this post was submitted on 07 Nov 2026
651 points (89.1% liked)

Technology

89639 readers
2604 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related news or articles.
  3. Be excellent to each other!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
  9. Check for duplicates before posting, duplicates may be removed
  10. Accounts 7 days and younger will have their posts automatically removed.

Approved Bots


founded 3 years ago
MODERATORS
top 50 comments
sorted by: hot top controversial new old
[–] LovableSidekick@lemmy.world 49 points 2 days ago* (last edited 2 days ago) (3 children)

TFA says this hack was mostly phishing and old-fashioned social engineering. I can't tell whether the author thinks Homebrew is "an AI tool" (it's not) or an unnamed AI tool was involved. It's not even made clear that the devs were actually vibe coding, let alone how it contributed to the success of the hack. Regardless of how you feel about AI, let's not abandon critical thinking.

[–] SchwertImStein@lemmy.dbzer0.com 1 points 1 day ago (1 children)
[–] LovableSidekick@lemmy.world 2 points 1 day ago (1 children)
[–] SchwertImStein@lemmy.dbzer0.com 1 points 13 hours ago (1 children)

I hate thst everything needs an acronim in this language

[–] LovableSidekick@lemmy.world 1 points 3 hours ago (1 children)

RTFA: "Read The Fucking Article"

based on RTFM: "Read The Fucking Manual" coined by tech support people at least 50 years ago.

[–] SchwertImStein@lemmy.dbzer0.com 1 points 3 hours ago (1 children)

Doesn't make it any less of an acronim

[–] LovableSidekick@lemmy.world 1 points 2 hours ago* (last edited 2 hours ago)

Wasn't arguing that, just trying to be helpful in case you might not have known what RTFA meant. I agree there's an overabundance of acronyms, and also new slang terms for complex ideas and situations. I'm sure at least some of the reason is to save keystrokes, but the downside is that it ingrains a habit of oversimplying everything, which deteriorates thinking skills.

[–] Jiral@lemmy.world 16 points 2 days ago* (last edited 2 days ago) (1 children)

Futurism_com is a lousy source. I think there is every reason to be critical of vibe coding but I hate it that this site is a source for so much stuff on Lemmy.

[–] GamingChairModel@lemmy.world 7 points 2 days ago

It's a trash source that gets a lot of traffic because its editorial lean is anti-AI and it summarizes other paywalled sources. I'm not a fan, even if I'm also anti-AI.

load more comments (1 replies)
[–] LiveLM@lemmy.zip 186 points 3 days ago* (last edited 3 days ago) (9 children)

Poor headline.

It began in June when an employee on Binance’s wallet developer team thought they’d indulge in some vibe coding by installing a popular AI coding tool. But they ended up downloading a tampered installation of Homebrew, a tool that’s popular with software engineers, after clicking a malicious ad.

There's lots of packages on Homebrew and it's a popular package manager, even outside of MacOS. He could have decided to grab anything from Homebrew and get hit.

The real one to blame here is Google for doing zero vetting on the crap they put at the top of the search results. Malicious ads for popular software happen constantly and so far they haven't moved an inch to fix it.

[–] magic_smoke@lemmy.blahaj.zone 57 points 3 days ago* (last edited 3 days ago) (3 children)

If you touch computers enough to install homebrew you shouldve touched computers enough to find the real download link, or at least install ublock.

[–] 3laws@lemmy.world 25 points 3 days ago (1 children)

100% user error.

If you work (as in LITERALLY GET PAID TO DO SO) back/front end, IT or devops there's absolutely no excuse to expose your digital self like an absolute fucking idiot not checking where the fuck are you & what the fuck are you running.

[–] explodicle@sh.itjust.works 9 points 3 days ago

And specifically for crypto, it's negligent to not put billions in a multisig wallet.

load more comments (2 replies)
[–] rbb36@lemmy.world 43 points 3 days ago* (last edited 3 days ago) (2 children)

futurism .com links often seem like clickbait for people who are skeptical of the broligarchy.

I'm all for covering that side of the story - we need a lot more resistance against the oligarchy. But clickbait is sleazy no matter what story it's pretending it can tell.

[–] Crankenstein@lemmy.world 19 points 3 days ago

Sleazy propaganda is sleazy propaganda even if it's in my favor.

[–] FlashMobOfOne@lemmy.world 12 points 3 days ago (2 children)

Yeah, Futurism's presentation is always overly dramatic and clickbaity. I end up learning more by clicking on the embedded links in the articles than the articles themselves.

load more comments (2 replies)
[–] redballooon@lemmy.world 29 points 3 days ago (2 children)

If you are developing software with financial impact, and every developer downloads their dependencies from the internet without further checks, you already have set up yourself for desaster.

If you would ask a LLM for how to guard yourself against malicious dependencies, this would be one of the first things they'd point out.

[–] SkunkWorkz@lemmy.world 22 points 3 days ago (2 children)

Also crazy how they are just allowed to “indulge” themselves with vibecoding on a machine that can access live production servers.

load more comments (2 replies)
load more comments (1 replies)
[–] CrimeIsLegalNow@ani.social 26 points 3 days ago (3 children)

The person to blame is the idiot clicking on ads for software downloads

[–] searabbit@piefed.social 24 points 3 days ago (2 children)

If we blamed every low level individual idiot who falls for malware, we'd be here all day and the malware would still be there. How about we blame the people pushing malware to millions of idiots? Also the companies who can't even employ the most basic cybersecurity best practices to protect their own assets. It's not like they were a small startup that can't afford to.

load more comments (2 replies)
[–] SkunkWorkz@lemmy.world 12 points 3 days ago* (last edited 3 days ago) (1 children)

Yeah but a secure system should have stopped them. And even if that first safety net failed another one should have stopped the hackers from accessing the client’s crypto accounts. Why does a software dev’s computer need access to the live accounts.

Also why can they just access any website? Shit should’ve been locked down. They should’ve only be able to access whitelisted websites.

load more comments (1 replies)
[–] LiveLM@lemmy.zip 11 points 3 days ago* (last edited 3 days ago) (1 children)

I'll still blame the corporation gaining god knows how much money with this over the individual person, even if I also think a Developer should have known better.

load more comments (1 replies)
[–] Duckwingthegoose@sh.itjust.works 18 points 3 days ago (4 children)

But who downloads homebrew from the web and not CLI?

[–] bitjunkie@lemmy.world 8 points 3 days ago (1 children)
load more comments (1 replies)
load more comments (3 replies)
[–] raspberriesareyummy@lemmy.world 20 points 3 days ago (1 children)

Bold of you to blame google, a malware company, for advertising malware.

load more comments (1 replies)
load more comments (3 replies)
[–] pmk@piefed.ca 224 points 3 days ago (5 children)

The headline makes it sound like vibecoding was the main part in this, but in the text they describe an elaborate social engineering scheme that compromised the laptop.

"The engineer was asked to complete and download an “assignment” that contained malicious code that instantly executed once the employee began installing it. Among the things it changed was replacing a real development tool with a malicious version that could communicate with the hackers and execute commands.

That all took place in September. Starting in October, the hacker used the compromised employee machine to leverage an internal AI tool and use it as a “springboard” to seize control of the computer and the computer of a third wallet developer. "

[–] jaykrown@lemmy.world 101 points 3 days ago (4 children)

They want to blame AI but realistically it comes down to human error. Cyber security is more about sociology than it is about technology.

[–] Fmstrat@lemmy.world 32 points 3 days ago (3 children)

An argument could be made that someone untrained (many vibe coders) shouldn't be in positions that would fall for this. A stretch, but still valid.

[–] Frozengyro@lemmy.world 30 points 3 days ago (1 children)

Just wait until a generation is raised on AI and never has to think hard or critically in their life. They will be so easily exploitable.

load more comments (1 replies)
load more comments (2 replies)
load more comments (3 replies)
[–] artyom@piefed.social 0 points 1 day ago* (last edited 1 day ago)

I am a self-described "AI hater" but as far as I can tell the headline is just a straight up lie.

Hackers gained access to and exploited an AI tool, which has nothing at all to do with vibecoding employees.

But maybe in misunderstanding something...

[–] victorz@lemmy.world 13 points 3 days ago

Thank you for that clarification.

load more comments (2 replies)
[–] VoodooAardvark@lemmy.zip 50 points 3 days ago (6 children)

He took a job interview on his work machine from a fake company that was actually the NK hacking group and was convinced to download the payload.

Beyond stupid to take an interview from your current employers machine.

[–] ChickenLadyLovesLife@lemmy.world 12 points 3 days ago (14 children)

I'm a school bus driver. Some of my coworkers recently tried putting tape over the on-bus cameras so they could get away with vaping and smoking and using their phones while driving. The stupidity required to think they could get away with this is mind-boggling. 1) They thought it would actually work in the sense that our bosses would not notice that the camera was not recording anything, and 2) they thought if it was detected that our bosses wouldn't know it was them that put the tape up. Turns out the cameras are recording even when the buses are turned off and the little red light isn't on.

I'm naturally opposed to the surveillance state, but I wouldn't want to be taking action on this principle just so I could fucking smoke and use my phone while driving a school bus. Amazingly, my coworkers got nothing but a warning for this, and then we all got a sternly-worded letter telling us not to fuck with the cameras.

[–] isleepinahammock@lemmy.blahaj.zone 6 points 3 days ago (3 children)

Frankly, I'm horrified at the idea of someone with so little self-preservation that they would turn off the security cameras in a school bus. The person that camera most helps is the bus driver.

I work as a substitute teacher, and frankly I WISH we had cameras in the classrooms. The horror stories I've heard? Kids are not above making false allegations against teachers they don't like. Hell, groups of them will collude to do so to bring down a teacher they don't like. Some kids a are just psychos. (Or more charitably, they simply haven't morally matured.)

I've been lucky to not have this happen to me, but sometimes kids will just straight-up lie to cover for their own bad behavior, or to get back at a teacher that dared to discipline them. With regular teachers, they usually have enough protections to require a formal investigation. But with substitutes? Often schools or districts will just fire a sub and not think twice of it, even when an allegation is completely ridiculous. It's easier to make the sub disappear than to thoroughly investigate a claim.

I WISH I had cameras in my classrooms. As a substitute, it would allow the teacher to directly see the kind of behavior their kids engage in while away, and to discipline the troublemakers accordingly. For regular teachers, it would both prevent false allegations and also prevent litigious parents of disruptive students from working the system. Plenty of parents think so little of teachers that they will believe a lying 6th grader over an adult, trained, and licensed teacher.

I wouldn't feel any lack of privacy as a teacher from having cameras right in the classroom. I already have to deal with many eyes on me all day long. I work every day knowing I have to be careful with what I say or how I act.

I can understand why the students wouldn't want cameras in the classroom. The bad kids don't want accountability and everyone wants a little privacy. But for the school employee? It's baffling to me why you wouldn't want your workplace recorded. One false accusation can ruin your entire career.

load more comments (3 replies)
load more comments (13 replies)
load more comments (5 replies)
[–] Psythik@lemmy.world 25 points 3 days ago (1 children)

That's what they get for not running the code though another AI and telling it to fix all the security flaws. /s

[–] Alaknar@sopuli.xyz 9 points 3 days ago

They forgot to add "make no mistakes" at the end of the prompt, noobs.

[–] moth@anarchist.nexus 15 points 3 days ago

this article makes it seem like Homebrew is something that only vibe coders use. in reality, Homebrew has thousands of projects on it that cover a very wide range of software. this is Futurism once again adopting a click-bait style that obscures the truth. they also tend to overly dramatize news in order to drum up clicks. looking at their site without an ad-blocker makes it obvious why they do this.

[–] flop_leash_973@lemmy.world 13 points 2 days ago (1 children)

Sounds like social engineering had a greater impact on this incident than vibe coding did.

load more comments (1 replies)
[–] Carnelian@lemmy.world 26 points 3 days ago (3 children)

Awesome story actually if you have a minute to read through. Sounds like it would be very technical but the details are easy to follow

load more comments (3 replies)
[–] Diplomjodler3@lemmy.world 19 points 3 days ago (1 children)

Getting socially engineered with AI slop and then downloading some random shit on your work machine is just humongously stupid. I wouldn't want to be in the skin of that engineer right now

[–] 00000@reddthat.com 29 points 3 days ago (7 children)

Dude should never be allowed to touch a computer again. How do these people get hired? He Googled "homebrew," clicked a fucking ad, landed at the page in the screenshot, then ran that insanely obviously suspicious terminal command to "install" it. Are you joking.

[–] P1nkman@lemmy.world 12 points 3 days ago

What the fuck? I did that when i was like 13. If someone wrote this as a story, no one would believe it, because its too stupid, but fucking hell, reality is dumber than fiction.

load more comments (6 replies)
[–] corvide077@lemmy.zip 7 points 3 days ago

Everyone saying what a stupid obvious mistake it is assumes 1. There has ever been a fishing test where you can successfully get everyone in the company to not click the link that says “DONT CLICK THIS LINK” 2. Any dev that’s graduated since 2022 has had any proper training on package vetting/security hygiene/anything basic at all. The degree is now “just try to get the vibe code to compile.”

Yes it’s a stupid obvious mistake. Welcome to the modern world.

[–] xylogx@lemmy.world 15 points 3 days ago (3 children)

How is it that wallet developers had access to customers crypto? This seems like bad security and a breach of trust.

load more comments (3 replies)
load more comments
view more: next ›