Instead of just generating a patch (copilot style), it generates the patch, applies the patch, runs the code, and then iterates based on the execution output.
Square | AppSec, vulnerability discovery, pen testing | Remote in North America
We're hiring people to find vulnerabilities in Square products and services! The team is brand-new with lots of opportunity to choose the type of AppSec work you want to focus on. Fully remote is an option. There are more details here: https://smrtr.io/6T58-
We're also hiring for lots of other security roles. Please feel free to email me: [email protected]
isTrusted cannot be spoofed in this situation, which is its intended use in Chrome. A Chrome extension in the isolated world is receiving events from the main world and checking isTrusted for those events.
> Yes, we're pushing the notification to a new tab (which can't be blocked or interfered with)
We went through a similar iteration with Password Alert. If you're setting focus on the new tab, an onBlur event could indicate that the current page has lost focus, perhaps due to the warning tab. I think notifying the user is still net-positive for the user's security.
Before Chrome implemented isTrusted, it was a bit more tricky and we had to rely on a variety of attributes that did not have as much of a security guarantee.
Thanks, that's a fair point. However I've been surprised to see that in well-executed attacks, even the best of us can at least occasionally fall for password phishing.
It's not actually related to Project Zero. There are quite a few people here at Google, both on Project Zero and on other projects and teams, that routinely find vulnerabilities. Here's a list of some of the vulnerabilities: http://www.google.com/about/appsecurity/research/
git clone a repo
Open goose with that directory
Instruct it to discover what the repo does
Ask it to make changes to the code, being detailed with my instructions.
I haven't tried computerController, only Goose’s main functionality.