described in the article. The industry sucks in multiple different ways rn.
indians:
There’s a sack of flesh some of us have that can produce computational power at the cost of a granola bar every few hours. Can’t beat the value of that.
My Github Actions configurations will bankrupt entire continents
Would be an option, firing someone after their trial period (usually 3 months) is over is an incredible pain in the ass around here lol
Oh shit, I applied to that company a few days ago. Guess I’ll be telling them to fuck right off when they call back
deleted by creator
… did you even read the article? Its not really bashing if it’s true