Bilingual

Lean Software Scaling Laws
16 days ago
- Proposal to measure how coding LLM perplexity scales with codebase context size, using Lean as a test case for formal languages.
- Aim to estimate scaling laws of 'predictability' by programming language, translating to security and safety improvements in software.
- Lean may have worse baseline performance but better scaling exponents, suggesting long-term benefits for program correctness and cybersecurity.
- Methodology involves empirical measurement via frozen LLMs, corpus construction, loss measurement, and scaling law fitting per language.
- Prediction: 'Weak' languages like Python excel at small scales but have worse scaling exponents, while 'strong' languages like Lean cross over at larger scales.
- Bias controls needed for programmer and domain differences; context learning and failure modes like ecosystem maturity effects are considered.
North Korean Hackers Compromise Go and PHP Packages
13 days ago
- PolinRider is a DPRK-linked supply-chain campaign that takes over legitimate GitHub accounts and injects obfuscated JavaScript loaders into repositories.
- Initially confined to GitHub, the campaign expanded to multiple package ecosystems including Packagist, Go modules, npm, and PyPI without evolving its malware.
- Ecosystems like Go and Packagist are particularly vulnerable because they resolve packages directly from Git repos, making GitHub account takeovers equivalent to publishing access.
- The malware uses methods such as appending JavaScript to config files, fake .woff2 font files, .vscode/tasks.json triggers, and typosquatted npm dependencies.
- Payloads are distributed via blockchain dead-drops (e.g., TRON, Aptos) and lead to Lazarus toolkit implants like Beavertail and InvisibleFerret for credential theft and C2.
- Git history is rewritten using scripts like temp_auto_push.bat to hide tampering, preserving original timestamps through force-pushed commits.
- Defenders should audit registry publication history against repo modifications, enforce strong GitHub security (e.g., MFA), and scan for IOCs like hidden JavaScript and malicious tasks.json.
- While npm and PyPI are less susceptible due to separate publishing credentials, PolinRider still publishes malicious packages from scratch in those ecosystems.
Interstitial risk: when two secure systems make one vulnerable one
a day ago
- Interstitial vulnerabilities exist in the spaces between software components, which traditional scanning methods (SAST/DAST) and even LLMs often miss.
- These vulnerabilities arise when assumptions between components become misaligned, such as during rewrites or system splits, without any changes to the API on paper.
- Examples include type mismatches after a language rewrite (e.g., Python to Rust) and auth checks that vanish when a monolith is split, both leading to security gaps.
- Common patterns include timeout/retry drift, serialization mismatches, error-code remapping, and message-ordering assumptions, all locally correct but insecure in combination.
- Root causes include product evolution, lost tribal knowledge, team changes, and polyglot type system mismatches, exacerbated by organizational inertia and past approvals.
- Existing solutions like contract testing, threat modeling, CSPM, and pentests are insufficient as they don't continuously fuzz live contracts at seams.
- Mitigation involves explicit interface specs, adversarial contract testing for rewrites, boundary fuzzing, and clear ownership of contracts via RACI.
- AI-assisted rewrites worsen interstitial risks by increasing the speed and frequency of context-lost changes, making contract vigilance more critical.
- The author is developing a tool to detect these issues, highlighting the need for systematic, continuous monitoring of interstitial spaces.

Hasty Briefsbeta

#software security

Lean Software Scaling Laws

North Korean Hackers Compromise Go and PHP Packages

Interstitial risk: when two secure systems make one vulnerable one