111–120 of 368 posts
Whenever I look at a web project, it starts with "npm install" and literally dozens of libraries get downloaded. The project authors probably don't even know what libraries their project requires, because many of them are transitive dependencies. There is zero chance that they have checked those libraries for supply chain attacks.
This is a perfect illustration of what cracks me up about the hyperbolic reactions to Mythos. Yes, increased automation of cutting-edge vulnerability discovery will shake things up a bit. No, it's nowhere near the top of what should be keeping you awake at night if you're working in infosec. We've built our existing tech stacks and corporate governance structures for a different era. If you want to credit one specifi…
> We know how to write software with very few bugs (although we often choose not to) Do we, really? Because a week doesn’t go by when I don’t run into bugs of some sort. Be it in PrimeVue (even now the components occasionally have bugs, seems like they’re putting out new major versions but none are truly stable and bug free) or Vue (their SFC did not play nicely with complex TS types), or the greater npm ecosystem, o…
Yes, or pretty close to it. What we don't know how to do (AFAIK) is do it at a cost that would be acceptable for most software. So yes, it mostly gets done for (components of) planes, spacecraft, medical devices, etc.
Totally agreed that most software is a morass of bugs. But giving examples of buggy software doesn't provide any information about whether we know how to make non-buggy software. It only provides information about whether we know how to make buggy software—spoiler alert: we do :)
A software building code could provide a legal framework to hold someone liable for transferring ownership of a software product and significantly altering its operation without informing its users. This is a serious issue for any product that depends on another product to ensure safety, privacy, financial impact, etc. It could add additional protections like requiring that cryptographic signature keys be rotated for new owners, or a 30-day warning period where users are given a heads up about the change in ownership or significant operation of the product. Or it could require architectural "bulkheads" that prevent an outside piece of software from compromising the entire thing (requiring a redesign of flawed software). The point of all this would be to prevent a similar attack in the future that might otherwise be legal.
But why a software building code? Aren't building codes slow and annoying and expensive? Isn't it impossible to make a good regulation? Shouldn't we be moving faster and cheaper? Why should I care?
You should care about a building code, because:
1. These major compromises are getting easier, not harder. Tech is big business, and it isn't slowing down, it's ramping up. AI makes attacks easier, and attackers see it's working, so they are more emboldened. Plus, cyber warfare is now the cheaper, more effective way to disrupt operations overseas, without launching a drone or missile, and often without a trace.
2. All of the attacks lately have been preventable. They all rely on people not securing their stacks and workflows. There's no new cutting-edge technology required; you just need to follow the security guidelines that security wonks have been going on and on about for a decade.
3. Nobody is going to secure their stack until you force them to. The physical realm we occupy will never magically make people spontaneously want to do more effort and take more time just to prevent a potential attack at some random point in the future. If it's optional, and more effort, it will be avoided, every time. "The Industry" has had decades to create "industry" solutions to this, and not only haven't they done this, the industry's track record is getting worse.
4. The only thing that will stop these attacks is if you create a consequence for not preventing them. That's what the building code does. Hold people accountable with a code in law. Then they will finally take the extra time and money necessary to secure their shit.
5. The building code does not have to be super hard, or perfect. It just has to be better than what we have now. That's a very low bar. It will be improved over time, like the physical world's building code, fire code, electrical code, health & safety code, etc. It will prevent the easily preventable, standardize common practice, and hold people accountable for unnecessarily putting everyone at risk.
I keep saying it again and again. I get downvoted every time, but I don't care. I'll keep saying it and saying it, until eventually, years from now, somebody who needs to hear it, will hear it.
Whenever I look at a web project, it starts with "npm install" and literally dozens of libraries get downloaded. The project authors probably don't even know what libraries their project requires, because many of them are transitive dependencies. There is zero chance that they have checked those libraries for supply chain attacks.
Isn't this the same for maven, python, ruby projects too? I don't see this as a web only problem
Earlier quoted context omitted.
> And with this much at stake, they can afford to simply buy your software dependencies, or to offer one of your employees some retirement money in exchange for making a "mistake". LAPSUS$ was prolific by just bribing employees with admin access. This is far from theoretical. Just imagine the kind of money your average nation state has laying around to bribe someone with internal access.
I started to write a comment about how low they probably were able to bribe people for but found this article [0] which put the number higher than I expected: > One of the core LAPSUS$ members who used the nicknames “Oklaqq” and “WhiteDoxbin” posted recruitment messages to Reddit last year, offering employees at AT&T, T-Mobile and Verizon up to $20,000 a week to perform “inside jobs.” That said, this is but one insta…
This is a perfect illustration of what cracks me up about the hyperbolic reactions to Mythos. Yes, increased automation of cutting-edge vulnerability discovery will shake things up a bit. No, it's nowhere near the top of what should be keeping you awake at night if you're working in infosec. We've built our existing tech stacks and corporate governance structures for a different era. If you want to credit one specifi…
> We know how to write software with very few bugs (although we often choose not to) Do we, really? Because a week doesn’t go by when I don’t run into bugs of some sort. Be it in PrimeVue (even now the components occasionally have bugs, seems like they’re putting out new major versions but none are truly stable and bug free) or Vue (their SFC did not play nicely with complex TS types), or the greater npm ecosystem, o…
I’m not sure I’d go quite as far as GP, but they did caveat that we often choose not to write software with few bugs. And empirically, that’s pretty true.
The software I’ve written for myself or where I’ve taken the time to do things better or rewrite parts I wasn’t happy with have had remarkably few bugs. I have critical software still running—unmodified—at former employers which hasn’t been touched in nearly a decade. Perhaps not totally bug-free, but close enough that they haven’t been noticed or mattered enough to bother pushing a fix and cutting a release.
Personally I think it’s clear we have the tools and capabilities to write software with one or two orders of magnitude fewer bugs than we choose to. If anything, my hope for AI-coded software development is that it drops the marginal cost difference between writing crap and writing good software, rebalancing the economic calculus in favor of quality for once.
Maybe mergers or acquisitions that substantially impact security should require approval by marketplaces (industry governance), and notification and approval by even governments?
Whenever I look at a web project, it starts with "npm install" and literally dozens of libraries get downloaded. The project authors probably don't even know what libraries their project requires, because many of them are transitive dependencies. There is zero chance that they have checked those libraries for supply chain attacks.
There is a reason. The prevailing wisdom has thus far been: "don't re-invent the wheel", or it non-HN equivalent "there is an app for that". I am absolutely not suggesting everyone should be rolling their own crypto, but there must be a healthy middle ground between that and a library that lets you pick font color.
Whenever I look at a web project, it starts with "npm install" and literally dozens of libraries get downloaded. The project authors probably don't even know what libraries their project requires, because many of them are transitive dependencies. There is zero chance that they have checked those libraries for supply chain attacks.
Earlier quoted context omitted.
And because it is surprisingly difficult to distinguish between 'oops' and 'malice' a lot of the actual perps get away with it too, as long as they limit their involvement. In-house threats are an under appreciated - and somewhat uncomfortable - topic for many companies, they don't have the funds to do things by the book but they do have outsized responsibilities and pray that they can trust their employees.
But on the other hand, adding LLM with strong guards (not yet here but doable for popular attack vectors) into the human loop can drastically eliminate insider factor, imho.