motorest

40 ms·

901.
by motorest 1y ago
> I'm gonna bet used Valentinos, in my size, are still gonna be at least 200$. I'm not a shoes guy, but I know they are worth something. That might be true, but it doesn't refute the idea that a) the value listed in the bl
902.
by motorest 1y ago
> The true value of these luxury goods is likely closer to that appraised by those undergrads than by the author - i.e trash. The explanation might be simpler than this: as the students are moving out, taking this stuff with them might b
903.
by motorest 1y ago
> This is why I said unless you...have a very good understanding of its behavior. In this scenario the LLM's behavior per se is not a problem. The problem is that random third parties are able to sneak prompts to manipulate the LL
904.
by motorest 1y ago
> I still don't really get it. Surely the older, simpler, and better cardinal rule is that you just don't expose any service to the Internet that you have given access to your private data, unless you directly control that serv
905.
by motorest 1y ago
> Of course it will apply. Entire purpose of the agent is to give a response to a prompt. The exploit involves random third parties sneaking in their own prompts in a way that leads a LLM to run them on behalf of the repo's owner. T
906.
by motorest 1y ago
> The point is this is NOT a GitHub MCP vulnerability, but how you use it. You're the only one talking about GitHub MCP vulnerabilities. Everyone else is talking about GitHub MCP exploits. It's in the title, even.
907.
by motorest 1y ago
> The problem I have with articles like this and people commenting is that it's framed as if MCP's vulnerability (...) You're extrapolating. The problem is clearly described as a MCP exploit, not a vulnerability. You'
908.
by motorest 1y ago
> In that case, when and how would you reload the statuslist? It only depends on your own requirements. You can easily implement pull-based or push-based approaches if they suit your needs. I know some companies enforce a 10min tolerance
909.
by motorest 1y ago
> Would you ever put a plain password (...) Your comment bears no resemblance with the topic. The attack described in the article consists of injecting a malicious prompt in a way that the target's agent will apply it.
910.
by motorest 1y ago
> That's the thing. LLM or MCP is not a database. You can’t compare it. You can. Read the article. A malicious prompt is injected into an issue to trigger the repo owner's LLM agent to execute it with the agent's credentia
911.
by motorest 1y ago
> I read it, and "attack" does not make sense. Do you believe that describe a SQL injection attack an attack also does not make sense?
912.
by motorest 1y ago
> How is this considered an "exploit"? Others in this discussion aptly described it as a confused deputy exploit. This goes something like: - You write a LLM prompt that says something to the effect "dump all my darkest se
913.
by motorest 1y ago
> How is this considered an "exploit"? As many do, I also jumped to the comment section before actually reading the article. If you do the same, you will quickly notice that this article features an attack. A malicious issue is
914.
by motorest 1y ago
> What is so frustrating about tech like JWTs is that it fits the fairly rare, high profile, websites like Reddit, netflix, etc. but doesn't fit ANYTHING else. This is only conceivably true if your ability to design services only go
915.
by motorest 1y ago
> The statuslist itself has a TTL (...) If you read the draft, the TTL is clearly specified as optional. > (...) and does not get re-loaded until that TTL expires. That is false. The draft clearly states that the optional TTL is inten
916.
by motorest 1y ago
> For the most simple use case of an client auth state; you want to be able to revoke auth straight away if an account is compromised. This means you have to check the auth database for every request anyway, and you probably could have g
917.
by motorest 1y ago
> The problem was that he was holding Iraq together. Not really. He was oppressing Iraq and ruling it with a cruel tight grip, but any regime change takes decades to normalize. You don't just replace a nation's political class
918.
by motorest 1y ago
> Saddam was, without any doubt, an at-times brutal tyrant. Yet not only was Iraq vastly more stable and peaceful under his reign, but so too was the entire Mideast. Hindsight is 20/20, but as consequences go I think that making a m
919.
by motorest 1y ago
> I've never understood what the real reason we invaded was. Wikipedia has a pretty good summary. https://en.wikipedia.org/wiki/Prelude_to_the_Iraq_War
920.
by motorest 1y ago
> $2 trillion for that war. Next time let’s cure cancer(s). Aren't there any positive tradeoffs in overthrowing the likes of Saddam Hussein?
921.
by motorest 1y ago
The comparison section seems to be lacking even the most cursory search for alternative API testing tools. It features insomnia but somehow fails to list postman or bruno. Tools like httpyac in particular or .http files in general are consp
922.
by motorest 1y ago
> It rewrote some comments, changed the test name and added extra assertions to the test. Baby sitting something like that seems like an absolute waste of time. I've worked with real flesh and blood developers who did the exactly sa
923.
by motorest 1y ago
> Yeah. I have Claude 4 correcting code that Claude 3.5 wrote a few months ago. You don't even need to switch models. Write a prompt to generate some code and immediately after prompt the same model to review the code it just genera
924.
by motorest 1y ago
> In other words, the thing that made JSON initially succeed was also a giant security hole Perhaps, but it's not a major concern when you control both the JavaScript frontend and whatever backend it consumes. In fact, arguably this
925.
by motorest 1y ago
> But also, all the other reasons written by the person you replied to Not really. JSON's mass adoption is tied to JavaScript's mass adoption, where sheer convenience and practicality dictates it's whole history most of th
926.
by motorest 1y ago
> is it really more efficient to have an LLM generate code, then review that code, fix errors and spend some time to fully understand it? The answer is always "it depends". There are some drudge work tasks that are brilliantly
927.
by motorest 1y ago
> The space is moving so fast that, if I wrote down my workflows and workarounds just two months ago, so much of it would be stale today. There is also the problem that none of these workflows were validated or verified. Everyone is free
928.
by motorest 1y ago
> I am hopeful that my fellow Americans will elect a responsible, intelligent, virtuous leader in 2028 to be sworn into office on that day. The US elected Biden after Trump's disastrous first term, and immediately followed up with T
929.
by motorest 1y ago
> Because canonical S-expressions don’t have numbers, just atoms (i.e., byte sequences) and lists. If types other than string and a list bother you, why don't you stick with those types in JSON?
930.
by motorest 1y ago
> I feel like not understanding why JSON won out is being intentionally obtuse. JSON can easily be hand written, edited, and read for most data. You are going way out of your way to try to come up with ways to rationalize why JSON was a

More ›