daniel:// stenberg://
kidney
- 7 Followers
- 90 Following
- 193 Posts
Kenn WhiteIncredible research at BlackHat Asia today by Tong Liu and team from the Institute of Information Engineering, Chinese Academy of Sciences (在iie.ac.cn 的电子邮件经过验证)
A dozen+ RCEs on popular LLM framework libraries like LangChain and LlamaIndex - used in lots of chat-assisted apps including GitHub. These guys got a reverse shell in two prompts, and even managed to exploit SetUID for full root on the underlying VM!
LiamIf you give money to a #FOSS project #OpenSource, unless it was some special signed agreement, you don’t get to tell them how they use it. It’s now their money.
For some it’s a hobby, for some it is their job, but either way it’s their time and that does cost money. We all gotta eat and live and pay bills.
If you’re gonna get mad, don’t donate. If you want something specific: do it via a proper signed agreement where you’re basically contracting them. Otherwise, shhh.
hannoGiven that I see calls for better support for those random opensource devs that happen to maintain some of the most important pieces of software on the planet: a good friend of mine is maintaining expat - possibly the most important+popular xml library out there - and he has a message in his latest changelog that you may want to read: https://github.com/libexpat/libexpat/blob/R_2_6_2/expat/Changes
AndresFreundTecI accidentally found a security issue while benchmarking postgres changes.
If you run debian testing, unstable or some other more "bleeding edge" distribution, I strongly recommend upgrading ASAP.
try "curl pkmn.li"
(via @glow )
The I in LLM stands for intelligence
On how people now use AI to submit security reports on #curl.
https://daniel.haxx.se/blog/2024/01/02/the-i-in-llm-stands-for-intelligence/
The I in LLM stands for intelligence
I have held back on writing anything about AI or how we (not) use AI for development in the curl factory. Now I can't hold back anymore. Let me show you the most significant effect of AI on curl as of today - with examples. Bug Bounty Having a bug bounty means that we offer … Continue reading The I in LLM stands for intelligence →
"Buffer Overflow Vulnerability in WebSocket Handling".
A bot? An AI? Just a silly reporter? Another fine waste of #curl maintainer time.
curl disclosed on HackerOne: Buffer Overflow Vulnerability in...
## Summary: Hello security team, Hope you are doing well :) I would like to report a potential security vulnerability in the WebSocket handling code of the curl library. The issue is related to the usage of the `strcpy` function, which can lead to a buffer overflow if the length of the input is not properly checked. The vulnerable code snippet is located at [this...
This tireless "fan" of mine does not give up easily, even though his comments never actually get displayed on my blog...
