←back to thread

Nx compromised: malware uses Claude code CLI to explore the filesystem

(semgrep.dev)
493 points neuroo | 1 comments | 27 Aug 25 12:18 UTC | HN request time: 0.221s | source
Show context
blibble ◴[27 Aug 25 14:23 UTC] No.45040148[source]▶
this company is something else

https://semgrep.dev/solutions/secure-vibe-coding/

if software development is turning into their demo:

   - does this code I've written have any vulnerabilities?
   - also what does the code do
then I'm switching careers to subsistence farming and waiting for the collapse
replies(3): >>45040419 #>>45040826 #>>45042170 #
falcor84 ◴[27 Aug 25 15:12 UTC] No.45040826[source]▶
With all due respect to subsistence farming, I would say that digital tech is already sufficiently "bootstrapped", such that even if the world's industrial base entirely collapses, and we don't have any more chips fabricated, the next century will still be about who can best utilize computers, scrounging up discarded phones and repurposing them to (re)automate farming, manufacturing and drone warfare. Even LLM-based AIs are already entrenched, and I'd expect people to be running ollama and aider/void on solar powered laptops in their tribe's half-destroyed buildings.
replies(1): >>45041063 #
vdupras ◴[27 Aug 25 15:30 UTC] No.45041063[source]▶
The amount of offline documentation required to do so is gargantuan. Try any kind of "repurposing" of any phone -- go for something trivial, not as hard as controlling an automated greenhouse circuit -- and try to do so without the internet -- or let's take the difficulty down a notch, without AI or search engines, wikipedia allowed. The operating system on that phone is likely way too complicated for you to succeed. It's also likely to be locked.
replies(3): >>45041233 #>>45042929 #>>45047099 #
1. sidewndr46 ◴[27 Aug 25 15:44 UTC] No.45041233[source]▶
It seems that few to no people understand just how unusual it is to buy an Intel or AMD64 based system and just boot it up. It's the exception in the industry, not the norm. Even the Raspberry Pi relies on the device tree, which is effectively a series of magic numbers for booting the board.

I worked at an enormous company that made embedded products. In the entire company, there were maybe ~12 engineers that knew how to boot up the various products. None of them were capable of booting all the devices. There was another team dedicated to preserving the knowledge they had because when one would retire they didn't even bother handing over all the knowledge. Only active product lines were transitioned to another employee. If a product line was brought back for a new contract and the bootloader was not already available, there were a huge number of man hours budgeted for that activity alone.