reddit: the front page of the internet

Reddit gives you the best of the internet in one place. Get a constantly updating feed of breaking news, fun stories, pics, memes, and videos just for you. Passionate about something niche? Reddit has thousands of vibrant communities with people that share your interests. Alternatively, find out what’s trending across all of Reddit on r/popular. Reddit is also anonymous so you can be yourself, with your Reddit profile and persona disconnected from your real-world identity.

Forum SF-Informatique -

PieFed ~v1.6.27

セキュリティ更新です 早めに上げる必要がありそうです(詳細不明)

PSA: open source security considerations in the era of LLMs - Lemmy

I was thinking a bit about the bugs I found in the Piefed codebase yesterday. And these led to an emergency fix by the dev that’s now been implemented. https://codeberg.org/rimu/pyfedi/commit/093a466935849f27b3ecf2eab159129186320417 [https://codeberg.org/rimu/pyfedi/commit/093a466935849f27b3ecf2eab159129186320417] And what the real takeaway for me here is that the whole dynamic of how we approach security has now changed in ways most people don’t appreciate. It used to take a lot of effort to find exploits in software projects because you’d have to spend a long time to familiarize yourself with the codebase, then comb through the code looking for mistakes that could be exploited. And to even do that, you’d need a good understanding of the protocols and specifications used by the application. You basically had to be a domain expert with a deep understanding of how the application works. A random person looking at the source code would have little chance of finding any non trivial problems or figuring out how to actually exploit them. And in that world, doing a private disclosure made a lot of sense because you did a lot of hard work to find it, and it wasn’t easy for somebody to replicate. This was valuable and dangerous knowledge that had to be communicated in a responsible fashion. But now, anybody can throw an LLM at the code and it’ll sniff out vulnerabilities and even explain step by step how to exploit these security holes. So, the information itself isn’t really that valuable anymore. If I can throw an LLM at the code and find these problems in a few minutes, anybody else can do the same thing too. I’m not a Python developer, I don’t have any deep knowledge of the Python stack used in Piefed, and on my own, I’d have zero chance of finding these exploits. But once the LLM identifies them, it’s very easy for me to verify that they are indeed real exploits, and to realize how they can be used maliciously. The attacker doesn’t even need to have any deep knowledge of programming because the LLM can guide them through the exploit step by step. Open source projects are particularly vulnerable here since anybody can just grab the source and throw an LLM at it to see if it can find exploits. I’d argue that raising awareness that this is now the state of things is really important, and I would suggest that running an LLM against the code is minimal due diligence at this point. Obviously, the LLM vulnerability check is not exhaustive, and if it doesn’t find anything that doesn’t mean there aren’t exploits in the code. But anything it does find should absolutely be checked by the developers. People should be aware that we’re now living in the world where the bar for finding vulnerabilities is far lower than it used to be. And that means security must be taken far more seriously.

Piefed, Peachpie, disclosed vulnerabilities, forks, and thoughts

Hey y'all, The tl;dr: - LLMs found vulnerabilities on Pyfedi, published them, and caused a federation-wide security issue - I run a fo…

PSA: There might be some federation issues today and tomorrow following the Piefed security fixes - Lemmy.zip

https://lemmy.zip/post/64401927 [https://lemmy.zip/post/64401927] for some context and why Piefed instances had to go down for a bit. I’ve noticed a few comments not getting federated properly, e.g. - https://quokk.au/post/915720#comment_4492357 [https://quokk.au/post/915720#comment_4492357] - https://piefed.social/post/2063881#comment_11352486 [https://piefed.social/post/2063881#comment_11352486] - https://sopuli.xyz/comment/23543808 [https://sopuli.xyz/comment/23543808] This should probably be solved over the weekend, I’ll personally wait until Monday to resume posting. Take care everyone!

PieFed v1.6.23 ~ v1.6.25

##v1.6.25 - セキュリティFix ##v1.6.24 - 新テーマ2つ - 画像タイプのクロスポストができるように - iOS周りのボタン修正 ##v1.6.23 - モデレーション周りの修正 - Mastodonと似たミュート機能 - 1ページあたりの投稿…