The thing is, how do I know whether the Debian repo is free of them? Arch user repos? The node.js packages? My pip? The package managers I don’t really understand but had to use anyway? Code from my colleagues? My students? Vim plugins?
Every program can do ssh to my critical remote computer if they want to.
And now someone in the chain can land on the wrong github page suggested by Google, which itself is bent to its knees by ChatGPT.
Again, this existed before AI. Typo squatting, supply chain attacks, automated package uploads, CI pipeline infection, they’re all known attack vectors. That’s not to say this isn’t a concern, just that it’s a known risk and the addition of “AI” doesn’t, to my eyes, increase that risk. If your SSH keys don’t require a password, you have taken the decision to make those keys less secure but more convenient to use. That’s pretty much always the tradeoff in security.
The thing is, how do I know whether the Debian repo is free of them? Arch user repos? The node.js packages? My pip? The package managers I don’t really understand but had to use anyway? Code from my colleagues? My students? Vim plugins?
Every program can do ssh to my critical remote computer if they want to.
And now someone in the chain can land on the wrong github page suggested by Google, which itself is bent to its knees by ChatGPT.
Again, this existed before AI. Typo squatting, supply chain attacks, automated package uploads, CI pipeline infection, they’re all known attack vectors. That’s not to say this isn’t a concern, just that it’s a known risk and the addition of “AI” doesn’t, to my eyes, increase that risk. If your SSH keys don’t require a password, you have taken the decision to make those keys less secure but more convenient to use. That’s pretty much always the tradeoff in security.
I’m talking about the magnitude