News for hackers. Stuff that matters.
Re:Humble Bundle just killed most of their security through ... by trvz on Thursday November 12, 2026 @03:34AM (#50464542)
This is not AI's fault. In fact, they had to probably fight the LLM to get it this simple.

I'm a subscriber to Humble Bundle Choice (their monthly offering), and it has been a pain to receive a code via email at every login.

Re:Humble Bundle just killed most of their security through ... by geraneum on Thursday November 12, 2026 @03:40AM (#50464580)
It’s the person’s fault who says you don’t need to review/read/understand the code. “2fa? that’s just gobbledygook”.

I doubt you have to fight anything to get there.

Re:Humble Bundle just killed most of their security through ... by forgetfreeman on Thursday November 12, 2026 @03:55AM (#50464700)
Nah. Pre-AI you'd never make it deep enough into a project to actually ship with this level of incompetence.
Re:Humble Bundle just killed most of their security through ... by geraneum on Thursday November 12, 2026 @04:05AM (#50464767)
Then you’d be surprised what the hype is doing to people.
Re:Humble Bundle just killed most of their security through ... by UqWBcuFx6NV4r on Thursday November 12, 2026 @04:20AM (#50464888)
This just simply isn’t true. How short is your memory? Bad software, AND bad software of this nature, existed in plentiful quantities before “AI”.
Re:Humble Bundle just killed most of their security through ... by forgetfreeman on Thursday November 12, 2026 @11:45AM (#50470229)
No. This isn't "bad software". This is Code Bootcamp 2nd semester lab levels of incompetent. Most of the security lessons this product ignores were known (and solved) 20 years ago. The last time I saw a website in the wild that fell down this badly on basic user account security it was written in Perl.
Re:Humble Bundle just killed most of their security through ... by WD-42 on Thursday November 12, 2026 @03:41AM (#50464582)
This disaster never would have seen the light of day if it weren't for AI.
Re:Humble Bundle just killed most of their security through ... by p2detar on Thursday November 12, 2026 @03:45AM (#50464624)
[delayed]
Re:Humble Bundle just killed most of their security through ... by adastra22 on Thursday November 12, 2026 @04:21AM (#50464898)
AI is a massive multiplier. It’ll 100x anyone. It’s just many people start with negative coefficients…
Re:Humble Bundle just killed most of their security through ... by alex_duf on Thursday November 12, 2026 @04:04AM (#50464760)
I don't know, I'm more inclined to blame the usage rather than the tool here.

Do we blame the bulldozer if it bulldozes the wrong thing? We're just not used to bulldozing yet.

Re:Humble Bundle just killed most of their security through ... by reaperducer on Thursday November 12, 2026 @04:23AM (#50464911)
Do we blame the bulldozer if it bulldozes the wrong thing?

The people who make the bulldozer don't market it as "intelligent."

Re:Humble Bundle just killed most of their security through ... by 3form on Thursday November 12, 2026 @04:24AM (#50464925)
I'm not going to blame the tool. I'm sure as fuck going to blame the peddlers of the tools that are always ready to support this kind of nonsense; worse, they tell everyone around that this is perfectly fine.
Re:Humble Bundle just killed most of their security through ... by Relic0935 on Thursday November 12, 2026 @04:28AM (#50464953)
I'm not blaming the bulldozer. I blame the people who gave everyone bulldozers knowing that they have faulty steering and that nobody is used to bulldozing. And the people who shut down every attempt to prevent that with the argument "bulldozers are the future, you can't stop them!".

And yes, I also blame the people getting on that bulldozer, bulldozing like there's no tomorrow. But mainly I blame the first two groups.

Re:Humble Bundle just killed most of their security through ... by kbenson on Thursday November 12, 2026 @01:53PM (#50472273)
Bulldozers aren't restricted vehicles, anyone can buy them. What you seem to be upset at is that they became very cheap and easy to obtain, and everyone is using them to landscape their small front yards and the damage caused is often outweighing the time saved by using something simpler that takes more time and effort. The bulldozers work fine, but if you use a large one to clear everything you might just find you've also taken out the walkway to your door inadvertently, when a small one that took a bit more time and effort would have allowed for you to target what needed attention.

That metaphor has been stretched about as far as I can take it, but it's the tools and people getting access to tools they've not been trained on to do tasks they have no prior experience with. As someone who just laid laminate flooring myself for the first time, I'm keenly aware of both having the right tool for the job and the knowledge of how to use it and knowledge of how to do the task in general affects the end product. The mistakes I made are my own, not the cause of the incorrect tools I used at times.

Re:Humble Bundle just killed most of their security through ... by seba_dos1 on Thursday November 12, 2026 @05:01AM (#50465178)
Once you can't go for a walk without experiencing a bulldozer bulldozing the wrong thing somewhere on your path, it becomes a distinction without difference.
Re:Humble Bundle just killed most of their security through ... by syshyk on Thursday November 12, 2026 @07:32AM (#50466238)
The bulldozer goes in the direction the person is sitting enough of the time we can call it "all the time" without having to argue "what if it breaks down, or a lever breaks and sticks on".
Re:Humble Bundle just killed most of their security through ... by latexr on Thursday November 12, 2026 @09:16AM (#50467572)
> I'm more inclined to blame the usage rather than the tool here.

Which is what your parent comment is doing. They didn’t say AI was to blame, they said this wouldn’t have happened without it. It’s likely your fault if you blow up your hands with a firecracker, but it’s also true that it wouldn’t have happened if firecrackers weren’t a thing.

> Do we blame the bulldozer if it bulldozes the wrong thing?

That’s such a tired analogy. By this point it’s honestly hard to believe it is made in good faith.

There isn’t a massive industry with tendrils in every facet of society trying to sell you on autonomous bulldozers that do the bulldozing for you without interaction, is there? Caterpillar is working on autonomous bulldozers, but even those aren’t targeted and advertised at every household as something you have to use.

Re:Humble Bundle just killed most of their security through ... by weego on Thursday November 12, 2026 @04:20AM (#50464885)
Disagree on which end of the telescope were looking down.

AI has caused a generational set back on how stakeholders view the value of expertise knowledge, but the gun is still people, AI is just one of the bullets along with things like obsessive cost cutting.

My large orgs entire marketing strategy is now run by an MBA using Claude to generate 'idea and best practice docs'.

The process that lead us to not having a CMO or any other marketing leadership with domain knowledge? Consulting partnerships using MBAs.

The reason we're not changing any strategies even though we're burning money pper CPA? MBAs concerned seeking alignment and having the right narrative to change course.

Thr planned new course? More Claude.

Re:Humble Bundle just killed most of their security through ... by ulrikrasmussen on Thursday November 12, 2026 @04:31AM (#50464983)
That is true, but this can be said about so many things. Hit and runs would also not exist if it weren't for cars.

The technology itself is not to blame, but maybe the marketing around it should be. AI coding tools are marketed as magic tools that can somehow spit out perfect solutions even if the input spec is garbage. Of course that is impossible, and no amount of technology can solve that problem unless every AI coding agent is equipped with guardrails that makes it stop if it gets the impression that its user is an idiot.

Re:Humble Bundle just killed most of their security through ... by berkes on Thursday November 12, 2026 @04:53AM (#50465118)
What if it was intentional?

Thought experiment. A startup is at the end of their runway. Need to show income or go down. Businessmodel is to sell "one off" sales, and vast majority of their accounts buy once or twice (a year or ever).

What if they "accidentally" make it easier for hackers to take over those accounts. Accidentally, as part of a large overhaul or rewrite of their systems. Then, at least for a while, their accounts suddenly "buy" much more products per month or year.

Cynical, I know. But not unthinkable.