demonsword comments on ‘The Worst Leak That I’ve Witnessed’: U.S. Cybersecurity Agency Leaves Its Digital Keys Out in Public on GitHub

[–] demonsword@lemmy.world 209 points 5 months ago* (last edited 5 months ago) (7 children)

vibe code go brrrrrrr

EDIT: wow it's far worse, it was a single contractor that decided that his convenience was above any and all security recommendations ever written. Pure. Genius!

permalink

fedilink

source

hideshow 7 child comments

[–] crusa187@lemmy.ml 45 points 5 months ago (1 child)

Only the best people

permalink

fedilink

source

parent

hideshow 1 child comment

[–] nymnympseudonym@piefed.social 7 points 5 months ago

You know what's ironic? FedRAMP rules dictate that Thou Must Scan Thy Repos for Secrets (tokens, passwords, etc)

GitHub, ButrBucket, etc all have this out of the box for enterprise customers

https://support.atlassian.com/bitbucket-data-center/kb/how-to-scan-for-and-remove-passwords-or-secrets-in-bitbucket-server-repositories/

permalink

fedilink

source

parent

[–] wonderingwanderer@sopuli.xyz 15 points 5 months ago

Contractor, eh?

How much do you wanna bet he has close personal ties to the trump family and zero cybersecurity experience?

permalink

fedilink

source

parent

[–] lIlIlIlIlIlIl@lemmy.world 70 points 5 months ago (3 children)

Leaving passwords in plaintext has zero to do with “vibe coding”

permalink

fedilink

source

parent

hideshow 3 child comments

[–] village604@adultswim.fan 80 points 5 months ago (1 child)

It definitely can if an LLM did it.

permalink

fedilink

source

parent

hideshow 1 child comment

[–] wucking_feardo@lemmy.world 7 points 5 months ago

I agree and to expand the same point. Even if the llm didn't do it, it's entirely plausible the LLM recommended it and the dev just drank that coolaid

permalink

fedilink

source

parent

[–] demonsword@lemmy.world 26 points 5 months ago

yeah, and this is why I edited my original post after reading the article.

permalink

fedilink

source

parent