Alt text: Image macro: The world if the IESG had the same authority as the ISO. The background shows a futuristic landscape featuring green gras, glass towers, and flying cars and buses.

https://xkcd.com/3277/

cross-posted from: https://feditown.com/post/3393569

I was just editing my Dockerfile and suddenly IntelliJ showed me the message "No" without any context.

Hey Boss, look here!

I made a magical X-ray app that displays our code as wiring.

Here is the shiny, neat program that Bob wrote 15 years ago, right before he left us:

And here is what it is today, after Tom took it from Bob, and Jane from Tom, and Mick from Jane, and me from him, porting it to roughly four new platforms, and adding about 240 features from customer requests (150 of which were urgent):

SpaceXAI's AI coding tool Grok Build has been exposed for defaulting to uploading entire Git repositories, including code that the tool itself hasn't read or contextual calls, as well as the full Git commit history. A 12GB of repository data was sent to Google Cloud, where Grok Build uses Google GCP to store the collected data. If you run this on a sensitive stack, your entire repo is already compromised regardless if it's public or not. It's literal spyware.

Shipping source code to the cloud is bad enough, but blindly inhaling .env.local and .dev.vars in a background sync is absolute negligence. They are vacuuming up raw api keys, database credentials, and private nodes directly to GCP.

If you ran this locally, your private keys are now sitting on a remote server. consider every secret burned, treat your bare metal as completely compromised, and rotate your entire stack immediately.

Grok Build quietly adjusted its cloud strategy last night to stop uploading data, which further suggests that it was a conscious decision rather than a bug. The problem, however, is that development teams can re-enable data collection options from the cloud at any time, Grok Build is not open source and therefore nobody can do a code audit.