5 ms·

What follows next is purely speculation and it is based on my own observations and thoughts but based on what I've seen the old RBAC models, while being almost

by _pdp_ 4mo ago

What follows next is purely speculation and it is based on my own observations and thoughts but based on what I've seen the old RBAC models, while being almost broken before, now it is fully broken, with the fact that now coding assistants and engineers are working on multiple unrelated projects simultaneously - especially working on wild experiments they had no time for previously. The risk of supply chain issue has increased dramatically in the enterprise. Again, I am not saying it is related but I think it has an impact. Now in many places it is encouraged by coders and managers to vibe stuff on their own devices. Soon or later it will become a problem, especially for those that have no idea what they are doing. I am not saying it is related but I feel that it coincides perfectly. I just cannot believe there is no underlaying thread going through all of these recent supply chain issues, and yes there are some hacking groups that specialise in this, sure, but it is because the bounty is plentiful.

altairprime 4mo ago
I argued for years that we had too few workers for our total project count and management argued that most projects were idle and so it was fine to have so many per worker. Welp.
- _pdp_ 4mo ago
  I think web-based IDEs like GitHub Codespaces (but even VSCode with tunnels) is part of the solution because at the very least you can get an isolated dev environment per project. I've been advocating for this for as long as I remember. Unfortunately, most developers don't like them so it is a though sell.
  - altairprime 4mo ago
    Is the theory here that the browser cannot be co-opted to infect web-based repositories? Also: thinking of how yt-dlp can integrate with browser cookies now and the malware paths that opens up. (This is part of why Chrome wants HSM cookies, I expect: DRM and opsec!)
    - _pdp_ 4mo ago
      In this scenario the malware will not be on the device but in an isolated dev environment on a remote machine. So it will have access to whatever was configured in that repo but hopefully the project is isolated enough to ensure containment and prevent cross-pollination.
      - altairprime 4mo ago
        That’s a big, labor-expensive if.
      - repelsteeltje 4mo ago
        I don't think the cloud (someone else's computer) is the best solution. The sanitation problem can be mitigated by compartimentization but the cloud aspect also adds brittleness and new attack vectors. Why not set up proper containers (or VMs) locally? And why not wait a little till local LLMs catch up? Maybe just a personal itch, but having your dev environment elsewhere feels so gross to me..
        _pdp_ 4mo ago
        That is the problem. You outline perfectly how a developer sees the situation. On the other hand ephemeral cloud environment with proper security controls makes a lot of sense if the goal is to isolate and control. If everyone was following the protocol we wouldn't have had the problem to begin with.
  - domh 4mo ago
    Web-based IDEs like VSCode on github just had a 1-click github token stealing vulnerability: https://blog.ammaraskar.com/github-token-stealing/ https://blog.ammaraskar.com/github-token-stealing/ You could argue this is probably on GitHub for creating a token here that gives blanket access to all repos vs a scoped token for just the repo.
  - 63stack 4mo ago
    Why do most developers not like it? Is it because the browser is a terrible platform for text editors since there is no proper key mapping, or access to proper debuggers, or there is too much latency, and no access to cli tools? You make it sound like you are surprised, but everyone who has tried this knows it's crap and a band aid at best.
    - greggroth 4mo ago
      I hope folks know they can use Codespaces in their desktop editor. I never use the web editor.
    - nosioptar 4mo ago
      I really tried to give vscode an honest shot. I couldn't find anything about it that was even half as good as a real text editor. It made writing code feel like a chore. I usually love writing code.
      - GabeIsko 4mo ago
        What is a real text editor, by your estimation? NVim? Emacs? Genuinely curious. I use VSCode/Codium since I maintain a GUI stack for general usage. But I have all the terminal tools installed for my work there as well. I hate customizing things too, which I find is necessary if you want to get the most out of terminal text editors. VSCode is pretty good out of the box, with terminal access and everything built in. Jeez, I hope this doesn't turn into a text editor flame war...
        tracker1 4mo ago
        I'll say my biggest recent gripe with VS Code, is since they started collapsing bits in the terminal, when I type a command and hit enter, if I start typing the next command before the first command is done, the input gets mangled. It doesn't happen in MS Terminal (new Windows Terminal) and it doesn't happen in Tabby (which is also Electron+xterm.js), so it's a recent unique to VS Code bug... and it's annoying to no end for me. I actually rely on the integrated code terminal a lot.
  - fc417fc802 4mo ago
    Why would I ever want to use a browser based solution instead of local VMs? If you're worried about VM escapes then you have bigger problems (and hopefully a full time security team supporting you). Edit: I realize in hindsight this comes across as overly negative. I think those are great solutions to have available for when you are working with a suboptimal local setup for whatever reason. I just don't think they're the default choice let alone any sort of ideal to strive for.
  - jasonjayr 4mo ago
    This is the leg of the cycle when we go back to mainframes & centralized computing? With all the datacenter build out; why wouldn't you want your services adjacent to the LLM processing centers?
  - matkoniecz 4mo ago
    > I think web-based IDEs like GitHub Codespaces (but even VSCode with tunnels) is part of the solution I am against proprietary SAAS online in browser dependencies.
  - tracker1 4mo ago
    I like the remote editing tools for VS Code quite a bit...
black_knight 4mo ago
Do you mean that role based access control (RBAC) should be replaced by something else? Or that just the specific RBAC models in use are broken? I personally think the, perhaps confusingly named, capability based security models are the way of The Future.
- rswail 4mo ago
  ABAC/Capability and very granular policies for both actions and actions on behalf of others with the right sort of resource-based policies as well. And the apps need to be capability constrained and sandboxed. Gonna be a hard nut to crack to implement this across the supply chain. Transitive dependencies are a bitch.
sourcecodeplz 4mo ago
one could also vibe-code vanilla, no dependencies.
- _pdp_ 4mo ago
  You can vibe code safely for sure. I am not saying vibe coding is the issue. The issue is that a typical developer might be working on a lot more projects that run concurrently then they used to. And because of the various nature of the project the risk is significantly increased. Scale this across the workforce and you not just doubled the problem.
  - Grimburger 4mo ago
    You can vibecode docs and tests also but I'm truly not seeing more of those. In the end it can just be a culture thing. A dev who was going to write docs and tests before is going to have a LLM generate docs and tests today. Same with safe practices and defensive coding. The machine does whatever you want from it, for most that's "just get the job done I don't care". So that's the output.
    - johnisgood 4mo ago
      If I vibe code a project, that involves docs and tests as well. Obviously I do not, at any point, do anything blindly and there are some iterations for everything. I always double-check, and I do not use "agents", I do everything manually. I always check what the LLM is thinking, in real-time. I might be old school, but that allows me to write code that is not a pile of shit. :P I am still conscious about quality.
      - whattheheckheck 4mo ago
        Anecdotal. 13 million swe roles with .01% is 130,000 compromised devices. Process problem
        johnisgood 4mo ago
wartywhoa23 4mo ago
> Now in many places it is encouraged by coders and managers to vibe stuff on their own devices. Soon or later it will become a problem, especially for those that have no idea what they are doing. Idiots must suffer.
watty 4mo ago
Just to clarify, and I know you weren't saying they are related, but this has absolutely nothing to do with AI or vibe coding or manager code. It's a continuation of the Shai Halud worm and the lack of security around developer dependnecy installations, which has existed for a very long time. Hackers have figured out that developers themselves are an ideal target due to how easy it is to trick them into installing something and how much private information they have on their machines (creds, cloud clis, mcps, etc.).
- madeofpalk 4mo ago
  As with many other things, AI exacerbates this problem. It’s so easy for many more of things things to happen unattended and in greater volume, and the AIs themselves can be tricked into doing these things, not helped by their patten of “prompt the user to approve 30 different inscrutable pythons and bash scripts”.
- josefx 4mo ago
  > due to how easy it is to trick them into installing something You have tools from large corporations where the official installation procedure involves copy pasting a command from a random blog post, run it with sudo and watch it download and execute a script from a random filehost. This is somehow deemed acceptable by everyone involved. Meanwhile I can't use teams in our meeting rooms, since any form of internet access was deemed a security risk in rooms where customer projects could be discussed. This is in a day and age where 90% of customer meetings are done over the internet. Anyone trying to follow sane practices in this industry just asks to end up in a padded cell.
  - dirkc 4mo ago
    > This is somehow deemed acceptable by everyone involved By some, not all. It's been crazy from the start and it is still crazy to pipe a script to bash!
  - chickensong 4mo ago
    > Anyone trying to follow sane practices in this industry just asks to end up in a padded cell. Same as it ever was.
wolvoleo 4mo ago
> Now in many places it is encouraged by coders and managers to vibe stuff on their own devices. Soon or later it will become a problem, especially for those that have no idea what they are doing. Yes in our place too. "You better do as much as possible with AI or you will be left behind" dogmas etc. It's the stupid IoT hype all over again. No concern for security, just trying to be the first in the pack.
- renegade-otter 4mo ago
  "MongoDB is the hottest thing! No default creds, who cares about that! ONWARD TO PRODUCTION, SOLDIERS!"
  - doubled112 4mo ago
    Instead of learning from past mistakes, it seems we need to keep making the same ones over and over.
    - wolvoleo 4mo ago
      It has all happened before and it will all happen again :)
      - dylan604 4mo ago
        I just finished watching that series, so I can pick up these references. Nothing like being 20 years late to the party
        wolvoleo 4mo ago
        Has it been 20 years already? Wow. Yeah it was a good one (though a little too gritty for me sometimes)
        abustamam 4mo ago
        Apparently I'm late to the party too! What is this from?
tracker1 4mo ago
My work projects are on separate hardware in a separate network that doesn't allow for AI agents... for better and worse. I have used agents for a few components externally, that I've adopted/used internally... but those were 100% code reviewed, not vibe coded. One was an intro animation using a couple SVGs and CSS. Another was an image zoom control where I needed some behaviors and not a lot extra. Both significantly tweaked by hand as well. I'm more a proponent of working as a gatekeeper as opposed to vibe coding... Though I think a better term would be nice.

by _pdp_ 4mo ago

altairprime 4mo ago

I argued for years that we had too few workers for our total project count and management argued that most projects were idle and so it was fine to have so many per worker. Welp.

_pdp_ 4mo ago
I think web-based IDEs like GitHub Codespaces (but even VSCode with tunnels) is part of the solution because at the very least you can get an isolated dev environment per project. I've been advocating for this for as long as I remember. Unfortunately, most developers don't like them so it is a though sell.
- altairprime 4mo ago
  Is the theory here that the browser cannot be co-opted to infect web-based repositories? Also: thinking of how yt-dlp can integrate with browser cookies now and the malware paths that opens up. (This is part of why Chrome wants HSM cookies, I expect: DRM and opsec!)
  - _pdp_ 4mo ago
    In this scenario the malware will not be on the device but in an isolated dev environment on a remote machine. So it will have access to whatever was configured in that repo but hopefully the project is isolated enough to ensure containment and prevent cross-pollination.
    - altairprime 4mo ago
      That’s a big, labor-expensive if.
    - repelsteeltje 4mo ago
      I don't think the cloud (someone else's computer) is the best solution. The sanitation problem can be mitigated by compartimentization but the cloud aspect also adds brittleness and new attack vectors. Why not set up proper containers (or VMs) locally? And why not wait a little till local LLMs catch up? Maybe just a personal itch, but having your dev environment elsewhere feels so gross to me..
      - _pdp_ 4mo ago
        That is the problem. You outline perfectly how a developer sees the situation. On the other hand ephemeral cloud environment with proper security controls makes a lot of sense if the goal is to isolate and control. If everyone was following the protocol we wouldn't have had the problem to begin with.
- domh 4mo ago
  Web-based IDEs like VSCode on github just had a 1-click github token stealing vulnerability: https://blog.ammaraskar.com/github-token-stealing/ https://blog.ammaraskar.com/github-token-stealing/ You could argue this is probably on GitHub for creating a token here that gives blanket access to all repos vs a scoped token for just the repo.
- 63stack 4mo ago
  Why do most developers not like it? Is it because the browser is a terrible platform for text editors since there is no proper key mapping, or access to proper debuggers, or there is too much latency, and no access to cli tools? You make it sound like you are surprised, but everyone who has tried this knows it's crap and a band aid at best.
  - greggroth 4mo ago
    I hope folks know they can use Codespaces in their desktop editor. I never use the web editor.
  - nosioptar 4mo ago
    I really tried to give vscode an honest shot. I couldn't find anything about it that was even half as good as a real text editor. It made writing code feel like a chore. I usually love writing code.
    - GabeIsko 4mo ago
      What is a real text editor, by your estimation? NVim? Emacs? Genuinely curious. I use VSCode/Codium since I maintain a GUI stack for general usage. But I have all the terminal tools installed for my work there as well. I hate customizing things too, which I find is necessary if you want to get the most out of terminal text editors. VSCode is pretty good out of the box, with terminal access and everything built in. Jeez, I hope this doesn't turn into a text editor flame war...
      - tracker1 4mo ago
        I'll say my biggest recent gripe with VS Code, is since they started collapsing bits in the terminal, when I type a command and hit enter, if I start typing the next command before the first command is done, the input gets mangled. It doesn't happen in MS Terminal (new Windows Terminal) and it doesn't happen in Tabby (which is also Electron+xterm.js), so it's a recent unique to VS Code bug... and it's annoying to no end for me. I actually rely on the integrated code terminal a lot.
- fc417fc802 4mo ago
  Why would I ever want to use a browser based solution instead of local VMs? If you're worried about VM escapes then you have bigger problems (and hopefully a full time security team supporting you). Edit: I realize in hindsight this comes across as overly negative. I think those are great solutions to have available for when you are working with a suboptimal local setup for whatever reason. I just don't think they're the default choice let alone any sort of ideal to strive for.
- jasonjayr 4mo ago
  This is the leg of the cycle when we go back to mainframes & centralized computing? With all the datacenter build out; why wouldn't you want your services adjacent to the LLM processing centers?
- matkoniecz 4mo ago
  > I think web-based IDEs like GitHub Codespaces (but even VSCode with tunnels) is part of the solution I am against proprietary SAAS online in browser dependencies.
- tracker1 4mo ago
  I like the remote editing tools for VS Code quite a bit...

black_knight 4mo ago

Do you mean that role based access control (RBAC) should be replaced by something else? Or that just the specific RBAC models in use are broken? I personally think the, perhaps confusingly named, capability based security models are the way of The Future.

rswail 4mo ago
ABAC/Capability and very granular policies for both actions and actions on behalf of others with the right sort of resource-based policies as well. And the apps need to be capability constrained and sandboxed. Gonna be a hard nut to crack to implement this across the supply chain. Transitive dependencies are a bitch.

sourcecodeplz 4mo ago

one could also vibe-code vanilla, no dependencies.

_pdp_ 4mo ago
You can vibe code safely for sure. I am not saying vibe coding is the issue. The issue is that a typical developer might be working on a lot more projects that run concurrently then they used to. And because of the various nature of the project the risk is significantly increased. Scale this across the workforce and you not just doubled the problem.
- Grimburger 4mo ago
  You can vibecode docs and tests also but I'm truly not seeing more of those. In the end it can just be a culture thing. A dev who was going to write docs and tests before is going to have a LLM generate docs and tests today. Same with safe practices and defensive coding. The machine does whatever you want from it, for most that's "just get the job done I don't care". So that's the output.
  - johnisgood 4mo ago
    If I vibe code a project, that involves docs and tests as well. Obviously I do not, at any point, do anything blindly and there are some iterations for everything. I always double-check, and I do not use "agents", I do everything manually. I always check what the LLM is thinking, in real-time. I might be old school, but that allows me to write code that is not a pile of shit. :P I am still conscious about quality.
    - whattheheckheck 4mo ago
      Anecdotal. 13 million swe roles with .01% is 130,000 compromised devices. Process problem
      - johnisgood 4mo ago

wartywhoa23 4mo ago

watty 4mo ago

Just to clarify, and I know you weren't saying they are related, but this has absolutely nothing to do with AI or vibe coding or manager code. It's a continuation of the Shai Halud worm and the lack of security around developer dependnecy installations, which has existed for a very long time. Hackers have figured out that developers themselves are an ideal target due to how easy it is to trick them into installing something and how much private information they have on their machines (creds, cloud clis, mcps, etc.).

madeofpalk 4mo ago
As with many other things, AI exacerbates this problem. It’s so easy for many more of things things to happen unattended and in greater volume, and the AIs themselves can be tricked into doing these things, not helped by their patten of “prompt the user to approve 30 different inscrutable pythons and bash scripts”.
josefx 4mo ago
> due to how easy it is to trick them into installing something You have tools from large corporations where the official installation procedure involves copy pasting a command from a random blog post, run it with sudo and watch it download and execute a script from a random filehost. This is somehow deemed acceptable by everyone involved. Meanwhile I can't use teams in our meeting rooms, since any form of internet access was deemed a security risk in rooms where customer projects could be discussed. This is in a day and age where 90% of customer meetings are done over the internet. Anyone trying to follow sane practices in this industry just asks to end up in a padded cell.
- dirkc 4mo ago
  > This is somehow deemed acceptable by everyone involved By some, not all. It's been crazy from the start and it is still crazy to pipe a script to bash!
- chickensong 4mo ago
  > Anyone trying to follow sane practices in this industry just asks to end up in a padded cell. Same as it ever was.

wolvoleo 4mo ago

> Now in many places it is encouraged by coders and managers to vibe stuff on their own devices. Soon or later it will become a problem, especially for those that have no idea what they are doing. Yes in our place too. "You better do as much as possible with AI or you will be left behind" dogmas etc. It's the stupid IoT hype all over again. No concern for security, just trying to be the first in the pack.

renegade-otter 4mo ago
"MongoDB is the hottest thing! No default creds, who cares about that! ONWARD TO PRODUCTION, SOLDIERS!"
- doubled112 4mo ago
  Instead of learning from past mistakes, it seems we need to keep making the same ones over and over.
  - wolvoleo 4mo ago
    It has all happened before and it will all happen again :)
    - dylan604 4mo ago
      I just finished watching that series, so I can pick up these references. Nothing like being 20 years late to the party
      - wolvoleo 4mo ago
        Has it been 20 years already? Wow. Yeah it was a good one (though a little too gritty for me sometimes)
        abustamam 4mo ago
        Apparently I'm late to the party too! What is this from?

tracker1 4mo ago

My work projects are on separate hardware in a separate network that doesn't allow for AI agents... for better and worse. I have used agents for a few components externally, that I've adopted/used internally... but those were 100% code reviewed, not vibe coded. One was an intro animation using a couple SVGs and CSS. Another was an image zoom control where I needed some behaviors and not a lot extra. Both significantly tweaked by hand as well. I'm more a proponent of working as a gatekeeper as opposed to vibe coding... Though I think a better term would be nice.