joj123
joj123 on Hacker News
Posted by
joj123 on Wednesday June 24, 2026 @11:24PM
from the boringappsec.com dept.
Posted by
joj123 on Tuesday July 22, 2025 @01:52PM
from the boringappsec.substack.com dept.
Posted by
joj123 on Thursday May 29, 2025 @01:06PM
from the boringappsec.substack.com dept.
I am a founder of a company that generates LLM-generated output (the users know that). I am curious if folks would prefer we make it more "human-like", or do you prefer we just add more disclaimers of the text being LLM generated?
Of course, do assume that the content itself is accurate. The question is on the style of output
Posted by
joj123 on Tuesday January 28, 2025 @01:18AM
from the boringappsec.substack.com dept.
Thanks. That's a good point, should have linked to the landing page instead :)
Posted by
joj123 on Thursday September 19, 2024 @09:17AM
from the show-hn dept.
https://app.seezo.io/
Generate security requirements for every new feature built by your developers.It accepts documents (design docs,tech specs, HLD, LLD), diagrams (architecture diagrams) and Jira tickets as input. Produces Security requirements and Open questions as output.They are powered by LLMs, so we have a 5-scan limit for all new users. You can request access for more scans though.
Posted by
joj123 on Sunday August 13, 2023 @01:02PM
from the boringappsec.substack.com dept.
My cynical take is that HR teams don't know how to manage or engage remote teams. Instead of picking up that skill, they are forcing a return to office.
I have no idea what they have built. Hope they talk about it though :)
1. I agree with your point that Prompt Injection can still affect the consumer of a third party LLM
2. I prefer to categorize it as a supply chain security issue, since the vulnerability is with a software provider that you are consuming.
Agree that the ownership of using a vulnerable 3rd party is on you. I would just categorize that as supply chain risk and not prompt injection.
(Author of the newsletter here)
It's early days, but the simplest use case has been to improve employee productivity (Github Copilot, ChatGPT etc.). The Stripe CEO just tweeted that over half of their employees are using an internal LLM tool they built (folks who build internal tooling know how hard it is to drive adoption to a non-mandatory tool):
https://twitter.com/patrickc/status/1681699442817368064?s=20There are other companies which are doing some crazy experimental things which may have a large impact. For instance, Truveta is cleaning up on millions of medical records, training a model on that data and using that to drive research about patient care. Too early to tell if LLMs will actually transform companies beyond slight bumps in productivity, but to me, it feels like the cloud computing moment from 12-15yrs ago.
Posted by
joj123 on Tuesday May 30, 2023 @11:15PM
from the boringappsec.substack.com dept.
Posted by
joj123 on Monday May 08, 2023 @10:26AM
from the boringappsec.substack.com dept.
Posted by
joj123 on Tuesday February 21, 2023 @11:47AM
from the boringappsec.substack.com dept.
Posted by
joj123 on Friday July 01, 2022 @09:37AM
from the engineering.razorpay.com dept.
Posted by
joj123 on Sunday January 02, 2022 @08:03AM
from the boringappsec.substack.com dept.
Posted by
joj123 on Sunday September 19, 2021 @10:06AM
from the boringappsec.substack.com dept.
Posted by
joj123 on Sunday August 29, 2021 @06:44AM
from the boringappsec.substack.com dept.
Fair enough. Guess IDE plugins work even better for that
The CI service is free, with some limitations on how long the findings stay on the dashboard, SSO integration and maybe a few others. The paid version was $40/usr/mo the last time I checked
Once we figured it out, it takes us a few minutes to onboard a new repo to Semgrep
Out of curiosity, Is there value in doing this over (say) running a GitHub Action post commit and failing the build if it finds something nasty?
I do the same with Whatsapp using a neat trick someone told me about.
Create a group(call it "Share with self" or similar) with you and another person. Then, remove that person from the group.. that's it! Functionally it's the same as sending yourself Slack messages, but on WA, which is good
I guess the idea is that TLS is sufficiently complicated that you can take tangents during the interview and establish if the candidate can understand and communicate complex concepts
You make many of leaps of faiths to get to your conclusion. Let's for a second assume that's all accurate, are you in favour of government solving this problem by an executive decision?
Note that the same State refuses to regulate FAANGs which have stood by as their platforms were exploited to influence elections.
The double standards are staggering
Wait, are you in good faith comparing H1B workers to slavery? I am not an expert on American history, but if you did, that escalated quickly :). The only rebuttal I have is, that no employee on Infosys is forced on a Lufthansa economy class seat to Newark airport. They do it by choice.
The whole "their code is horrible" is shifting of a goalpost. If that's true (and it might well be), then stop hiring them. If businesses see the point you are making, they'll stop hiring them.
On FAANGs adding value - I 100% agree. FAANGs add way more value than any Indian consulting company and that's reflected in the market cap of these companies. But surely,one can appreciate that FAANGs add value and that they lobby to have laws created in their favor. My limited point is that I don't think these American companies (which benefit from the new H1B rule) have any higher moral ground to claim with respect to their stance on immigration laws.
Also, A higher wage is an odd way to restrict hiring. A FAANG company can pay much higher wages for low-end coding job than Indian consulting companies ever can. So, if a FAANG hires the same Indian kid, at 120K/yr and have him/her do the same shitty job that the consulting company does, there's nothing here that stops it (please correct me if I am mistaken)
Wow. That's a mean acronym (whoever came up with it).
FWIW - these companies add tremendous value to enterprises in the US and yes, they do that by paying lower wages to folks flying in from India (compared to American counterparts), but it's still a upgrade for these engineers (plus a chance to experience America).
I understand the whole "but they are circumventing the spirit of the Visa" angle, but they are operating in an environment where FAANGs spend a lot of money lobbying for favorable regulations.
I don't see a big ethical difference between 'I will pay millions to lobby and get laws written in my favor' and 'I will exploit loopholes in the system to better my business'