I agree, not a huge difference here. They eyes and ... hat? on high are out of place so I'd argue that's the worst one, but it takes xhigh before we get legs and bike ordering correct.
It's less than OpenAI did for Astra, but that was my first encounter opening it and my first thought was that they decided they liked Astra's hero/scrolling animation. I'm pleased to see they didn't make the entire page that like OpenAI did, but I'm expecting to encounter this pattern more often on these announcements now.
"Oh, usually my bank just logs me in, that's strange. Let me just go grab my username and password and type it into this site that looks like my bank."
Same thing is going to happen with passkeys for non-technical users for exactly the same reason you stated. People will think the integration is busted and manually copy/paste the non-passkey credentials in. In that way, I would argue that passkey is not stronger protection against phishing attacks unless its the only way to login. It is, at best, a convenience for users.
If the user just has a username/password fallback and that's it, then yes, but the aim of passkeys is that won't be the norm, rather users will only have passkeys and the fallback would be to, e.g: magic link email log in where the phishing attack is still broken. I've seen some sites explicitly disallow plain username/password login after you enable passkeys for this reason (you can still put them in, but then it just does a magic link flow afterwards as a second factor).
I've been told by multiple people that the recovery method of passkeys is to enter your username/password. If passwords are eliminated, your final recourse is fucked.
Why would it be that is the only recovery method? The most convenient one is just more passkeys on other devices of course, but you can have any other recovery methods you want. Magic link emails are the most common, but there is nothing about passkeys stopping you from implementing anything you want.
Which is a laudible goal, but something that makes "oh just fall back to the standard insecure recovery process" not a very good response to the concerns about users being able to actually hold on to their passkeys easily and reliably.
I've been seeing links to it for the past hour+, and I did catch it live when this post came up, but is now once again a 404 and this post is flagged. Several other outlets are reporting on its release. Clearly we're getting a new GPT today, the question is when are they going to commit to the announcement.
Ever since they made auto-mode default I swear claude has tuned to use python commands instead of the Edit Tool to frustrate the ~security conscience~ luddites into using auto-mode.
Yeah, It’s in the system prompt, Claude will tell you if you ask why it’s using Python.
My theory is that Anthropic is just a vibe-coding company. Their goal is to capture the attention of white-collar non-coders, since programmers will jump ship fast to another model.
> Every CVE thus has this huge cost tied to it. A cost that does not land on us and we don’t really see or feel it, but a cost on the ecosystem I believe we should not ignore.
I really appreciate this attitude towards this because it recognizes that there are a lot of security teams out there that don't take a nuance view of CVEs. For instance, one time we had a security team that required us to patch a vmware support package that was installed by default on ubuntu, but the CVE required being ran on vmware when we were running on EC2. Arguing with them was pointless because they were not interested in determining if the CVE applied to us, only that it needed fixed.
Lots of teams that are supposed to be in charge of security don't ask "does this CVE affect us", but simply shift the burden of patching downward and outward. In some cases, like in the case of easy to update and centrally deploy SaaS products, that burden is more annoying and frustrating than difficult. In some cases, like when you have complicated deploy or have customer-controlled updates, those mandates cause a huge burden on teams not producing the decision to patch every low CVE.
Yes, I’ve also experienced this kind of attitude. Some scanning tools can detect that certain CVEs do not apply because the specific functionality is not used.
I hope your team was OK with you uninstalling the VMware package manually (this is actually not a bad outcome if you don’t use that package)
There are also ridiculous CVEs like CVE-2018-20225 for pip, which will not get fixed as that behaviour is by design (but here as well it might be a good idea to strip pip if it’s not used)
> An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index.
To be fair this behavior + extra-index-url definitely allowed for dependency confusion attacks. Now it's a bit silly for the CVE as written, but IIRC this was before you could use index-url to point exclusively to an internal package host so there were (and in other ecosystems still are) dependency confusion attacks going on in the wild where attackers are publishing "internal-package-a@999.9.9" on any public package host (NPM, PyPi, etc) to try to compromise companies that have internal packages of the same name.
For the attack you mentioned (reusing internal packages in a public repository) prefix reservation is one possible solution. Unfortunately PyPI does not support it.
I don't understand what's ridiculous about that pip CVE, could you explain? Just because something is by design that doesn't mean it's not a vulnerability or somehow unexploitable.
Maybe I was too harsh. It’s the CVE in conjunction with its high severity, the maintainers’ decision and the bundling of pip with CPython. In the end what can you do about it as a dev given that the pip maintainers have decided not to fix it? The only option is not to use pip at all (and sure, you can see the CVE as a critique of pip in a way), or discuss with your security team in hope for some exclusion. And since pip or at least ensurepip are part of Python you get a lot of these scan results
E: and if you decide not to use pip I don’t think there’s an official way to remove ensurepip, I typically rm -rf inside of site-packages, it works but doesn’t feel correct
The CVE looks relevant to me. If you're trying to get a package from a private repo, and someone publishes version 999 of that package on a public repo, then you're executing their code instead of your own. Just because the pip maintainers refuse to fix it doesn't mean it isn't a security vulnerability that could lead to remote code execution and needs to be controlled for in some other way.
One could argue that this is not an issue with pip, the software, but of the index used. I mean, if you control both index and extra-index there is no problem (and one solution to this is to use your own mirror with a set resolution order). This could very well be addressed in PyPI, for example NuGet allows to reserve package prefixes.
We also do not create a CVE for curl because you can use it to download the wrong bash script. If this was an alert for suspicious usages of pip instead of pip itself, I’d be less critical of it.
One could argue that, certainly, but I think it's a little disingenuous. Pip makes it impossible to use extra-index-url safely, in the ~only use-case that option has. There is no world where you use extra-index-url and you're not vulnerable in some way or another to dependency confusion.
Our internal "security team" actually put gcc (yes, that gcc) on the banned software list. It was overturned in short order when the entire engineering org suddenly wasn't allowed to compile software. Luckily I don't have to deal with that team directly, but it definitely means I have zero respect for that entire team and anything they have to say.
> I really appreciate this attitude towards this because it recognizes that there are a lot of security teams out there that don't take a nuance view of CVEs
This is true, but also: needless CVEs place a burden even on security teams who do take a nuanced view of CVEs - it requires some amount of effort to evaluate every CVE and determine whether it's applicable or not.
In many (most?) companies it also takes nontrivial amount of time to patch potentially affected systems. In my company half IT department got recently an email that we need to urgently patch all Windows servers because of some critical CVE. I checked it. The description was maybe 3 lines and it said this affected domain controllers only. I raised this with security team and they said that in this case we don't need to patch everything. Now if we had to do this, it would force us to spend nontrivial time on unplanned patching. That this in itself disorganizes our operations can not be ignored. So comparatively me doing some legwork and checking the CVE was trivial effort and saved a lot of busywork for the department as a whole. That time we got lucky.
If something is hard do it more often so you get good at it.
While this time you avoided something, it sounds like you need to figure out your patching process ASAP. There is every reason to believe a major issue will affect everything in the near future.
Absolutely. I was focused on the burden CVEs place on everyone downstream of teams that don't take a nuance view, but even when teams do look at all the CVEs reported in scans, the proliferation of CVEs just adds workload to determine if they are affected. Unless teams say they will not look at lows (or lower-than-lows if the category existed) then what amounts to busy-work just piles up.
There's an upcoming talk at the OpenSSL conference next month on the cost of bogus CVEs to open-source projects that covers similar ground. It also lists some particularly ridiculous CVEs that, despite being jawdroppingly stupid, still need to be responded to by project maintainers who really have better things to do with their lives.
> Lots of teams that are supposed to be in charge of security don't ask "does this CVE affect us", but simply shift the burden of patching downward and outward
Unfortunately, I've had many a frustrating session with compliance auditors who do not care that it couldn't affect you, you're required to meet the PCI-DSS deadlines of 90 days for low, etc, and I've seen security groups force to accept that this is what they have to do, and then get the unfortunate task of dealing with engineers pissed off that them for forcing them to what security is being forced to do. Everyone's a whole big bundle of happy joy joy, all because of some stupid auditor following a stupid (but well intentioned) checklist.
At least it's got slightly less bad recently, it used to be 30 days critical, 90 days everything else, now you're required to perform a targeted risk analysis but it's still a lot of work to do.
The problem of CVE inflation is not just that you might be forced to patch a CVE that is not applicable to your product. Even investigating to understand whether a CVE is applicable or not takes time, and is simply not worth it for obscure issues like the one in this bug.
Even if the CVE doesn't currently apply to you, how can you be sure? Is the CVE in code that only runs on vmware; or does the code also run on EC2 - it will just be a few more weeks before someone figures out how to exploit it there.
Which is why the default answer for everybody should be fix the CVE. You should only ask "does this CVE affect us" in the case where the fix in some way is a negative to you.
Of course one downside might be risks of upgrading and so if you determine this affects us it means you would risk updating with less verification even though the update might break something else. If the issues doesn't affect you a longer process to verify nothing breaks is safe.
This becomes fun if you start to prioritize security work on CVEs rated higher, not affecting you, over security work on CVEs rated lower and affecting you.
Or prioritizing chasing CVEs currently not affecting you over architectural work improving security.
The CVE should be fixed, I fully agree, but where does it land as a priority? Less competent security teams push /all/ CVEs as Sev0 over /all/ other topics.
I don't have a good answer to this problem. The reality is security is becoming very important - for good reasons. If you (as an organization) are spending all your time chasing CVEs instead of the other useful things (such as what you named) you have a problem, but not fixing CVEs right away is a terrible answer. There is some hope that LLMs have found most of the existing issues and things will settled down - but only time will tell if this becomes true or not.
Unfortunately, while cybersecurity is a real thing with real concerns and there are some amount of highly competent people, it's mostly, as a field, full of box-checkers and grifters. That lack of nuance or even attempt to understand if you are affected by a CVE or have other mitigations is unfortunately par for the course, even though its far below basic expectations.
As someone who has to respond for this kind of stuff at work, I am regularly in a situation where I am pushing back on a CVE, or telling them that our product neither uses nor installs that package (or its for a different OS entirely).
Our product is run in a moated environment, most systems have the same username and passwords (customers never change the defaults), so I only really care about RCE's even if it is an effected package.
> most systems have the same username and passwords (customers never change the defaults)
That is horrifying and 100% on your dev team. You should not ship default credentials, instead require unique creds to be set at install. Ship an update which required default creds to be changed.
Our flagship product is not a SaaS, customers install it in their own cloud environments, and as a result, they scan us with Wiz, Prisma, basically anything that supports agentless scanning, and then send us reports demanding answers and remediations.
Half the time, they're running versions that are over a year old. Sometimes, the version they're running is 3 years old and end-of-support. Then tell us they don't want to upgrade. It's the dog-wanting-the-frisbee meme, except it's "Patch CVEs? NO UPGRADE! ONLY PATCH CVEs!"
And every time there's a new CVE with its own web page, logo, and TikTok dance, we get dozens of tickets from customers asking if we're affected and what the workaround is. Like, yeah, I get that an easy-to-exploit LPE like DirtyFrag seems scary, but the system has SSH disabled on production deployments. If an attacker has shell, you've already lost.
Terrapin was especially infuriating. Customers were acting like it was an authentication bypass.
About 8 years ago, we used mturk for reading data out of public PDFs generated by a huge range of producers. I am not sure that LLMs would have been able to consistently extract this data until recently as a good number of these PDFs were scans, sometimes a scan of scan.
We had pretty good luck in the end, but getting there produced a somewhat large app on our side that would manage the whole process, including but not limited to asking for multiple responses, comparing them to each other, finding consensus, and determining which users would consistently produce bad responses and stop them from responding. We got to a confidence that about 85-95% of the data was correct, which was good enough for the company.
Through that process, I learned a couple things about managing mturk, primarily about how changes to the cost-per-task would change the process. Initially, we thought that price would be a quality knob, but quickly learned that price was a speed know. The higher the price the faster the tasks would be taken and completed. Quality did not change significantly as the price went up or down.
Overall, I still have fondness to mturk, but it was really bare-bones experience that needed a lot of work to get working effectively.
I've yet to understand why they call a 190 page PDF a "card". Calling something a card invokes a small, quick rundown of pertinent details, not every single possible detail.
Because "model card" is a set phrase, it's a concept. It originates from a time when they were shorter. Like datasheets, even if it's not literally a sheet.
They could say "tech report" but model card makes it clear that it's a specific kind of tech report.
I think 'model card' should be a 1 page summary of key info. The report format should be something like a 'model data sheet' (like safety data sheets that you get with chemicals). 98% of people would only want to know the key info, not read a whole report.
Co-worker and I were speculating that a) They'd extend the preview period when OpenAI announced Sol (which they did, maybe not because of Sol though) and b) That once the preview period it was going to get included by default on plans in a couple weeks so they could gauge usage of it being included versus having to pay for it all the time. Noticed that Fable was included when I launched claude code this morning, so I'm guessing they have all the data they needed to make a decision.
reply