Flying Penguin

Okta has been plagued by security issues [1], never heard of Ping Identity, Azure only makes sense if you get a sweetheart deal and are willing to deal with Azure's crap, and I'd never recommend anyone to use anything Google any more. [1] https://www.flyingpenguin.com/?p=54722

I think there's an easy answer for Elon's motivation in particular: he wants to damage the US as revenge for ending South African apartheid (https://www.flyingpenguin.com/?p=65793).

They also crash way more often[1] and have disproportionally more deaths[2]. 1. https://www.forbes.com/sites/stevebanker/2023/12/18/tesla-has-the-high… 2. https://www.flyingpenguin.com/?p=35819

You can compare Tesla death rates per vehicule sold vs similar cars however: https://www.flyingpenguin.com/?p=35819

The developer responsible for breaking the integrity of this commonly used software package is known as Brandon Nozaki Miller. It is public information that he is the maintainer. I think we will have to wait for him to announce if he personally did this or was hacked. TURN OFF AUTO UPDATES FOR DEPENDENCIES. One good thing is that this bad actor will just bring more light to better practices for dependency management. https://www.flyingpenguin.com/?p=38727 Edit: you can read his responses here https://github.com/RIAEvangelist/node-ipc/issues/233

It's not so much that Copilot is a threat because it could produce tight, elegant code that handles all the edge cases and so on, but because employers still see coders as expensive keyboard jockeys whose code is not significantly better than what a Copilot user could cargo-cult into existence. Blaming Copilot feels a bit like the wrong target. Like the Luddites, the real question is the relationship between employer and employee, and how the presence of the machine empowers or endangers the worker. To put it another way. Suppose a perfect Copilot existed, that required a human to drive it but made that human a 10x developer. Do you think they would get paid 10x as much? Or would the worker stay where they were, perhaps under threat of replacement, and the employer take the spoils? https://www.flyingpenguin.com/?p=28925 Edit: to be clear, I am actually a big fan of Copilot for increasingly one's personal productivity, rather like a super-Google or a non-snarky-Stack Overflow. But I remain rather cynical about how those benefits might work in the new corporate environment.

No, not really. Mythos found 3 CVEs, not 271. https://www.flyingpenguin.com/mythos-mystery-in-mozilla-numbers-how-22…

Wow as far as you know? That settles it then! Just ignore this: https://www.flyingpenguin.com/wheres-ed-anthropic-told-court-5-billion…

Good but not necessarily better that was is already pay-as-you-go available today. ref. https://www.flyingpenguin.com/the-boy-that-cried-mythos-verification-i… This AISLE benchmark is interesting in this matter: https://aisle.com/blog/ai-cybersecurity-after-mythos-the-jagged-fronti… And the recently discovered Copy Fail by Xint code is another proof that the gating is overblown: https://xint.io/blog/copy-fail-linux-distributions

How about the boy who called nonsense security vulnerabilities. This is the same author who posts with incredulity that the ability to change a config file with a shell command in it gives you the ability to run the shell command you posted and wants it treated as some big CVE. Absolutely inconceivable that you might already have your harness in a sandbox where this is okay, and inconceivable that anyone might have a threat model that says that someone who can edit configuration of a tool can make that tool do arbitrary things allowed by its config. https://www.flyingpenguin.com/ox-security-report-anthropic-mcp-is-exec…