4 ms·
Someone unminified the js, and it turned out that a bunch of the rest endpoints it knew about were just unverified crud endpoints for the site. https://archive
by monocasa 2y ago
Someone unminified the js, and it turned out that a bunch of the rest endpoints it knew about were just unverified crud endpoints for the site.
https://archive.ph/2025.02.14-132833/https://www.404media.co/anyone-can-push-updates-to-the-doge-gov-website-2/ https://archive.ph/2025.02.14-132833/https://www.404media.co...
- Euphorbium 2y agoSmells exactly like llm created solution.
- monocasa 2y agoOr just what happens when you hire a bunch of 20 year olds and let them loose. That's currently how I model my usage of LLMs in code. A smart veeeery junior engineer that needs to be kept on a veeeeery short leash.
- ellisv 2y agoYes. LLMs are very much like a smart intern you hired with no real experience who is very eager to please you.
- heavyset_go 2y agoIMO, they're worse than that. You can teach an intern things, correct their mistakes, help them become better and your investment will lead to them performing better. LLMs are an eternal intern that can only repeat what it's gleaned from some articles it skimmed last year or whatever. If your expected response isn't in its corpus, or isn't in it frequently enough, and it can't just regurgitate an amalgamation of the top N articles you'd find on Google anyway, tough luck.
- worik 2y agoThe Age of the Eternal Intern
- kridsdale1 2y agoAnd the content online is now written by Fully Automated Eternal September
- kps 2y agoToday is Friday the 11490th of September 1993.
- willturman 2y agoWithout a mechanism to detect output from LLMs, we’re essentially facing an eternal model collapse with each new ingestion of information from academic journals, to blogs, to art. [1][2] [1] https://en.m.wikipedia.org/wiki/Model_collapse https://en.m.wikipedia.org/wiki/Model_collapse [2]https://thebullshitmachines.com/lesson-16-the-first-step-fallacy/index.html https://thebullshitmachines.com/lesson-16-the-first-step-fal...
- SketchySeaBeast 2y agoLLMs are to interns what house cats are to babies. They seem more self sufficient at first, but soon the toddler grows up and you're stuck with an animal who will forever need you to scoop its poops.
- lgas 2y ago> You can teach an intern things, correct their mistakes, help them become better and your investment will lead to them performing better. You can't do the same way you do with a human developer, but you can do a somewhat effective form of it through things like .cursorrules files and the like.
- deleted 2y ago[deleted]
- deleted 2y ago[deleted]
- gvx 2y agoOne who thinks "open source" means blindly copy/pasting code snippets found online.
- NewJazz 2y agoEven at 20 years old I would not have done this.
- kevin_thibedeau 2y agoThe difference is that today's digital natives regard computers as magic and most don't know what's really happening when their framework du jour spits out some "unreadable" text.
- mlinhares 2y agoSo much this, I was interning at a government entity at 20 and I already knew you needed credentials to do shit. Most frameworks have this by default for free, we're so incredibly screwed with these folks running rampant and destroying the government.
- daveguy 2y agoIt's definitely both. A bunch of 20 year olds were let loose to be "super efficient." So, to be efficient they use LLMs to implement what should be a major government oversight webpage. Even after the fix the list is a few half-baked partial document excerpts with a few sentences saying, "look how great we are!" It's embarrassing.
- rcpt 2y agoMaybe doge should have used an LLM to generate defenses
- caboteria 2y agoThey did, and this is what they got.
- AirMax98 2y agoMy first guess is that this is an unauthenticated server action.[0] 0 - https://blog.arcjet.com/next-js-server-action-security/ https://blog.arcjet.com/next-js-server-action-security/
- Maxatar 2y agoDoes it? At least my experience is that ChatGPT goes super hard on security, heavily promoting the use of best practices. Maybe they used Grok ;P
- tatersolid 2y ago> At least my experience is that ChatGPT goes super hard on security, heavily promoting the use of best practices. Not my experience at all. Every LLM produces lots of trivial SQLI/XSS/other-injection vulnerabilities. Worse they seem to completely authorization business logic, error handling, and logging even when prompted to do so.
- tatersolid 2y agoPost-edit window, the above should read “…completely skip authorization…”
- zamalek 2y agoDoes it, though? The saying says we shouldn't mistake incompetence for malice, but that requires more than usual for Musk's retinue. Smells like getting a backdoor in early.
- daveguy 2y agoApparently they get backdoors in as incompetently as they create efficiency.
- insane_dreamer 2y agoGood thing we have the best and brightest at DOGE!
- croisillon 2y agowell they pay for a blue checkmark, they _must_ be the cleverest we have
- rbanffy 2y agoIt's been a while since I last saw a CMS pulling data from a database... It's a miracle the website didn't crumble under the load.
- ksenzee 2y agoPut a CMS behind a well-configured CDN and it's essentially a static site generator. If you have cache invalidation figured out, you get all the speed and scalability benefits of a static site without ever having to regenerate your content.
- rbanffy 2y agoI’m guessing it didn’t have much in front of it because the management endpoints were accessible from the public Internet. I think you mentioning the “well configured CDN” is key here. If there was a CDN in front of it, it wasn’t well configured. BTW, I spent a lot of my career configuring load balancing, caches, proxies, sharding, and CDNs for Plone (a CMS that’s popular with governments) websites.
- ksenzee 2y agoYeah sorry, I didn't mean to imply these folks have any clue what they're doing. I misread your comment as "it's been a while since I saw a CMS-based site, big sites are all static now" instead of "it's been a while since I saw a CMS rawdogging it."
- CharlesChadwick 2y agoJust checked the DOGE website; I'm not too sure about this theory given that POST requests are blocked and the only APIs you can find (ie. /api/offices) only supports GET requests and if the UUID doesn't match, it 404s. I don't see any CRUD endpoints for modifying the database
- 1_1xdev1 2y agoDOGE noticed. They might have "fixed" the vulnerability by now https://doge.gov/workforce?orgId=69ee18bc-9ac8-467e-84b0-106601b01b90 https://doge.gov/workforce?orgId=69ee18bc-9ac8-467e-84b0-106... is what's linked to by the "Workforce" header, and it now looks different than the screenshots
- 0x1ceb00da 2y agohttps://m.youtube.com/watch?v=woPff-Tpkns&pp=ygUSdW5kZXJ0YWxlIGRvZyBzb25n https://m.youtube.com/watch?v=woPff-Tpkns&pp=ygUSdW5kZXJ0YWx...