111–120 of 152 posts
Earlier quoted context omitted.
People will just turn SELinux off rather than have to go through the horrible tooling when it breaks a regular use case.
I do think SELinux is a good example of how robust software with poor UX/DX gets undermined by that poor UX/DX. Although I do wonder if AI can help with it?
Earlier quoted context omitted.
And Windows?
Pray to God no one ever lets an AI agent run loose on the various leaked Windows source code dumps. Given Windows' absurd amount of backwards compatibility, chances are pretty high that there are a lot of sleeping dragons buried inside even modern Windows 10/11 kernel and userland that date back to code and issues from the 90s - code where half the people who have worked on it probably not just have departed Microsof…
Also contrary to Linux, Windows 11 (optional on W10) uses sandboxing for kernel and drivers.
Since Windows XP SP2 that Windows keeps getting mitigations, Microsoft has security teams whose day job is to attack Windows.
They are also promoting using CoPilot for C and C++ code review for some time now.
While it won't stop all attacks, it is better than the whole UNIX is safer than Windows attitude from the 90's, turns out it is a matter of how much money is into it.
Want really safe above anything else, look into Qube OS with its sandboxing over everything, or mainframe systems like Unysis ClearPath MCP, with NEWP as systems language, and managed environments.
What is happening? I see multiple outages and CVEs is being reported on HN's front page. I've never seen these many security/incident related posts on HN's front page.
Earlier quoted context omitted.
Automated vulnerability discovery via LLM.
Everyone was talking about how Mythos was overblown marketing, and while it may be, they missed the forest for the trees. Capabilities have been escalating for a year now and we're at the point of widespread impact. I don't suspect we'll see a slowdown for a long time.
Linus' law was wrong because there were never enough (qualified) eyeballs to check the code. LLMs provide an ample supply of eyeballs (though it's not a benefit to open source, since proprietary developers can use the same LLMs).
What is happening? I see multiple outages and CVEs is being reported on HN's front page. I've never seen these many security/incident related posts on HN's front page.
C code is broken - period
What is happening? I see multiple outages and CVEs is being reported on HN's front page. I've never seen these many security/incident related posts on HN's front page.
In some sense, I wonder if non-open-source is "safer" since LLMs can't mass scan the code for exploits.
> “and is writable with CAP_SYS_ADMIN” Am I reading this wrong or is this just a way of executing an arbitrary binary with uid=0 if you have both CAP_NET_ADMIN and CAP_SYS_ADMIN? If you can write modprobe_path, is it really news that you can find a way to execute code?
Right. `CAP_SYS_ADMIN` is for all intents and purposes equivalent to root.