kannthu

I don't have the exact number for you, but what I observed was that it took a couple of hours for npm to remove some of the packages this week, even though an advisory was published

+ To be clear, this tool does not solve the problem if you are one of the first people to get infected; it minimizes your chance if you are the N-th person

Hey, I am the author of this post. Ask me anything.

The author of this analysis used ^ prompt and fed it to OSS LLMs. The question itself contains the answer. The prompt contains all the facts and insights the model needs to identify the issue. It removes the burden of finding those insights within the 4k+ lines of code in the original vulnerable file.

So the claim that OSS models can find those zero-day issues was a lie.

I have been saying this since last year, we crossed certian treshhold and not everyone realized it yet.

True, fortunately we learned how to filter those types of resumes and candidates. (we got quite good at that)

We are still a fully remote company, but we added an additional on-site stage to verify if the people are legit. So I would say that the jobs are not over, but hiring just got way more expensive.

Yup, this happened to me. Ask me anything.

Thank you so much, sharing is caring!:)

Clickable links:

- https://news.ycombinator.com/item?id=40460084

- https://github.com/dj-stripe/dj-stripe

- https://gist.githubusercontent.com/kannthu/6e1bdd2781d2e0a6d...

No mods. Anarchy.

Oh, I did not know about that, good idea!

I see writing posts and commenting as two separate ways of contributing. These are 2 different styles.

I prefer writing high-quality content (posts) instead of commenting. It is not in my nature to write comments (and this style of contributing).

It does not mean that I am not putting high effort into writing posts - quite the opposite. When I write long content I put all my heart into it and many hours.

What I mean is that I would love to meaningfully contribute and gain karma by doing "content" the way I like and prefer and not being forced to comment.

Email me at dawid{at}vidocsecurity.com - we can talk about it more

Not really, sourcegraph is the end product - what I am talking about is giving you API to create products similar to sourcegraph.

It is implemented, but it's embedded in the product at https://vidocsecurity.com/. I was thinking about extracting that part and creating a standalone API for it

Not at this time, I only thought about releasing it as an API for companies to use within their own products (my API would only return JSON file with all of the nodes and edges from graph)

You are right with the self-hosted version

One of our constraints was that the context fetching had to be accurate as the whole validation process depended on it.

For context:

I am a co-founder of https://vidocsecurity.com/ - one of our main features is validating security issues. To validate the security issue you need to find relevant context - let's say we detected a potential security issue in file "test.ts" in function "doStuff". We would need to find what other functions in the repository reference this function and do it recursively to build a call tree. Then we use LLM to validate each branch of the tree to understand if the issue could be exploitable.

It took me a couple of months to solve the context fetching and I managed to solve it in a way that is really easily extendable to other languages. At this moment we support Typescript, JS, Python, Go, Ruby, and Rust. I can add many more languages.

I talked with other founders and understood that what I built might be valuable to other companies as they rely on supporting as many languages as possible. This post is my attempt to understand if it is a real problem or if I just imagined it myself.

To clarify - it does not mean you shouldn’t build something similar if you can do it better

There already exists https://www.builder.io/

XSS in Swagger-UI - many people waited for this writeup so here you are. Your company is probably vulnerable too. We found it in so many places - in big corpo, government websites, it is everywhere.