Social engineering is probably 95% of modern attack vectors. And that's not even unexpected, some highly regarded computer scientists and security researchers concluded this more than a decade ago.
I wonder if this was made by AI or a shit programmer
a year ago by Lena to c/programmer_humor
hoshikarakitaridia 118 points a year ago
spankmonkey 69 points a year ago
When the technical side reaches a certain level of security, the humans become the weakest link.
SpaceNoodle 10 points a year ago
*if
spankmonkey 11 points a year ago
We reached that part a long time ago.
qqq 16 points a year ago
I work in security and I kinda doubt this. There are plenty of issues just like what is outlined here that would be much easier to exploit than social engineering. Social engineering costs a lot more than GET /secrets.json.
There is good reason to be concerned about both, but 95% sounds way off and makes it sound like companies should allocate significantly more time to defend against social engineering, when they should first try to ensure social engineering is the easiest way to exploit their system. I can tell you from about a decade of experience that it typically isn't.
kautau 25 points a year ago
https://www.infosecinstitute.com/...
You're right. It's 74%.
https://www.cybersecuritydive.com/...
It's way easier to convince someone that you are just a lost user who needs access than it is to try to probe an organization's IT security from the outside.
This is only going to get worse with the ability to replicate other's voices and images. People already consistently fall for text message and email social engineering. Now someone just needs to build a model off a CSO doing interviews for a few hours and then call their phone explaining there has been a breach. Sure, 80% of good tech professionals won't fall for it, but the other 20% that just got hired out of their league and are fearing for their jobs will immediately do what they are told, especially if the breach is elaborate enough to convince them it's an internal security thing.
qqq 3 points a year ago
Yes social engineering can be incredibly effective. I completely agree, but there is a bit of an obsession with it these days and imo it's over indexed, because at the end of the day the type of social engineering detailed in that report typically just provides access.
In some cases, the target is important enough and has enough organizational power that accessing the network as them is sufficient, but that's not often the case. What that means is that in those other cases social engineering (which in that report you cited is often just phishing) is providing, typically, internal network access. An attacker will have to move through the network and exploit software typically to continue their attack. There are many points in this chain that the weakness lies in software or configuration. If effort was placed on making those systems better it would likely see better results than hyper focusing on the social engineering, which is significantly more difficult to stop, especially with all of the things you mentioned on the horizon.
My point is then that even if it is a part of 74% of breaches, according to Verizon, it's not necessarily sufficient and is often paired with software level exploits.
And I know this because my company does plenty of red teaming, and we use social engineering but at the end of the day the more interesting result comes from a software exploit or just abusing a weak configuration.
PoisonedPrisonPanda 3 points a year ago
we built this shit. thus we are always to blame.
givesomefucks 4 points a year ago
modern attack vectors.
more than a decade ago.
It's used to be the majority of modern attack vectors...
It still is, but it used to be too.
Alexstarfire 3 points a year ago
Thank you, Mitch.
Monument 41 points a year ago
Many years ago, I discovered that my then-employer’s “home built” e-commerce system had all user and admin passwords displayed in plaintext at home/admin/passwords.
When I brought this to the attention of leadership, they called the “developer” in and he said “oh, well, that’s IP locked, so no one on the web can access it!” When I pulled it up on my phone, he insisted my phone was on the work WiFi, despite it being clearly verifiable that was not the case. (The same work WiFi that had an open public connection, which is the one my phone would have been on, if it were on it…)
He did fix that, but many other issues remained. Eventually a new COO hired someone competent as his ‘backup’, replaced our website and finally suggested he pursue other employment opportunities before he could no longer voluntarily pursue them. (There was concern he might sabotage.)
4am 28 points a year ago
I think that’s less about “hacking” and more about modern day devs being overworked by their hot-shit team lead and clueless PMs and creating “temporary” solutions that become permanent in the long run.
This bucket was probably something they set up early in the dev cycle so they could iterate components without needing to implement an auth system first and then got rushed into releasing before it could be fixed. That’s almost always how this stuff happens; whether it’s a core element or a rushed DR test.
drkt 19 points a year ago
modern day devs being overworked
And then there is meningspunktet.dk which had all the time in the world to do whatever they wanted, and even get their hosting paid for by a university. They still leaked everyones email, phone, full legal name and location on day one and only fixed it because I pointed it out.
TheOakTree 5 points a year ago
Thanks for the writeup - I can't believe they claimed anything about keeping data safe while building the website so poorly...
MonkderVierte 23 points a year ago
Shodan lists 100'000s of publicly accessible security cameras.
ChickenLadyLovesLife 14 points a year ago
If I was a hacker, I would just get a job as a night cleaning person at corporate office buildings. And then just help myself to the fucking post-it notes with usernames and passwords on them.
burgerpocalyse 5 points a year ago path: 0 18450540 18458268 18459079, hotness: undefined, score: 5, children: 0
Vanilla_PuddinFudge 1 point a year ago
this man ssh'd in on a five-digit port
taiyang 96 points a year ago
This reminds me of how I showed a friend and her company how to get databases from BLS and it's basically all just text files with urls. "What API did you call? How did you scrape the data?"
Nah man, it's just... there. As government data should be. They called it a hack.
lord_ryvan 3 points a year ago
When getting data legitimately is beyond them…
ignotum 86 points a year ago
I remember when a senior developer where i worked was tired of connecting to the servers to check its configuration, so they added a public facing rest endpoint that just dumped the entire active config, including credentials and secrets
That was a smaller slip-up than exposing a database like that (he just forgot that the config contained secrets) but still funny that it happened
PattyMcB 47 points a year ago
That's not a "senior developer." That's a developer that has just been around for too long.
Secrets shouldn't be in configurations, and developers shouldn't be mucking around in production, nor with production data.
palordrolap 16 points a year ago
I would have put IP address access restrictions on that at the very least. I may have even done something like that more than once for various tools in the past.
That way it acts completely open to people (or other servers) in the right places and denies all knowledge to anything else.
funkless_eck 19 points a year ago
while True:
Jesus Christ
FooBarrington 25 points a year ago
You know that's not the Tea code, but the downloader, right?
fmstrat 20 points a year ago
Other reports state the Tea backend was Vibe Coded: https://www.ainvest.com/...
FooBarrington 22 points a year ago
Sure, it might be, I'm not saying it isn't. All I'm saying is: the screenshot shows the code someone wrote to download the images. It's not part of the Tea codebase.
The_Decryptor 2 points a year ago
They're also not using requests very efficiently, so who knows.
funkless_eck 8 points a year ago
There's nothing wrong with eating a banana with a knife and fork, either.
Except living with the shame.
Bane_Killgrind 3 points a year ago
Well these people probably don't wash their hands so knife fork is the most sanitary way.
lessthanluigi 1 point a year ago
Most monkey-esque insult
grrgyle 4 points a year ago
An infinite loop used to be such a rank code smell back when I was a junior, specifically because I was a noob and made giant loops like 50 lines long and invariably didn't plan the exit condition right, and then my computer would lock up and I would have to hard power cycle.
But yeah, now it's it's a totally acceptable little pattern imho.
Strawberry 2 points a year ago
eh
EmilyIsTrans 44 points a year ago
I absolutely despise Firebase Firestore (the database technology that was "hacked"). It's like a clarion call for amateur developers, especially low rate/skill contractors who clearly picked it not as part of a considered tech stack, but merely as the simplest and most lax hammer out there. Clearly even DynamoDB with an API gateway is too scary for some professionals. It almost always interfaces directly with clients/the internet without sufficient security rules preventing access to private information (or entire database deletion), and no real forethought as to ongoing maintenance and technical debt.
A Firestore database facing the client directly on any serious project is a code smell in my opinion.
tiramichu 25 points a year ago
It's like people learn how to make a phone app in React Native or whatever, but then come to the shocking and unpleasant realisation that a data-driven service isn't just a shiny user interface - it needs a backend too.
But they don't know anything about backend, and don't want to, because as far as they are concerned all those pesky considerations like data architecture, availability, security, integrity etc are all just unwanted roadblocks on the path to launching their shiny app.
And so, when a service seemingly provides a way to build an app without needing to care about any of those things, of course they take it.
And I get it, I really do. The backend usually is the genuine hard part in any project, because it's the part with all the risk. The part with all the problems. The place where everything can come crashing down or leak all your data if you make bad decisions. That's the bothersome nature of data-driven services.
But that's exactly why the backend is important, and especially the part you can't build anything decent without thinking about.
sylver_dragon 19 points a year ago
I think it's less about the tech picked and more about developers with no sense of security and a poor understanding of networking. I've seen far too many web applications where the developer needed some sort of database behind it (MySQL, PostGres, MSSQL) and so they stood up either a container or entire VM with a public IP and whatever the networking layer set to allow any IP to hit the database port. The excuse is almost always something like, "we needed the web front end to be able to reach the database, so we gave the database server/container a public IP and allowed access". Which is wonderful, right up until half of the IP addresses in Russia start trying to brute force the database.
EmilyIsTrans 13 points a year ago
I agree that this is ultimately a problem with developers lacking security knowledge and general understanding, but my issue with Firestore specifically is that it is a powerful tool that, while it can be adopted as part of a carefully considered tech stack, lends itself most naturally towards being a blunt force instrument used by these kinds of developers.
My main criticism of Firestore is that it offers a powerful feature set that is both extremely attractive to amateur or constrained developers while simultaneously doing a poor job of guiding said amateurs towards creating a secure and well designed backend. In particular, the seemingly expected use case of the technology as something directly interfaced with by apps and other clients, as evidenced by the substantial support and feature set for this use case, is the main issue. This no-code no-management client driven interaction model makes it especially attractive to these developers.
This lack of indirection through an API Gateway or service, however, imposes additional design considerations largely delegated to the security rules which can easily be missed by a beginner. For example:
- Many examples of amateurs take an open-by-default approach, only applying access and write restrictions where necessary and miss data that should be restricted
- Some amateurs deploy databases with no access or write restrictions at all
- There is no way to only allow a "view" of a document to a request, instead a separate document and security rules containing the private fields needs to be created. This can be fairly simple to design around but seems to be a bit of a "gotcha", plus if you have similar but non identical sets of data that needs to be accessible by different groups it must be duplicated and manually synchronized.
- Since there is no way to version data models, incompatible changes require complicated workarounds or an increasingly complicated deserialization process on the client side (especially as existing clients continue to write outdated models).
- Schema validation of data written by clients to the database is handled by security rules, which is seemingly unintuitive or missed by many developers because I've seen plenty of projects miss it
- If clients are writing data directly, it can become fairly complex to handle and subsequently maintain their contributions, especially if the aforementioned private data documents are required or the data model changes.
All of these pitfalls can be worked around (although I would still argue for some layer of indirection at least for writes), but at this point I've been contracted to 2 or 3 projects worked on by "professionals" (derogatory) that failed to account for any of these issues and I absolutely sick to death of it. I think a measure of a tools quality is whether it guides a developer towards good practices by design and I have found Firestore to completely fail in that regard. I think it can be used well, and it is perfectly appropriate for small inconsequential (as in data leaks would be inconsequential) single developer projects, but it almost never is.
moonpiedumplings 1 point a year ago
This is a very good writeup.
Do you think supabase or other similar solutions also have these pitfalls?
meme_historian 10 points a year ago
Ah yes, Firebase. The Google version of leaking all your company data through a public S3 bucket
I remember when they launched and started pushing it in the Android dev community. Actually won a Google Pixel at a Firebase sponsored hackathon in my town...after that I never touched Firestore again. Using that ACL language to restrict access, you could see the massive foot gun from a mile away
grendel84 5 points a year ago
path: 0 18460264 18463297, hotness: undefined, score: 5, children: 0
sounds like firebase itself is a hack.
I'm honestly embarrassed by my fellow devs more often than not these days.
What the fuck happened to craftsmanship? Or taking pride in your work?
oh right, techbro startup culture garbage ended it.
JackbyDev 33 points a year ago
Hack has at least two definitions in a computing context.
- A nifty trick or shortcut that is useful. "Check out this hack to increase your productivity."
- Accessing something you shouldn't. "They hacked into the database."
A lot of times they sort of get used in conjunction to describe interesting ways to gain access to secure systems, but using it to describe accessing insecure things you shouldn't is still a valid usage of the phrase.
That said I definitely wanna see the company face charges for this, this is insane.
SpaceCowboy 16 points a year ago
Yeah, if I leave my house door wide open for a few weeks and I get robbed, it's still burglary.
grendel84 10 points a year ago
path: 0 18468233 18470006 18470660, hotness: undefined, score: 10, children: 8
In a legal context there's also the concept of a "reasonable expectation of privacy". The computer abuse and fraud act defines hacking as accessing data or systems you are not authorized to access.
A better analogy is putting your journal in a public library and getting mad when somone reads it.
I'm not saying what these ass holes did was right, I'm saying that the company weakened their legal position by not protecting the data.
SpaceCowboy 7 points a year ago
Terrible analogy. You have permission to read books in a library.
Forgetting to lock your door isn't granting permission to people enter your house, and it doesn't grant people permission to take your valuables. It may be neglectful to leave your door unlocked, but it doesn't imply granting permission to enter your house.
Same goes with computer security. Leaving your computer insecure may be neglectful, but it does not imply someone has permission to take your data.
grendel84 1 point a year ago
path: 0 18468233 18470006 18470660 18472200 18474225, hotness: undefined, score: 1, children: 2
Then how do I know what I am not allowed to access?
In this specific case there was no (formal) indication that the data was out of bounds.
I can't put 10 pdf files in a web dir and claim 5 are public and 5 are private, then charge you with a crime for viewing them.
You can't have "unauthorized access" when there's no authorization at all
iii 4 points a year ago
A better analogy is putting your journal in a public library and getting mad when someone reads it.
Good analogy indeed. I'd go one step further and add: it's like promising others you'll keep their diary safe, then putting it in a public library, to then get mad when someone reads it.
grendel84 6 points a year ago
path: 0 18468233 18470006 18470660 18470864 18471672, hotness: undefined, score: 6, children: 2
Yeah the internet by design is a public space, and we must be responsible and treat it as such when handling sensative data.
Again, it was very wrong for people to take that data and especially to post like that.
The company also has to do their part and produce at least some kind of barrier to the data.
Even using UUIDs and making sure the data wasn't query-able would have been something.
Rivalarrival 9 points a year ago
Terrible analogy. A webserver is not at all like a door. It doesn't block or allow traffic to and from your file system.
A web server is more like a receptionist. It handles requests. "Can I have your basic catalog?" "Certainly, here you go."
"Can I get this item from your basic catalog?" "Certainly."
"I don't see it in your catalog, but my buddy said he got this other item from you. Can I have this other item too?" "Absolutely."
"Can I borrow your stapler?" Sure. "How about a pad of paper?" "Of Course". "Can I just have the contents of your supply closet?" "Here you go." "How about your accounting files, can I get those?" "No problem!" "How about your entire customer list?" "Consider it done!"
When you hire a receptionist and specifically tell them to give customers anything they request, that's entirely on you. You have to at least make a token effort to restrict access to only authorized users before you can even claim that a particular user was unauthorized.
This wasn't burglary. This was putting up signs that say "come in" and labeling everything in your house with "free" stickers.
JackbyDev 6 points a year ago
Thank you! I feel like I'm taking crazy pills reading people's reactions to this. And if it was a business instead of your house and it was customer data you weren't protecting you should still be in trouble too. It's like people think only one side can be in the wrong in this or that because the data wasn't secured and in the public that gives them free reign to post it everywhere. I wonder how those people would feel if their addresses were leaked. Afterall, if you're a homeowner your name is attached to the property and is publicly accessible.
spicehoarder 13 points a year ago
No, this was a data leak. The word "hack" has legal implications and shifts the blame away from the company and onto the individual who discovered the leak.
JackbyDev 5 points a year ago
It can be both. The company can be at fault for not keeping something secure while the people who steal the data are at fault for stealing data. Data leaks and hacks are not mutually exclusive.
percent 1 point a year ago
I don't disagree with your main point, but I'm not sure it's really even "stealing", as that means to take without permission. In this case, the storage permissions were configured so that the files were publicly available to everyone, so everyone had permission to access them.
Semantics though. It's still unethical to access that data, even if it's not technically stealing.
spicehoarder 0 points a year ago path: 0 18468233 18469076 18469333 18471754, hotness: undefined, score: 0, children: 0
Pastime0293 1 point a year ago
😂
somerandomperson 18 points a year ago
🤦♂️
Landless2029 17 points a year ago
That should be criminally negligent.
Phoenix3875 6 points a year ago
Possibly from the decompiled APK. 404media reported that they found the same URL as the posted one in the APK (archive link).
Diplomjodler3 25 points a year ago
I always get irrationally angry when i see python code using os.path instead of pathlib. What is this, the nineties?
UndercoverUlrikHD 4 points a year ago
What big advantages does pathlib provide? os.path works just fine
Diplomjodler3 9 points a year ago
- Everything is in one library which offers consistency for all operations.
- You can use forward slashes on Windows paths, which makes for much better readability.
- You can access all the parts of a pathlib object with attributes like .stem, .suffix or .parent.
- You can easily find the differences between paths with .relative_to()
- You can easily build up complex paths with the / operator (no string additions).
Just off the top of my head.
brucethemoose 2 points a year ago
I suppose os.path is simpler? It's a string and operation.
Python is all about 'attention efficiency,' which there's something to be said for. People taking the path of least resistance (instead of eating time learning the more complex/OOP pathlib) to bang out their script where they just need to move a file or something makes sense. I'm with you here, but it makes sense.
...Also, os.path has much better Google SEO, heh.
Diplomjodler3 3 points a year ago
It's in the standard library, just like os or shutil.
Diplomjodler3 1 point a year ago path: 0 18466446 18472965, hotness: undefined, score: 1, children: 0
ConstantPain 19 points a year ago
Disabling index and making the names UUID would make the directory inviolable even if the address was publicly available.
wizardbeard 12 points a year ago
Sounds like a good case for brute forcing the filenames. Just do the proper thing and don't leave your cloud storage publicly accessible.
FooBarrington 20 points a year ago
While proper security is better, you're not gonna brute force UUIDs.
01189998819991197253 -4 points a year ago
As long as you're not rate limited, you absolutely could.
FooBarrington 13 points a year ago
A UUID v4 has 122 bits of randomness. Do you know how long that would take to brute-force, especially with network limitations?
ConstantPain 3 points a year ago
You cannot!
ConstantPain 4 points a year ago
Can't be done.
ConstantPain 12 points a year ago
It's not security through obscurity in this case. The filenames can't be obtained or guessed through brute force. At least not with current technology or processing power...
Security through obscurity is when you hide implementation details.
Saying that my suggestion is security through obscurity is the same as telling that ASLR is security through obscurity...
Scrappy 1 point a year ago
Until the psuedo random UUID generator can be reverse engineered. Makes me think of this video: https://youtu.be/o5IySpAkThg
Anyway, I think we're on the same wavelength and both agree that the implementation as is isn't production-ready to say the least ;)
Valmond 1 point a year ago
Bet you could reuse/keep UUIDs for someone/stuff that gets updated and get that new data even if you "shouldn't".
It could work in theory but in practice there are always a billion things that go wrong IMO.
bamboo 1 point a year ago
Not really sure what you mean by reusing UUIDs but theres nothing bad about using UUIDs in URLs for content you don't want scrapped by bots. Sites like Google Photos are already are using UUIDs in the URL for the photos, and do not require any authentication to see the image as long as you have the URL. You can try this for yourself and copy the URL of an image and open it in a Private Browsing Window. Every so often someone realizes the actual image URL is public and think they've found a serious issue, but the reason why it isn't is because of the massive key space UUID provides and that it would be infeasible to check every possible URL, even if it's publicly available.
Valmond 2 points a year ago
You point out the "vulnerability" yourself, sometimes (when it's Google) it works as designed, but a less robust site could have the full access through a UUID for example and then someone shares an image with it, bam they have access to more than they should. The history is littered with bulletproof things like this ending up being used wrongly.
Rhaedas 15 points a year ago
Even the best models fine tuned for coding still have training that was based on both good and bad examples of programming from humans. And since it's not AGI but using probability to generate the code, you're going to get crap programming logic dependent on how often such things were used and suggested by humans to other humans. Googling for an answer on how to code something pulls up all sorts of answers from many sources, but reading through them, many are terrible. An LLM doesn't know that, it just knows that humans liked some answers better than others, so GIGO.
NoneOfUrBusiness 9 points a year ago
Gorilla In Gorilla Out?
rayquetzalcoatl 6 points a year ago
Fantastic for building BaaS apps
rayquetzalcoatl 9 points a year ago
Bananas as a Service :)
lemjukes 3 points a year ago
path: 0 18451956 18451962 18452228, hotness: undefined, score: 3, children: 0
percent 8 points a year ago
I'm no lawyer, but this seems like at least grounds for a class action lawsuit, I would think. Like, it seems like privacy and security is implied (however ironic for an app like this) when requiring users to upload their PII.
Also, I assume their privacy policy didn't mention that they were just gonna publish their users' PII.
finitebanjo 14 points a year ago
An app called Tea™ was marketed as a safespace for women and used government issued IDs as a way to verify users.
4Chan users leaked all of the IDs onto the larger internet.
RampantParanoia2365 4 points a year ago
So it essentially became a honey trap, either through malice or sheer incompetence.
finitebanjo 2 points a year ago
Well, I get what you mean, but a "honey trap" idiom in English, also called a "honeypot scheme", usually refers to utilizing romantic connections to influence people to make decisions or release confidential information.
ICastFist 2 points a year ago
Honeypot is a common term in computing/cybersecurity, setting up fake important servers so bad actors invade and the security team can analyze what got in and how to deal with it.
angstylittlecatboy 12 points a year ago
At this point I think the women using it got psyopped
NigelFrobisher 8 points a year ago
You could say they “spilled the tea”.
cupcakezealot 8 points a year ago
who'd have thought that javascript and client side programming was incredibly susceptible to security flaws and deeply unsafe
cupcakezealot 5 points a year ago
aw bobby
cupcakezealot -4 points a year ago
but it didn't help; it was basically the gasoline
01189998819991197253 5 points a year ago
Wow. It actually identified something?
LovableSidekick 8 points a year ago
Securing the db is more of an ops thing.
givesomefucks 7 points a year ago
This is like asking:
Is this shape a square or a rectangle?
Diurnambule 6 points a year ago
I wonder if their data is poisoned by below average Dev. I mean if your test subjects are met or below Dev and mad Ethel lost 20% efficiency imagine what you can do to good dev
Thorry84 17 points a year ago
Not below average dev necessarily, but when posting code examples on the internet people often try to get a point across. Like how do I solve X? Here is code that solves X perfectly, the rest of the code is total crap, ignore that and focus on the X part. Because it's just an example, it doesn't really matter. But when it's used to train an LLM it's all just code. It doesn't know which parts are important and which aren't.
And this becomes worse when small little bits of code are included in things like tutorials. That means it's copy pasted all over the place, on forums, social media, stackoverflow etc. So it's weighted way more heavily. And the part where the tutorial said: "Warning, this code is really bad and insecure, it's just an example to show this one thing" gets lost in the shuffle.
Same thing when an often used pattern when using a framework gets replaced by new code where the framework does a little bit more so the same pattern isn't needed anymore. The LLM will just continue with the old pattern, even though there's often a good reason it got replaced (for example security issues). And if the new and old version aren't compatible with each other, you are in for a world of hurt trying to use an LLM.
And now with AI slop flooding all of these places where they used to get their data, it just becomes worse and worse.
These are just some of the issues why using an LLM for coding is probably a really bad idea.
Diurnambule 3 points a year ago
Didn't expect this much. I don't think about tuto example being weighted heavier. This make sense.
floofloof 3 points a year ago
Yeah, once you get the LLM's response you still have to go to the documentation to check whether it's telling the truth and the APIs it recommends are current. You're no better off than if you did an internet search and tried to figure out who's giving good advice, or just fumbled your own way through the docs in the first place.
kayohtie 4 points a year ago
whether it's telling the truth
"whether the output is correct or a mishmash"
"Truth" implies understanding that these don't have, and because of the underlying method the models use to generate plausible-looking responses based on training data, there is no "truth" or "lying" because they don't actually "know" any of it.
I know this comes off probably as super pedantic, and it definitely is at least a little pedantic, but the anthropomorphism shown towards these things is half the reason they're trusted.
That and how much ChatGPT flatters people.
floofloof 2 points a year ago
Yeah, it has no notion of being truthful. But we do, so I was bringing in a human perspective there. We know what it says may be true or false, and it's natural for us to call the former "telling the truth", but as you say we need to be careful not to impute to the LLM any intention to tell the truth, any awareness of telling the truth, or any intention or awareness at all. All it's doing is math that spits out words according to patterns in the training material.
chicken 2 points a year ago
You’re no better off than if you did an internet search and tried to figure out who’s giving good advice, or just fumbled your own way through the docs in the first place.
These have their own problems ime. Often the documentation (if it exists) won't tell you how to do something, or it's really buried, or inaccurate. Sometimes the person posting StackOverflow answers didn't actually try running their code, and it doesn't run without errors. There are a lot of situations where a LLM will somehow give you better answers than these options. It's inconsistent, and the reverse is true also, but the most efficient way to do it is to use all of these options situationally and as backups to each other.
floofloof 2 points a year ago
Yes, it can be useful in leading you to look in the right place for more information, or orienting you with the basics when you're working with a technology that's new to you. But I think it wastes my time as often as not.
2910000 7 points a year ago
The original article is paywalled (I mean, registration-walled?), this summary is not
404 Media reported that 4chan users claimed to be sharing personal data and selfies from Tea after discovering an exposed database.
RaivoKulli 1 point a year ago
This is hilarious
qqq -9 points a year ago
Not a big fan of the wording here. Plenty of skilled programmers make dumb mistakes. There should always be systems in place to ensure these dumb mistakes don't make it to production. Especially when related to sensitive information. Where was the threat model and the system in place to enforce it? The idea that these problems are caused by "shit programmers" misses the real issue: there was either no system or an insufficient system to test features and define security requirements.
rozodru 13 points a year ago
I can tell you exactly what happened. "Hey Claude, I need to configure and setup a DB with Firebase to store images from our application." and then promptly hit shift+tab and then went to go browse Reddit.
nothing was tested. nothing was verified. They let the AI do its thing they checked in on it after an hour or so. once it was done it was add all, commit -m "done", push origin master. AI doesn't implement security stuff. there was zero security here.
deadbeef79000 3 points a year ago
You've probably already made your Big Dumb Mistake, it just hasn't been triggered yet.
Or, you just weren't there any more when it triggered.
programmer_humor
@programming.dev
33583
2551
7101
Welcome to Programmer Humor!
This is a place where you can post jokes, memes, humor, etc. related to programming!
For sharing awful code theres also Programming Horror.
Rules
- Keep content in english
- No advertisements
- Posts must be related to programming or programmer topics
- If the mod doesn't find it funny, you're banned. Ha-ha!... For real: do not use the community for "statements". There are other places for such content. Keep it chill and funny.
go to feed...
programmer_humor
@programming.dev
33583
2551
7101
Welcome to Programmer Humor!
This is a place where you can post jokes, memes, humor, etc. related to programming!
For sharing awful code theres also Programming Horror.
Rules
- Keep content in english
- No advertisements
- Posts must be related to programming or programmer topics
- If the mod doesn't find it funny, you're banned. Ha-ha!... For real: do not use the community for "statements". There are other places for such content. Keep it chill and funny.
go to feed...
Believe it or not a lot of hacking is more like this than you think.
save