3 ms·
I maintain a handful of Open Source projects written in JavaScript and TypeScript, a couple of which are fairly popular, and I don't think I've seen any of this
by nfriedly 2y ago
I maintain a handful of Open Source projects written in JavaScript and TypeScript, a couple of which are fairly popular, and I don't think I've seen any of this. Maybe it just hasn't reached the JavaScript world yet?
The one project is a rate limiter, and for a while I was getting a fair number of bug reports that boiled down to configuration mistakes, such as accidentally rate limiting the load balancer/reverse proxy rather than a specific end user. I implemented a handful of runtime checks looking for common mistakes like that, each logging a one-line warning with a link to a wiki page that gave more details. Since then, the support burden has come down dramatically.
- ajross 2y agoZephyr isn't getting any either that I've seen. The projects in evidence in the article are python and curl, so it's likely limited to only the highest profile targets. What would be interesting is who's doing it and why. The incentives wouldn't seem to be malicious, there's no attempt a-la xz-utils to boost credentials for a real human. Honestly if I had to guess it's an AI research group at Microsoft or wherever trying to tune their coding bots.
- techjamie 2y agoCurl offers a monetary reward as part of their bug bounty program, so that is a contributing factor in their case. It seems to me like talentless hacks looking for ChatGPT to get them easy money/cred without any actual work.
- nfriedly 2y agoYeah, that's probably part of it - none of my projects have any bug bounty.
- BeetleB 2y ago[flagged]
- dang 2y agoPlease don't do this here.