5 ms·

I like how nearly every comment here is about the AI itself instead of POST data injection the blog post warns about. I can only imagine GitHub Copilot is writ

I like how nearly every comment here is about the AI itself instead of POST data injection the blog post warns about. I can only imagine GitHub Copilot is writing them.

silvester23 5y ago
Seriously, I have rarely seen a comment section on HN that was so completely off topic. Ironically, this comment is not really helping either.
- draw_down 5y ago
  Really? I think it happens pretty often. It’s a form of bikeshedding, if you don’t know jack about the actual technical issue in question just blurt out your thoughts on the product (or whatever) the issue is in context of.
matthewmacleod 5y ago
The specific error in question is a pretty common kind of error that most of us will have seen at some time – so while it's interesting to highlight, it's not particularly new or surprising. The Copilot thing is much more intriguing IMO. It is a large and fairly high-profile product launch of a developer tool, and the headline examples given contain a variety of subtle bugs – at least four that are listed in this comment thread alone. That's likely to stimulate some interesting discussion!
pyrale 5y ago
That's the risk when an article uses hot news as an introduction to talk about something else.
- jaffathecake 5y ago
  Hah, yeah, although the process here wasn't as cynical as you're making out. I blog about things that catch my interest, and the coding error in Copilot caught my interest. Usually when I do a blog post about the 'right' way to do something, it's triggered by seeing it done 'wrong' somewhere. Usually I can't point to whoever did it wrong, because it's unfair, and as a result I get a lot of replies to the post like "duhhh everyone knows this already". But in this case it's AI creating the error, so it feels fine to point to the source of the error. Rather than jumping on a hot topic to farm hits to my blog, I'm blogging about something that caught my interest, and it caught my interest because it's a hot topic.
  - pyrale 5y ago
    I see no harm or cynicism in doing so, either. I edited my original message to make it clearer. I'm completely fine with chasing an incidental topic, my comment was in reaction to the parent's comment about people going offtopic, while, to me, it's pretty logical that the topic is going to be the news while it's still hot.
  - Tade0 5y ago
    Any excuse to share knowledge is a net benefit in my view.
deleted 5y ago
[deleted]
saurik 5y ago
Umm... the article is also about Copilot: it is a massive explanation of why Copilot's generated code is dangerous, using an example put forward on the home page of the project as an egregious example. An article about an obvious injection issue and the myriad ways of doing it correctly wouldn't be worth writing in 2021 without the goal of critiquing Copilot as articles about these issues in web development are a dime a dozen.
- pwdisswordfish0 5y ago
  The irony. Your sensors seem to be badly miscalibrated. I've seen moments in the last week where no fewer than three items on the frontpage were dealing in Copilot outrage. URLSearchParams, on the other hand, is brand new. (I wouldn't even be surprised if this were the first time the topic has made it to the frontpage, ever—if it's even been submitted for discussion at all; searches aren't disconfirming this, but it's hard to be conclusive by just filtering on submission titles.) As for the (obnoxiously stated) claim "Umm... the article is also about Copilot", you're off by about a mile (or maybe off by an amount that we'd expect from a machine that feels like it's doing pattern matching and faking deep, human-level understandig). Copilot's relationship to the article is incidental; it uses Copilot snippets as examples. The article is about URLSearchParams and data encoding.
shadowgovt 5y ago
EDIT: to clarify for others: the issue is the combination of the content-type x-www-form-urlencoded and the body that is being raw-string-injected without encoding. '&' in the body would be interpreted as a URL form token delimiter and parsed improperly by the text-processing.com API.
- vbezhenar 5y ago
  If this JavaScript executes in browser, it's just a bug. If user types 'abc&d=e', it might not post this text. It's unlikely to be a security issue, because server must check all requests anyway, as user can send anything. If this JavaScript executes in a server (e.g. some kind of microservice call), it might be a security issue, indeed, as some people treat internal calls as trusted ones (although they probably should not).
- deleted 5y ago
  [deleted]

I like how nearly every comment here is about the AI itself instead of POST data injection the blog post warns about. I can only imagine GitHub Copilot is writing them.

silvester23 5y ago

Seriously, I have rarely seen a comment section on HN that was so completely off topic. Ironically, this comment is not really helping either.

draw_down 5y ago
Really? I think it happens pretty often. It’s a form of bikeshedding, if you don’t know jack about the actual technical issue in question just blurt out your thoughts on the product (or whatever) the issue is in context of.

matthewmacleod 5y ago

The specific error in question is a pretty common kind of error that most of us will have seen at some time – so while it's interesting to highlight, it's not particularly new or surprising. The Copilot thing is much more intriguing IMO. It is a large and fairly high-profile product launch of a developer tool, and the headline examples given contain a variety of subtle bugs – at least four that are listed in this comment thread alone. That's likely to stimulate some interesting discussion!

pyrale 5y ago

That's the risk when an article uses hot news as an introduction to talk about something else.

jaffathecake 5y ago
Hah, yeah, although the process here wasn't as cynical as you're making out. I blog about things that catch my interest, and the coding error in Copilot caught my interest. Usually when I do a blog post about the 'right' way to do something, it's triggered by seeing it done 'wrong' somewhere. Usually I can't point to whoever did it wrong, because it's unfair, and as a result I get a lot of replies to the post like "duhhh everyone knows this already". But in this case it's AI creating the error, so it feels fine to point to the source of the error. Rather than jumping on a hot topic to farm hits to my blog, I'm blogging about something that caught my interest, and it caught my interest because it's a hot topic.
- pyrale 5y ago
  I see no harm or cynicism in doing so, either. I edited my original message to make it clearer. I'm completely fine with chasing an incidental topic, my comment was in reaction to the parent's comment about people going offtopic, while, to me, it's pretty logical that the topic is going to be the news while it's still hot.
- Tade0 5y ago
  Any excuse to share knowledge is a net benefit in my view.

deleted 5y ago

[deleted]

saurik 5y ago

Umm... the article is also about Copilot: it is a massive explanation of why Copilot's generated code is dangerous, using an example put forward on the home page of the project as an egregious example. An article about an obvious injection issue and the myriad ways of doing it correctly wouldn't be worth writing in 2021 without the goal of critiquing Copilot as articles about these issues in web development are a dime a dozen.

pwdisswordfish0 5y ago
The irony. Your sensors seem to be badly miscalibrated. I've seen moments in the last week where no fewer than three items on the frontpage were dealing in Copilot outrage. URLSearchParams, on the other hand, is brand new. (I wouldn't even be surprised if this were the first time the topic has made it to the frontpage, ever—if it's even been submitted for discussion at all; searches aren't disconfirming this, but it's hard to be conclusive by just filtering on submission titles.) As for the (obnoxiously stated) claim "Umm... the article is also about Copilot", you're off by about a mile (or maybe off by an amount that we'd expect from a machine that feels like it's doing pattern matching and faking deep, human-level understandig). Copilot's relationship to the article is incidental; it uses Copilot snippets as examples. The article is about URLSearchParams and data encoding.

shadowgovt 5y ago

EDIT: to clarify for others: the issue is the combination of the content-type x-www-form-urlencoded and the body that is being raw-string-injected without encoding. '&' in the body would be interpreted as a URL form token delimiter and parsed improperly by the text-processing.com API.

vbezhenar 5y ago
If this JavaScript executes in browser, it's just a bug. If user types 'abc&d=e', it might not post this text. It's unlikely to be a security issue, because server must check all requests anyway, as user can send anything. If this JavaScript executes in a server (e.g. some kind of microservice call), it might be a security issue, indeed, as some people treat internal calls as trusted ones (although they probably should not).
deleted 5y ago
[deleted]