• Goldmaster@lemmy.ml
    link
    fedilink
    arrow-up
    5
    ·
    21 hours ago

    Ended up downloading a tampered installation of Homebrew, a tool that’s popular with software engineers, after clicking a malicious ad.

    So they didn’t even have uBlockOrigin installed. That’s the first mistake.

    • chronicledmonocle@lemmy.world
      link
      fedilink
      arrow-up
      18
      ·
      2 days ago

      Proton is a lost cause. Their leadership are Trump ball garglers. I was looking at an alternative to completely replace Google and ended up choosing someone else because of their bullshit.

  • searabbit@piefed.social
    link
    fedilink
    English
    arrow-up
    31
    ·
    2 days ago

    What I got from the article is that this company had minimal access controls and a very reactive security approach. Those employees should not have been able to download or execute random software or “assignments”. As we saw, even if they caught the first download after the fact and replaced the laptop, the damage was already done. This is again my problem with everyone adopting the “move fast and break things” mentality. Security starts to be seen as a hindrance that just slows developers down.

    • [deleted]@piefed.world
      link
      fedilink
      English
      arrow-up
      3
      ·
      2 days ago

      Yeah, that fits with the whole vibe coding concept where they don’t need to know what they are doing to vomit forth code.

    • bookmeat@fedinsfw.app
      link
      fedilink
      English
      arrow-up
      2
      ·
      2 days ago

      To me it just reads like multiple supply chain attacks on the client tooling side. It just happened to be developer tools that integrated with ML models. Where’s the vibe coding part?

  • Platypus@sh.itjust.works
    link
    fedilink
    English
    arrow-up
    18
    ·
    2 days ago

    Misleading title. The entry point for the attack was a spiked Homebrew install that the dev fell for. AI tools were in the exploit chain but it’s not like slop code opened some big dumb backdoor.

    • key95@lemmy.world
      link
      fedilink
      arrow-up
      1
      ·
      2 days ago

      But, mate, you can’t just crash and destroy a good circle-jerk. The kids were having so much fun talking out of their gas release valves