112 Followers
147 Following
278 Posts
Malware Analyst, Reverse Engineer, Software Developer, Mathematician, Teacher, Podcaster, send cat pics
Websitehttps://www.wallenborn.net
Podcasthttps://armchairinvestigators.de
Reversing Classeshttps://mal.re

Hacktoberfest only runs for a month, which seems like an arbitrary limitation given that the agents opening the pull requests don't ever sleep. Fixed that.

https://nesbitt.io/clawtoberfest/

Please Use AI

Be sure to use AI when making

The Courage to Live It

📦 Composer 2.10 is out today.

Native malware filtering, powered by an Aikido feed and enabled by default for everyone installing from Packagist. The new unified config.policy framework consolidates handling of malware, security advisories, and abandoned packages, and also lets organizations plug in their own custom policies.
Source fallback is now deprecated, and there's wildcard support in composer update --with.

https://blog.packagist.com/composer-2-10-release/

#php #phpc #composerphp

Composer 2.10 Release

We are excited to announce the release of Composer 2.10.0, introducing native malware filtering and consolidated future-proof customizable dependency policy configuration to control the handling of security advisories, abandoned packages, and now malware. Fast detection of malware for packages published on Packagist.org is provided by Aikido. This

Private Packagist
A new way to explore your node modules folder: https://nesbitt.io/heap

And here for some good news in the current software supply chain craziness: https://www.crowdstrike.com/en-us/blog/inside-crowdstrike-takedown-of-a-developer-targeting-botnet/ #glassworm

watch out for traffic to 164.92.88[.]210. If you see it you might have an infected host on your network (even though nothing bad will happen anymore, that host is a sinkhole).

Inside CrowdStrike’s Takedown of a Developer-Targeting Botnet

Learn how CrowdStrike’s Counter Adversary Operations team executed a coordinated takedown of the Glassworm botnet, which targeted software developers.

CrowdStrike.com
If only someone had thought to suggest cooldowns to vscode: https://github.com/microsoft/vscode/issues/272765
Minimum release age setting for extensions · Issue #272765 · microsoft/vscode

I could not find any existing issues requesting this functionality To decrease the risk of malicious extensions (like the recent GlassWorm attack), it would be great to have a setting that enforces...

GitHub
In order to go viral on Mastodon, your post should include at least one cat and some criticism of AI. So here is Binah disliking large language models.

For context:

We went from “cannot understand the difference between C and PHP” to “can sometimes write a valid function” to “works reasonably well to work on single files” to “can build a full greenfield app but needs extensive guidance on architecture and APIs” to “can build a full app with an engineer in the loop and build on top of it for a few weeks” to “decent at architecture and can build smaller systems without guidance” in 3 years.

But when I was trying to talk about labor issues and it being a paradigm shift for the industry at large, the standard response was that I was deluded and spreading FUD. The take that the tools are useless has been constant too, except the goal posts constantly move to whatever the current state of the art. Another take that never dies is that using llm based tools somehow can’t involve skill, that there is no difference between the prompting of an experienced software engineer who has spent years working with llms and the 3 prompts one has put into a random model “to try things out”. Imagine someone coming to like Elixir from Java, typing a few classes in Java, runs it and gets errors and say “elixir is kinda useless, all I got to run was this super barebones program after 17 tries and lots of compile errors”.

Whether one like using these tools or not (especially if you don’t like them), and especially if you are relatively new to them, spend just a few minutes or hours to compare how far you get with llama (the OG) and pure copy paste by hand, to a newer 8B model in an agent harness, to a model like glm5.1 to gpt5.5 or opus4.6 in a harness.

That’s the last 2 years in a bottle.

#llm #llms #genai #claude #vibecoding

I don't even know what is real anymore
Incident Report: CVE-2024-YIKES

A series of unfortunate events.

Andrew Nesbitt