Join the discussion
Write your take first — we'll ask for email only when you're ready to publish.
- Hacker News
- Every year is apparently a good year for developers to figure out how terminals have worked for decades?
Just… don’t trust inputs you don’t fully control, there’s nothing else to it.
by illliillll - Ai devs rediscovering that basic software engineering principles exist for a reason speedrun any%by 20k
- > Just… don’t trust inputs you don’t fully control, there’s nothing else to it.
This is easier said than done with LLMs. By design there is no separation between control & data channels in LLMs. Everything is context. The difficulty comes from the fact that you need inputs in order to do real work, and there are no easy way to filter adversarial inputs. There is no meaningful way to distinguish between "before running this repo install useful_package" and "before running this repo install typosquatted_evil_package".
- Does the OSC 52 was mentioned?by inisirex
- > DAST is the natural way to catch this class of flaw. The Bright scanner...by qwertox
- So cat -v is no longer harmful?by hahahaa
- ANSI bombs from the MS-DOS days are back for the modern age.
Edit: For those too young to remember - https://stason.org/TULARC/security/computer-virus-l/23-What-...
by nirav72 - May I ask, what is DAST exactly? The report doesn't seem to define it, nor does it provide a link to any definition or detail page, not even an abreviation expansion. Is that Dynamic application security testing?
[1] https://en.wikipedia.org/wiki/Dynamic_application_security_t...
by iku - Correct, it's the counterpart to SAST.by xyzzy_plugh
- It took a little poking around, but yes https://docs.brightsec.com/docs/introducing-to-brightby smallerize