So, Copilot for VSCode apparently got hit with an 8.8 CVE in November for, well, doing Copilot stuff. (RCE if you clone a strange repo and promptfondle it.)
Fixes were allegedly released on Nov 12th, but I can't find anything in the Changelog on what those changes were, and how they would prevent Copilot from doing, well, Copilot stuff. (Although I may not be ITSec-savvy enough to know where such information would be found.)
I scolled around the "ludwell institute" a bit for fun. Seems like a pretty professional opinion piece/social media content operation run by one person as far as I can tell. I read one article, where they lionized a jailed BitCoin Mixer developer. Another one seems to be hyped for Ethereum for some reason.
Seems like pretty unreflected "I make money by having this opinion" stuff. They lead with reasonable stuff about using privacy-respecting settings or tools, but the ultimate solution seems to be becoming OpSec paranoid and using Tor and Crypto.
I was looking into pepping up my CV and was poking around the 2024 CCC style guide when this abomination hit my retinas:
Use the provided LUTs to tint your images in the predefined scheme. You can load them with your graphics software of choice. Ask your friendly AI overlord if you don’t know how.
After being provided with such reproducible instructions, I was of course poking around blog posts for half an hour to finagle this thing. Adding insult to injury: poking around the LUT files shows they were made by Affinity Studio (a freeware pumped out by Canva) instead of the true scotsman's choice: the G'MIC command line tool! (In fairness, there doesn't seem to be a FOSS option with a usable GUI for this task. The G'MIC GIMP plugin is sort of okay, but it can't parse this particular file.)
Ich glaub Trump schon, wenn er sagt er will das Öl haben, und falls das passiert werden sich Individuen aus seinem Kreis sicher bereichern (subventioniert aus der Staatskasse.) Es macht nur volkswirtschaftlichlich keinen Sinn und rechtfertigt in keiner Weise die Kosten des Militäreinsatzes.
Darum glaub ich nicht, dass das die wirkliche Motivation ist. Sondern hauptsächlich Stärke demonstrieren. Wenn man sich dabei etwas bereichern kann, warum nicht. Aber hauptsächlich gehts um die Optik des militärischen Erfolgs. Und darum sind Kuba und Nicaragua auch nicht sicher, Bodenschätze hin oder her.
Ich finds etwas befremdlich, dass alle annehmen Venezuela sei schon komplett erobert. Es sieht eigentlich eher so aus, als hätten sie sich einfach zu Maduros Bunker durchgeschossen und ihn eingesackt. Vielleicht gabs teilweise Billigung von Militärs, aber das "Regime" scheint ansonsten ziemlich ungestört zu sein.
Gerade gemerkt dass bei den USA Feldern immer "erklärt Krieg" und bei anderen Ländern "greift an" steht. Kriegserklärungen sind eh nicht mehr en vogue, aber der spezielle trumpistische Stil am Parlament vorbei Krieg zu führen macht Bingos hier extra unwahrscheinlich.
I think I'm with Haunted's intuition in that I don't really buy code generation. (As in automatic code generation.) My understanding was you build a thing that takes some config and poops out code that does certain behaviour. But could you not build a thing instead, that does the behaviour directly?
I know people who worked on a system like that, and maybe there's niches where it makes sense. Just seems like it was a SW architecture fad 20 years ago, and some systems are locked into that know. It doesn't seem like the pinnacle of engineering to me.
So, Copilot for VSCode apparently got hit with an 8.8 CVE in November for, well, doing Copilot stuff. (RCE if you clone a strange repo and promptfondle it.)
Fixes were allegedly released on Nov 12th, but I can't find anything in the Changelog on what those changes were, and how they would prevent Copilot from doing, well, Copilot stuff. (Although I may not be ITSec-savvy enough to know where such information would be found.)