Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Welcome to the Strip Mining Era of OSS Security

metabase.com

Post reply on HN
Print view View original

51–60 of 94 posts

Re: Welcome to the Strip Mining Era of OSS Security

#51

Post by jdiff »

bluGill wrote: post #27
ben_w wrote: post #18

Earlier quoted context omitted.

From what I've heard, every LLM before Mythos (which you can't get, they'll call you if you're big enough) will have far too many false positives to be helpful, so I guess the best option would be to use an agent to help you (not lights-off vibe coding!*) take advantage of all the older tools like valgrind and closing all the compiler warnings? * I presume I'm not the only one to find the agents tasked with adding un…

That is false. A year ago every LLM generated report was slop - more likely a false positive than correct. However in the past few months nearly every LLM generated report is real.

If your assertion of falsehood were true, the current top story on HN wouldn't be Turso shutting down their bug bounty due to overwhelming slop.

Re: Welcome to the Strip Mining Era of OSS Security

#52

Post by salsakran »

mtlynch wrote: post #42

> Most are not serious, and we’ve quietly fixed them, thanked the researcher, and went our merry way... These come from a wide variety of locations and people, and sometimes, but not always, are looking for bug bounties. I take it that Metabase is both not paying bug bounties and not using these tools internally? If that's the case, Metabase is not going to get meaningful investment from researchers who want to fix i…

Thankfully we've historically had a fair amount of attention (and investment in our security) by both customers, our oss users and people our ecosystem.

The interesting thing is that the business model seems to have changed. Why collect a 10k bounty when you can advertise a 3k/month scanner?

Re: Welcome to the Strip Mining Era of OSS Security

#53

Post by salsakran »

Macha wrote: post #39

> Did you have other plans for the weekend? Or a long term project you’re prioritizing? That’s nice, you have a new plan — fix every vulnerability that comes in NOW. Or you know, provide the security companies and businesses using your software for free with all the fix timelines and out of hours support they’ve paid for (none).

Yeah ... this gets into the question of what exactly an OSS creator's responsibility is towards users that don't pay them.

In theory, nothing.

In practice, it's in our long term interest that bad things don't happen to them.

How sustainable all of this is, I have my doubts?

Re: Welcome to the Strip Mining Era of OSS Security

#54

Post by ambicapter »

ahlCVA wrote: post #38

Whenever one of these vulnerability apocalypse posts comes along I cannot help but think of the Litany of Gendlin: What is true is already so. Owning up to it doesn't make it worse. Not being open about it doesn't make it go away. And because it's true, it is what is there to be interacted with. Anything untrue isn't there to be lived. People can stand what is true, for they are already enduring it. I cannot wrap my…

> Imagine somebody finding a flaw in a mathematical proof and everybody being sad because a beautiful proof got invalidated rather than being glad future work won't build on flawed assumptions.

Is this supposed to be hard to imagine? I can completely imagine this, especially if the mathematician is a celebrity in their field.

Re: Welcome to the Strip Mining Era of OSS Security

#55

Post by cyrusradfar »

I'd buy the core thesis and appreciate the concern.

I do think security is going to require more, not, less human investment as attackers may be running automated vulnerability screens from the outside that you must counter, as well. Without rigorous internal processes to manage and screen all changes and upgrades, companies risk leaving themselves open.

One design change which limits exposure is to have more local-first apps or experiences so there's less cloud / server to computer interactions to secure.

Re: Welcome to the Strip Mining Era of OSS Security

#57

Post by tptacek »

salsakran wrote: post #50
ahlCVA wrote: post #38

Whenever one of these vulnerability apocalypse posts comes along I cannot help but think of the Litany of Gendlin: What is true is already so. Owning up to it doesn't make it worse. Not being open about it doesn't make it go away. And because it's true, it is what is there to be interacted with. Anything untrue isn't there to be lived. People can stand what is true, for they are already enduring it. I cannot wrap my…

In theory, the vulnerability was always there, and it's better to find out than not find out. In practice, how much effort it is to find vulnerabilities matters a lot. We're in a time where things that used to be quite hard are now easy and the rate of discovery will change. This rate of discovery matters a lot -- for OSS maintainer burnout if nothing else.

It matters in a positive sense; it's a thing that enables you to make some predictions about the state of the world tomorrow. It does not matter in a normative sense; OSS maintainer burnout is strictly a less important concern than software security, which is an externality of software development.

Re: Welcome to the Strip Mining Era of OSS Security

#58

Post by Arainach »

tptacek wrote: post #57
salsakran wrote: post #50

Earlier quoted context omitted.

In theory, the vulnerability was always there, and it's better to find out than not find out. In practice, how much effort it is to find vulnerabilities matters a lot. We're in a time where things that used to be quite hard are now easy and the rate of discovery will change. This rate of discovery matters a lot -- for OSS maintainer burnout if nothing else.

It matters in a positive sense; it's a thing that enables you to make some predictions about the state of the world tomorrow. It does not matter in a normative sense; OSS maintainer burnout is strictly a less important concern than software security, which is an externality of software development.

> OSS maintainer burnout is strictly a less important concern than software security,

Burnout means that no more fixes come - ever - and that things sit vulnerable until everyone relying on that tool takes the time to build and switch to a replacement.

Maintainer burnout is perhaps the single biggest threat to the ecosystem right now.

Re: Welcome to the Strip Mining Era of OSS Security

#59

Post by tptacek »

Arainach wrote: post #58
tptacek wrote: post #57

Earlier quoted context omitted.

It matters in a positive sense; it's a thing that enables you to make some predictions about the state of the world tomorrow. It does not matter in a normative sense; OSS maintainer burnout is strictly a less important concern than software security, which is an externality of software development.

> OSS maintainer burnout is strictly a less important concern than software security, Burnout means that no more fixes come - ever - and that things sit vulnerable until everyone relying on that tool takes the time to build and switch to a replacement. Maintainer burnout is perhaps the single biggest threat to the ecosystem right now.

That can't possibly be an argument for forbearing security vulnerabilities in software. It's an argument for prioritizing hypothetical flaws over real ones.

Re: Welcome to the Strip Mining Era of OSS Security

#60

Post by bluGill »

jdiff wrote: post #51
bluGill wrote: post #27

Earlier quoted context omitted.

That is false. A year ago every LLM generated report was slop - more likely a false positive than correct. However in the past few months nearly every LLM generated report is real.

If your assertion of falsehood were true, the current top story on HN wouldn't be Turso shutting down their bug bounty due to overwhelming slop.

Everyone is going to see different results. Overall the general trend is AI is getting better. Although that might be partially people are shutting down their bounty programs which gives the incentive to generate slop.
Post reply on HN