• 3 Posts
  • 17 Comments
Joined 1 year ago
cake
Cake day: June 14th, 2023

help-circle



  • Not quite. Their “malicious” extension only got a few hundred installs. Using the data gathered by that extension and via other means they were able to locate other actually malicious extensions. Those total in the millions of installations.

    Through this process, they have found the following:

    1,283 with known malicious code (229 million installs).
    8,161 communicating with hardcoded IP addresses.
    1,452 running unknown executables.
    2,304 that are using another publisher's Github repo, indicating they are a copycat.
    





  • Well, the problem is you don’t know what you don’t know. One of the first example tasks in the paper was regarding implementing a symmetric cipher. Using a weak cipher was recommended by AI tools sometimes, these developers didn’t know that some ciphers were weak. Additionally, even when the AI tool recommended a strong cipher, such as AES, it generated code that screwed up an implementation detail (failing to return the authentication tag), making the result insecure. And the user didn’t know it was wrong because they didn’t know it was incomplete.

    There’s no substitution for domain specific knowledge. Users who were forced to use traditional tools got the answer correct significantly more often because they had to read, process, and understand the documentation for the libraries, which meant they understood why the symmetric cipher was the way it is, and what additional information needed to be reported and why.













  • Even if it seems to be common sense to those inside the community, there is something to be said about getting actual data on the subject so that those outside the community at least have a touchstone for the reality those on the inside experience, because propagandists are working very hard to muddy the waters on this point and points like this one in particular. It might be a “no shit Sherlock” moment to you, but to people like my Fox News watching extended family, this study is something that contradicts their current mental model of the situation, and something that I am glad I have in my quiver when they start talking about the subject to me.