4 ms·
> MSRC bounty team determined that M365 Copilot was out-of-scope for bounty and therefore not eligible for a reward. What a shame. There’s probably LOTS of vul
by binarymax 11mo ago
> MSRC bounty team determined that M365 Copilot was out-of-scope for bounty and therefore not eligible for a reward.
What a shame. There’s probably LOTS of vulns in copilot. This just discourages researchers and responsible disclosure, likely leaving copilot very insecure in the long run.
- CaptainOfCoit 11mo ago> There’s probably LOTS of vulns in copilot Probably exactly why they "determined" it to be out of scope :)
- candiddevmike 11mo agoIt's irresponsible for any company to be using copilot with MS having this bug bounty attitude, IMO. Would be curious what other products are out of bounds so I know not to use them...
- kenjackson 11mo agoIs there any company that has bug bounties on all their products?
- oowahahahah 11mo ago[dead]
- AppleBananaPie 11mo agoI'd assume the app / technology Microsoft is pushing over all else is more worth a bug bounty than say Visio so maybe more accurate to ask are there any major companies with their new key product that don't have bug bounties? Happy to be wrong and put my foot in my mouth though I've misunderstood folks before :)
- fingerlocks 11mo agoThis is about the M365 Copilot, which is the enterprise version. The normal consumer version of Copilot shares nothing in common except for the name, at least that’s what I’ve been told. Different architecture, team, back end, etc. And side by side, the enterprise version is much crapper of the two.
- p_ing 11mo agoQQ for the LLM folks -- is this possibly due to the lack of determinization of LLM output? If I code a var blah = 5*5; I know the answer is always 35. But if I ask an LLM, it seems like the answer could be anything from correct to any incorrect number one could dream up. We saw this at work with the seahorse emoji question. A variety of [slight] different answers.
- nawgz 11mo ago> If I code a var blah = 5*5; I know the answer is always 35 I greatly enjoy the irony here.
- anonymars 11mo agoIt's okay, we've replaced the Turing test with the em dash test
- DrewADesign 11mo agoThe em dash thing seems weird to me. The writing style guide for the college I attended as a freshman was big on them, and I never shook the habit. Not being able to easily conjure one was one of the biggest annoyances when I was forced to switch from macOS to windows.
- dpark 11mo agoI find the em dash thing weird as well. I bunch of people who didn’t know what an em dash was a couple of years ago decided that it’s a signature LLM move.
- nawgz 11mo agoIt just contrasts expectations of the unwashed masses with more professional writing. If most people are used to reading social media and texts from their friends and maybe subtitles for movies, an em dash is practically never going to appear, and so when everyone and their dog start using them, well, it’s obvious something is up. Whereas the more literate individual used to consuming writing for pleasure will have seen them regularly, and may even have employed them while writing.
- deleted 11mo ago[deleted]
- driverdan 11mo agoThis is MS telling anyone who finds an M365 Copilot exploit to sell it instead of reporting it. Incredibly short sighted and foolish.
- CaptainOfCoit 11mo agoThe very same company that for at least two decades and two CEOs have been saying "Security is now our top security".
- ruguo 11mo agoI honestly can’t even remember the last time I used Copilot.