Free and Open Source Software

22734 readers

85 users here now

If it's free and open source and it's also software, it can be discussed here. Subcommunity of Technology.

This community's icon was made by Aaron Schneider, under the CC-BY-NC-SA 4.0 license.

founded 3 years ago

MODERATORS

Gaywallet@beehaw.org

alyaza@beehaw.org

The fastest, smoothest way to transfer files to anyone, anywhere. Your files go straight from device to device - encrypted, with no accounts, tracking, ads, or cloud storage in between (dashbeam.net)

submitted 2 days ago by Dubois_arache@lemmy.blahaj.zone to c/foss@beehaw.org

37 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] spit_evil_olive_tips@beehaw.org 8 points 1 day ago

regardless of whatever else you think about AI, it's a good idea to be very wary about security-sensitive apps that are written using LLMs.

there's a self-hostable S3 replacement called RustFS, with development that leans heavily on LLMs.

they had a security vulnerabilty last year.

one LLM-written commit added a complete authentication bypass to the code. literally, you could just send rustfs rpc as the auth token instead of an actual token.

it was fixed in a pull request named fix: Prevent panic in GetMetrics gRPC handler on invalid input which claimed to fix a different auth problem and just coincidentally removed the hardcoded auth token.

security stuff is hard, and LLMs are prone to over-confidence. that's a bad combo.