For the curious, this is technically possible in Rust using a dynamically sized type [1], but in practice is difficult and doesn't really play nice with the rest of the language. The nomicon entry concludes with "Yes, custom DSTs are a largely half-baked feature for now." [2]
Another fun failure mode in the same vein: if you are emulating an NVMe device and declare that a write operation is successful once bytes are in memory, you will quickly find yourself buffering arbitrarily large amounts of data as "persist to disk" (SSD speed) falls behind "acknowledge writes" (RAM speed). If you do not add backpressure to your system intentionally, it will be added for you – and you may not like where it's placed!
(This also happens at the SSD level: burst writes can be very fast as data is buffered in the SSD's own RAM, then performance steady-states at the true write speed once that's saturated)
UFS WriteBooster not only have a buffer that eventually need to be flushed, since it uses flash cells with pseudo-SLC behavior, the write amplification is even higher, to the point that they give it a special flag because using it all the time will just kill the media faster.
The repository names all look like two terms/words from dune (harkonen, mentat, ornithoptor, etc.) followed by a number. This would indicate that the account (possibly GitHub auth/actions token) has been compromised and then used to create the repository.
Why can't GitHub get on the case and just block any repo where the README matches the regex? I thought they'd have learned their lesson the last time it happened.
This malware isn't even trying. Then again it's Microsoft so they're not even trying either.
6 minutes later an HN submission "GitHub blocks your account if you mention X in the README" with a top comment "This is absurd, are they just doing regex matching to check for malware?"
That doesn't really explain why there is a bunch of GitHub repos created as well.
If I remember correctly from Shai-Hulud 2, the attacker extricated creds by posting them in public github repos with minor easily reversible encryption. I believe it was double b64 last time.
I'm assuming the logic there is that every security researcher and company is going to pull and scan those creds for their stuff and their clients' stuff. So the attacker is just 1 of N people downloading it. As opposed to trying to send it to their own machine directly.
I think it's more about convenience and bypassing filters - developers are already logged in to github, already have access to create repos and publish code, firewalls will allow it. Even fancy HIDS systems will think the git push is rather normal.
If they have a clue, the attacker still will not download that without using a botnet tunnel or Tor at a minimum.
Note though that these credentials aren't even encrypted using some lightweight ECC to prevent others from capturing them, they're posted in cleartext. Embarassment might be part of the point.
With HN ettiquette in mind, I must make an exception: this is a case where skimming the first parts of the article would help a lot!
The public repo path is just one of four parallel paths, with the goal of getting around any barriers:
The exfiltration component shares its design with the "Mini Shai-Hulud" mechanism from their last campaign, using four parallel channels so stolen data gets out even if individual paths are blocked.
The review is also heavily LLM-inflected, to the point of being distracting.
GPTZero gives it a 100% chance of being AI generated, and I've found that these tools may give false negatives from a well-prompted model, but false positives are rare.
If you are looking to tune your intuition for AI-written text, here's an interesting list of their quirks (ironically provided as a Claude skill for removing those quirks from emitted text):
According to that site, Robert Kennedy's speech on the night Martin Luther King was killed[1] was almost entirely the product of GenAI, as were both of Obama's inaugural addresses[1][2].
By this logic, I'd venture a guess that "AI" was also responsible for some of Shakespeare's most famous lines.
Almost certainly. Someone no-one has ever heard of before driving a hallucinating AI claims to have done what the world's best cryptographers have been unable to do. Just wait a day or two for the first crypto person who notices to pick the claim to pieces.
>Just wait a day or two for the first crypto person who notices to pick the claim to pieces.
we went to cryptographic experts first and published second, after they said it is a very good result and worth publishing. We've given a lot of help for reproducibility, the c and python programs encode the claims very precisely and anyone can verify the claims in ten minutes. The bottom line is that you wouldn't have seen this article if cryptographers hadn't seen these results first and liked them.
edited to clarify, thanks for pointing it out. It wouldn't be responsible for us to only publish when we got to the same stage for SHA-256, since at that point TLS and other certificates would be considered compromised.
[1] https://doc.rust-lang.org/reference/dynamically-sized-types....
[2] https://doc.rust-lang.org/nomicon/exotic-sizes.html