Comment by wy1981
10 hours ago
I could have overlooked but doesn't seem there is a mention of Claude in the blog post? Did author say they had used Claude?
I also am wondering if Claude will proceed on a prompt which is about finding a bug like that? I am not sure, has anyone tried?
Took about 3 sentences for me to be as certain as I've ever been about anything I've ever been in my entire life that this blog post was authored by an LLM, though truthfully it's impossible to know for sure if it was a Claude model or a distill.
The cookie is "what caught my eye." not realistic phrasing
The cookie contained a pickle-serialized payload, "which was bad enough on its own." maybe not best practice but not bad on it's own
Flask session cookies are signed", not encrypted," so the... LLMs love to tell you what things aren't, as an emphasis on what they are
Tbf as someone with an infosec background, I would have probably written just about the same.
Pickle payload is a red flag precisely because pickle is not a safe serialisation format format when taken as untrusted input, here the input was trusted but it's still giving someone en easy escalation path (exactly what happened)
And most people would assume the whole cookie payload would be encrypted if they saw just a binary blob, and not realise you can fully read it if it's just signed
But, yes, the post was probably edited by an LLM, as is pretty much everything else you read online these days.