Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AI is breaking two vulnerability cultures

jefftk.com

Post reply on HN
Print view View original

51–60 of 188 posts

Re: AI is breaking two vulnerability cultures

#51

Post by nicce »

pier25 wrote: post #49
Animats wrote: post #46

We have a huge problem. The US is at war. Much of the world is at war at the cyber attack level right now. The US, the EU, most of the Middle East, Israel, Russia... Major services have been attacked and have gone down for days at a time - Ubuntu, Github, Let's Encrypt, Stryker. Entire hospital systems have had to partially shut down. Now, in the middle of this, AI has made attacks much faster to generate. Faster tha…

> before it gets better How is it going to get better?

Downplaying security has now real coencequences for everyone.

Re: AI is breaking two vulnerability cultures

#52

Post by Sarky »

pier25 wrote: post #49
Animats wrote: post #46

We have a huge problem. The US is at war. Much of the world is at war at the cyber attack level right now. The US, the EU, most of the Middle East, Israel, Russia... Major services have been attacked and have gone down for days at a time - Ubuntu, Github, Let's Encrypt, Stryker. Entire hospital systems have had to partially shut down. Now, in the middle of this, AI has made attacks much faster to generate. Faster tha…

> before it gets better How is it going to get better?

Right now we are at a point in time when AI can find bugs for attackers and defenders, but defenders did not fix/find those bugs yet.

In time most of the bugs AI can find will be fixed, and things will calm down. Some bugs will be left, but will be too complex to find and weaponise (or rarely).

Alin short, attackers have advantage for a brief time now, but ultimately defenders will win. I guess this "fight" might be over before the end of the year.

Re: AI is breaking two vulnerability cultures

#53

Post by Forgeties79 »

rikafurude21 wrote: post #3

This feels more like an old problem getting reframed as an AI problem. people were already diffing kernel commits and figuring out which ones were security fixes long before llms. if a patch lands publicly, the race has basically already started. also not sure shorter embargoes really help. the orgs that can patch in hours are already fine. everyone else still takes days or weeks. if anything, cheaper exploit generat…

I find i’m writing variations of the same comment every week so I’m just going to share a previous version I wrote if you’ll permit the laziness:

https://news.ycombinator.com/item?id=47921829

Re: AI is breaking two vulnerability cultures

#54

Post by fragmede »

rikafurude21 wrote: post #3

This feels more like an old problem getting reframed as an AI problem. people were already diffing kernel commits and figuring out which ones were security fixes long before llms. if a patch lands publicly, the race has basically already started. also not sure shorter embargoes really help. the orgs that can patch in hours are already fine. everyone else still takes days or weeks. if anything, cheaper exploit generat…

Reminder: the Ksplice patent expires October 1, 2028.

Re: AI is breaking two vulnerability cultures

#55

Post by nicce »

j2kun wrote: post #27

> Luckily AI can speed up defenders as well as attackers here, allowing embargoes that would previously have been uselessly short. This is an important facet of the problem space: security risks turning into an arms race for who wants to spend more tokens.

One interesting thing is that this makes closed source code even greater asset for the defenders. Attacker cannot spend tokens for it, but defenders can spend tokens for hardening based on source code, while attacker is stuck with blackbox testing.

Re: AI is breaking two vulnerability cultures

#56

Post by jiggawatts »

pier25 wrote: post #49
Animats wrote: post #46

We have a huge problem. The US is at war. Much of the world is at war at the cyber attack level right now. The US, the EU, most of the Middle East, Israel, Russia... Major services have been attacked and have gone down for days at a time - Ubuntu, Github, Let's Encrypt, Stryker. Entire hospital systems have had to partially shut down. Now, in the middle of this, AI has made attacks much faster to generate. Faster tha…

> before it gets better How is it going to get better?

Bulk rewrites of everything into Rust with AI assistance?

Re: AI is breaking two vulnerability cultures

#57

Post by lll-o-lll »

miki123211 wrote: post #28

AI will shorten update windows dramatically. 2026 is the worst year to be thinking about dependency cooldowns, we need to think about dependency warmups instead. Soon, there will be no such thing as a safe way to disclose a vulnerability in an open source project. Centralized SaaS will have a major security advantage here.

Closed source centralized SaaS will have a major security advantage.

Edit: Because an RCE in a open-source dependency means you are just as vulnerable when the security patch lands? I don’t see the controversy.

Re: AI is breaking two vulnerability cultures

#58

Post by j2kun »

nicce wrote: post #55
j2kun wrote: post #27

> Luckily AI can speed up defenders as well as attackers here, allowing embargoes that would previously have been uselessly short. This is an important facet of the problem space: security risks turning into an arms race for who wants to spend more tokens.

One interesting thing is that this makes closed source code even greater asset for the defenders. Attacker cannot spend tokens for it, but defenders can spend tokens for hardening based on source code, while attacker is stuck with blackbox testing.

Decompilation is quite good these days as well

Re: AI is breaking two vulnerability cultures

#59

Post by foobiekr »

jiggawatts wrote: post #56
pier25 wrote: post #49

Earlier quoted context omitted.

> before it gets better How is it going to get better?

Bulk rewrites of everything into Rust with AI assistance?

I am looking at the results of a mass vulnerability scan as I type this. Half of the bugs in one case are in fact (binary) parser errors for hand-written parsers. These really should not exist in any language - but in C it's particularly bad. Kaitai Struct or something similar would broadly have prevented these. Rust would help here, but less than a parser generator (because it could automate error checking insertion for things that aren't just out of bound access).

However, half of the vulnerabilities are logic errors in terms of what I would call RBAC enforcement, incorrect access permissions, and so on. Rust won't help at all with any of these.

Re: AI is breaking two vulnerability cultures

#60

Post by idopmstuff »

pier25 wrote: post #49
Animats wrote: post #46

We have a huge problem. The US is at war. Much of the world is at war at the cyber attack level right now. The US, the EU, most of the Middle East, Israel, Russia... Major services have been attacked and have gone down for days at a time - Ubuntu, Github, Let's Encrypt, Stryker. Entire hospital systems have had to partially shut down. Now, in the middle of this, AI has made attacks much faster to generate. Faster tha…

> before it gets better How is it going to get better?

If we assume that there will be an AI that is perfect in terms of ability to find vulnerabilities, cheap to run and widely available to everyone, then anyone can run it on any piece of software before deploying it. All vulnerabilities get found before they can be exploited.

One of the big challenges with cybersecurity is that attackers only need to find one exploit, while defenders need to stop everything. When you have a large surface area and limited resources, it's much easier to be the side that only has to succeed once. AI eliminates the limited resources problem.

Post reply on HN