2 ms·
This is common in the hype era of AI models that can look for security bugs. An open-source project I used to work on that is basically "distributed code execut
by TallGuyShort 3mo ago
This is common in the hype era of AI models that can look for security bugs. An open-source project I used to work on that is basically "distributed code execution as a service" keeps getting reports that the job submission function is a vulnerability. The reporters don't even understand what the project does.
- blincoln 3mo agoIs the job submission handled securely? I've seen plenty of systems along the lines of what you're describing where unauthenticated clients can submit jobs. Sometimes the developers even claim that's intentional. Either way, it's a vulnerability, because it compromises the underlying hosts.
- TallGuyShort 3mo agoYes, and that's not what people are reporting flaws in. The reports are "this daemon accepts arbitrary code and then runs it!"