It began in June when an employee on Binance’s wallet developer team thought they’d indulge in some vibe coding by installing a popular AI coding tool. But they ended up downloading a tampered installation of Homebrew, a tool that’s popular with software engineers, after clicking a malicious ad.
There’s lots of packages on Homebrew and it’s a popular package manager, even outside of MacOS. He could have decided to grab anything from Homebrew and get hit.
The real one to blame here is Google for doing zero vetting on the crap they put at the top of the search results. Malicious ads for popular software happen constantly and so far they haven’t moved an inch to fix it.
If you are developing software with financial impact, and every developer downloads their dependencies from the internet without further checks, you already have set up yourself for desaster.
If you would ask a LLM for how to guard yourself against malicious dependencies, this would be one of the first things they’d point out.
I’m all for covering that side of the story - we need a lot more resistance against the oligarchy. But clickbait is sleazy no matter what story it’s pretending it can tell.
Yeah, Futurism’s presentation is always overly dramatic and clickbaity. I end up learning more by clicking on the embedded links in the articles than the articles themselves.
Poor headline.
There’s lots of packages on Homebrew and it’s a popular package manager, even outside of MacOS. He could have decided to grab anything from Homebrew and get hit.
The real one to blame here is Google for doing zero vetting on the crap they put at the top of the search results. Malicious ads for popular software happen constantly and so far they haven’t moved an inch to fix it.
Yea, futurism.com is a shitty rag that will say anything for money.
But who downloads homebrew from the web and not CLI?
Vibe coders
Thats precisely my point, yeah. Or some PM who thinks they’re a Dev now
Thats something I would absolutely do years ago before I got more familiar with cli and not as afraid of a terminal shell
Are you a Dev though?
If you are developing software with financial impact, and every developer downloads their dependencies from the internet without further checks, you already have set up yourself for desaster.
If you would ask a LLM for how to guard yourself against malicious dependencies, this would be one of the first things they’d point out.
Also crazy how they are just allowed to “indulge” themselves with vibecoding on a machine that can access live production servers.
If you don’t know enough to write the code yourself, you likely also don’t know enough to ask the right questions
futurism .com links often seem like clickbait for people who are skeptical of the broligarchy.
I’m all for covering that side of the story - we need a lot more resistance against the oligarchy. But clickbait is sleazy no matter what story it’s pretending it can tell.
Sleazy propaganda is sleazy propaganda even if it’s in my favor.
Yeah, Futurism’s presentation is always overly dramatic and clickbaity. I end up learning more by clicking on the embedded links in the articles than the articles themselves.
And that’s why it’s always best to post the original source, not a repost with a warped headline.
TBH, if this gets worse, I’d like for /c/technology to enforce that as a rule.
Bold of you to blame google, a malware company, for advertising malware.
Their specialty is mass surveillance and monetizing the results of it, so it’s a bit unfair to expect them to be competent in other domains.
I’ve noticed Futurism has a ton of clickbait headlines.
I should really switch to Piefed so I can block it as a source…
Google purposely malware advertise. They know these sites are malware.