Daniel Stenberg, curl utiliidi autor, on kritiseerinud AI-platvormide kasutamist haavatavuste raportite koostamisel. Sellised raportid sisaldavad \u00fcksikasjalikku teavet, on kirjutatud tavakeeles ja n\u00e4ivad kvaliteetsed, kuid ilma s\u00fcgava anal\u00fc\u00fcsita v\u00f5ivad need tegelikult lihtsalt eksitada, asendades t\u00f5elised probleemid kvaliteetselt n\u00e4iva pr\u00fcgi sisuga. <\/p>\n
Curl projekt maksab tasu uute haavatavuste avastamise eest ja on juba saanud 415 potentsiaalset probleemi k\u00e4sitlevat raportit, millest ainult 64 on kinnitatud kui haavatavused ning 77 ei ole seotud turvalisuse probleemidega. Seet\u00f5ttu ei sisaldanud 66% k\u00f5igist raportitest mingit kasulikku teavet ja v\u00f5tsid arendajatelt aega, mida oleks saanud kasutada millegi kasuliku tegemiseks. <\/p>\n
Arendajad peavad raiskama palju aega kasutu raportite anal\u00fc\u00fcsimiseks ja kontrollima seal n\u00e4idatud andmeid mitu korda, kuna v\u00e4line kvaliteet loob lisakindlust teabe suhtes ja tekib tunne, et arendaja ei saanud millestki aru. Teisest k\u00fcljest n\u00f5uab sellise raporti koostamine minimaalset pingutust esitaja poolt, kes ei viitsi kontrollida, kas tegelikult on olemas probleem, vaid kopeerib lihtsalt andmed AI-assistentidelt, lootes \u00f5nne tasu v\u00f5itmisel. <\/p>\n
Toodud on kaks n\u00e4idet sellistest pr\u00fcgi raportitest. \u00dcks p\u00e4ev enne oktoobri t\u00f5sise haavatavuse (CVE-2023-38545) planeeritud avalikustamist saadeti Hackerone'i kaudu raport, et paranduspatch oli avalikult k\u00e4ttesaadav. Tegelikult sisaldas raport Google Bardi abil genereeritud segu faktidest sarnaste probleemide kohta ja l\u00f5ike varasemate haavatavuste \u00fcksikasjadest. Tulemus oli see, et teave n\u00e4is olevat uus ja asjakohane, kuid ei vastanud tegelikkusele. <\/p>\n
Teine n\u00e4ide k\u00e4sitleb 28. detsembril saadud vestluste r\u00e4\u00e4gitud s\u00f5numit WebSocket'i t\u00f6\u00f6tleja puhver \u00fcletamisest, mille saatis kasutaja, kes oli juba teatanud erinevatele projektidele haavatavustest l\u00e4bi Hackerone. Probleemi kordamise meetodina toodi aruandes v\u00e4lja \u00fcldised s\u00f5nad muudetud p\u00e4ringu edastamisest, mille v\u00e4\u00e4rtuse suurus \u00fcletab koopia tegemiseks kasutatava puhvri suurust, kasutades strcpy. Aruandes toodi ka v\u00e4lja parandamise n\u00e4ide (nt strcpy asendamine strncpy-ga) ning viidati koodirea «strcpy(keyval, randstr)» juurde, kus v\u00e4idetavalt oli viga. <\/p>\n
Arendaja kontrollis k\u00f5ik kolm korda ja ei leidnud probleeme, kuid kuna raport oli enesekindlalt kirjutatud ja sisaldas isegi parandust, tekkis tunne, et midagi j\u00e4\u00e4b t\u00e4helepanuta. Katse selgitada, kuidas uurijal \u00f5nnestus enne strcpy kutsumist m\u00f6\u00f6da minna suuruse kontrollimine ja kuidas keyval puhver osutus v\u00e4iksemaks kui loetud andmete suurus, andis \u00fcksikasjalikke, kuid mitte lisainfot, seletusi, mis vaid tutvustasid ilmselgeid \u00fcldiseid p\u00f5hjuseid puhverdus\u00fcleliiduse tekkeks, mis ei olnud seotud konkreetse Curl koodiga. Vastused meenutasid suhtlemist AI-assistentidega ja p\u00e4evasel ajal mittemugava proovimise j\u00e4rel selgus arendajale, et tegelikult pole haavatavust. \u0414\u044d\u043d\u0438\u0435\u043b C\u0442\u0435\u043d\u0431\u0435\u0440\u0433 (Daniel Stenberg), \u0430\u0432\u0442\u043e\u0440 \u0443\u0442\u0438\u043b\u0438\u0442\u044b \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u043e \u0441\u0435\u0442\u0438 curl, \u0432\u044b\u0441\u0442\u0443\u043f\u0438\u043b \u0441 \u043a\u0440\u0438\u0442\u0438\u043a\u043e\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f AI-\u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u043f\u0440\u0438 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0438 \u043e\u0442\u0447\u0451\u0442\u043e\u0432 \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445. \u041f\u043e\u0434\u043e\u0431\u043d\u044b\u0435 \u043e\u0442\u0447\u0451\u0442\u044b \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0442 \u0434\u0435\u0442\u0430\u043b\u044c\u043d\u044b\u0435 \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f, \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u044b \u043d\u043e\u0440\u043c\u0430\u043b\u044c\u043d\u044b\u043c \u044f\u0437\u044b\u043a\u043e\u043c \u0438 \u0432\u044b\u0433\u043b\u044f\u0434\u044f\u0442 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u043c\u0438, \u043d\u043e \u0431\u0435\u0437 \u0432\u0434\u0443\u043c\u0447\u0438\u0432\u043e\u0433\u043e \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u043d\u0430 \u0434\u0435\u043b\u0435 \u043c\u043e\u0433\u0443\u0442 \u043b\u0438\u0448\u044c \u0432\u0432\u043e\u0434\u0438\u0442\u044c \u0432 \u0437\u0430\u0431\u043b\u0443\u0436\u0434\u0435\u043d\u0438\u0435, \u043f\u043e\u0434\u043c\u0435\u043d\u044f\u044f \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u0432\u044b\u0433\u043b\u044f\u0434\u044f\u0449\u0438\u043c \u043c\u0443\u0441\u043e\u0440\u043d\u044b\u043c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u044b\u043c. \u041f\u0440\u043e\u0435\u043a\u0442 Curl […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-112715","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47AI-t\u00f6\u00f6riistade koostatud haavatavuste aruannete probleemid | ProHoster","description":"Daniel Stenberg, curl'i andmete edastamise t\u00f6\u00f6riista autor, kritiseeris AI-t\u00f6\u00f6riistade kasutamist haavatavuste aruannete koostamisel.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/problemy-iz-za-podgotovlennyh-ai-instrumentami-otchyotov-ob-uyazvimostyah","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0438\u0437-\u0437\u0430 \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0445 AI-\u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0438 \u043e\u0442\u0447\u0451\u0442\u043e\u0432 \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 | ProHoster","og:description":"\u0414\u044d\u043d\u0438\u0435\u043b C\u0442\u0435\u043d\u0431\u0435\u0440\u0433 (Daniel Stenberg), \u0430\u0432\u0442\u043e\u0440 \u0443\u0442\u0438\u043b\u0438\u0442\u044b \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u043e \u0441\u0435\u0442\u0438 curl, \u0432\u044b\u0441\u0442\u0443\u043f\u0438\u043b \u0441 \u043a\u0440\u0438\u0442\u0438\u043a\u043e\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f AI-\u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u043f\u0440\u0438 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0438 \u043e\u0442\u0447\u0451\u0442\u043e\u0432 \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/problemy-iz-za-podgotovlennyh-ai-instrumentami-otchyotov-ob-uyazvimostyah","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-01-05T19:10:15+00:00","article:modified_time":"2024-01-05T19:10:15+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/112715","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=112715"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/112715\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=112715"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=112715"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=112715"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"