Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Welcome to the Strip Mining Era of OSS Security

metabase.com

Post reply on HN
Print view View original

61–70 of 94 posts

Re: Welcome to the Strip Mining Era of OSS Security

#61

Post by salsakran »

tptacek wrote: post #57
salsakran wrote: post #50

Earlier quoted context omitted.

In theory, the vulnerability was always there, and it's better to find out than not find out. In practice, how much effort it is to find vulnerabilities matters a lot. We're in a time where things that used to be quite hard are now easy and the rate of discovery will change. This rate of discovery matters a lot -- for OSS maintainer burnout if nothing else.

It matters in a positive sense; it's a thing that enables you to make some predictions about the state of the world tomorrow. It does not matter in a normative sense; OSS maintainer burnout is strictly a less important concern than software security, which is an externality of software development.

Stated differently -- the way OSS software is currently maintained and users are conditioned to behave, there is a capacity problem if the rate of discovery surges too sharply.

And if the capacity is overshot (which I believe is happening as we speak), users end up in extended states of being insecure.

I'm also one of the unwashed rabble who believes there is a large practical difference between a vulnerability that exists but isn't found and one that is widely known and exploitable.

Re: Welcome to the Strip Mining Era of OSS Security

#62

Post by ctoth »

_alternator_ wrote: post #46
ahlCVA wrote: post #38

Whenever one of these vulnerability apocalypse posts comes along I cannot help but think of the Litany of Gendlin: What is true is already so. Owning up to it doesn't make it worse. Not being open about it doesn't make it go away. And because it's true, it is what is there to be interacted with. Anything untrue isn't there to be lived. People can stand what is true, for they are already enduring it. I cannot wrap my…

To address this framing directly: "a bug exists" is a different truth/state of the world than "the bug is known to exist", and that's also very different from "this bug exists and an exploit is readily available". So the transmission of information about the bugs does change the state of the world, and requires action.

A bug existing or not for a person is a statement about that person's knowledge of the bug.

Is your assertion that, since you specifically didn't know about the bugs that nobody, not in Russia or anywhere else did?

Obviously if bugs are out there existing in software and you don't know about them, or the CVE system doesn't know about them, or whatever ... this does not preclude bad guys from knowing about them. In the era of agents, knowing the bug exists is equivalent to having a PoC, so the distinction completely collapses.

Re: Welcome to the Strip Mining Era of OSS Security

#63

Post by synarchefriend »

4ladf1 wrote: post #25
bluGill wrote: post #19

Earlier quoted context omitted.

Mythos found only one issue in curl - but it didn't start until many other LLMs had been run and found a lot of issues that were fixed. If Mythos was run a year ago it would have found over 100 issues (of course it didn't exist a year ago, nor did the other tools).

Curl had many old protocols and code from the 1990s that no one used. Besides, Mythos was claimed to be better than existing tools. In most open source projects, Mythos or similar tools have found nothing. The AI people only contact the projects where they find something, because it would be bad for marketing otherwise.

Do you even believe this cope in your heart? With each month that passes you're going to keep seeing increasingly advanced bugs and mathematical proofs found by AI. And you'll have to keep coming up with increasingly silly excuses why that isn't real progress. Maybe save yourself the cognitive dissonance and face reality now. It's not just a parrot.

Re: Welcome to the Strip Mining Era of OSS Security

#64

Post by pessimizer »

jdiff wrote: post #51
bluGill wrote: post #27

Earlier quoted context omitted.

That is false. A year ago every LLM generated report was slop - more likely a false positive than correct. However in the past few months nearly every LLM generated report is real.

If your assertion of falsehood were true, the current top story on HN wouldn't be Turso shutting down their bug bounty due to overwhelming slop.

This is not good reasoning. You're offloading your thinking to "Turso" for some reason.

You're also assuming that they haven't made the alternative judgement that instead of triaging the haystack of slop that they get in order to potentially pay out to someone, they should instead be spending that cash and effort on tokens to find bugs in their own codebase.

Re: Welcome to the Strip Mining Era of OSS Security

#65

Post by tptacek »

salsakran wrote: post #61
tptacek wrote: post #57

Earlier quoted context omitted.

It matters in a positive sense; it's a thing that enables you to make some predictions about the state of the world tomorrow. It does not matter in a normative sense; OSS maintainer burnout is strictly a less important concern than software security, which is an externality of software development.

Stated differently -- the way OSS software is currently maintained and users are conditioned to behave, there is a capacity problem if the rate of discovery surges too sharply. And if the capacity is overshot (which I believe is happening as we speak), users end up in extended states of being insecure. I'm also one of the unwashed rabble who believes there is a large practical difference between a vulnerability that…

There's two fallacious arguments encoded here. The first is obvious, that we should prioritize hypothetical future vulnerabilities and fixes over ones we know exist today. The second is subtler and more insidious: it's the idea that the goal of software is to ensure every package and project is viable, that everyone who wants to deploy it should be able to do so. The risks this attitude pose to users, ordinary people who have no agency over which software packages you use to serve their needs, are a pure externality. The idea that a project serving real human users might opt to compromise availability rather than putting people at risk is never even broached.

Re: Welcome to the Strip Mining Era of OSS Security

#66

Post by graceful6800 »

_alternator_ wrote: post #46
ahlCVA wrote: post #38

Whenever one of these vulnerability apocalypse posts comes along I cannot help but think of the Litany of Gendlin: What is true is already so. Owning up to it doesn't make it worse. Not being open about it doesn't make it go away. And because it's true, it is what is there to be interacted with. Anything untrue isn't there to be lived. People can stand what is true, for they are already enduring it. I cannot wrap my…

To address this framing directly: "a bug exists" is a different truth/state of the world than "the bug is known to exist", and that's also very different from "this bug exists and an exploit is readily available". So the transmission of information about the bugs does change the state of the world, and requires action.

There are actually three states:

- A bug exists and nobody knows

- A bug exists and some people know

- A bug exists and everyone knows

As an outside observer, there is no way for you to determine if a bug is in state one or two, you only know once it's in the third state.

Which is the entire problem here. Having the bug be known to everyone is a vastly improved state over being known to a few. Yes, the bug being completely unknown is better than being known to a few, but there is no way to ever know if that's the case.

From the outside, known to none and known to a few are indistinguishable, and thus both states are the worst possible case. The only remedy is to make the bug known to everyone such that it cannot be covertly exploited.

Re: Welcome to the Strip Mining Era of OSS Security

#67

Post by likesHumidity »

I think this is going to play out in interesting ways. There's a saying in lockpicking: even if you can pick the lock, the easiest way in is usually a window. Distribution is core to a technology's market reach, and every distribution point is a window. The strip-mining piece reads to me as one phase of a longer cycle — tech distributed → adopted → experimented with → misused → secondary protection market emerges. The 2017 S3 misconfiguration wave is a useful reference: Verizon and Booz Allen both spilled data through bucket ACLs with inadequate controls, AWS responded with Block Public Access, and the CSPM market matured to sell the discipline back. Mythos looks like the same shape at the AI layer — leaked via vendor environment chain (Mercor breach + contractor credentials + URL guessing), not code-level vulnerability. The proliferation of high-quality security research the article points at reads to me as one sign of the secondary market forming as the primary disruptive technology stabilizes — Gartner already has AI governance spending crossing $1B by 2030. And it seems to be landing on OSS first because that's where the surface area and public exposure are, which is what the labor pressure is documenting. Cascade to closed source seems likely as the compression between vulnerability-introduced and vulnerability-identified continues, just on a lag and behind NDAs. The OSS side could go either way under that pressure, and I don't know which dominates. FFmpeg slowed in 2024 from overload and got rescued by Germany's Sovereign Tech Fund — pressure converted into hardened posture. Ingress-Nginx retired November 2025 after two maintainers couldn't sustain it on weekends, despite running in ~50% of cloud-native environments — same pressure, no backing. Tracks institutional backing more than anything intrinsic to OSS. The wrinkle Mythos adds: same product is both weapon and salve. Pay to run it against your own systems, or be vulnerable to what it finds in everyone else's — discovery and protection collapsed into one SKU. We'll need to watch the locksmiths to see if they end up selling lockpicks in addition to keys. Going to be an interesting summer.

Re: Welcome to the Strip Mining Era of OSS Security

#68

Post by bawolff »

_alternator_ wrote: post #46
ahlCVA wrote: post #38

Whenever one of these vulnerability apocalypse posts comes along I cannot help but think of the Litany of Gendlin: What is true is already so. Owning up to it doesn't make it worse. Not being open about it doesn't make it go away. And because it's true, it is what is there to be interacted with. Anything untrue isn't there to be lived. People can stand what is true, for they are already enduring it. I cannot wrap my…

To address this framing directly: "a bug exists" is a different truth/state of the world than "the bug is known to exist", and that's also very different from "this bug exists and an exploit is readily available". So the transmission of information about the bugs does change the state of the world, and requires action.

Arguably, the transition goes from - this bug exists but vendors ignore it because only criminals and intelligence agencies know about it to, this bug is publicly embarassing lets fix it right away.

Sweeping things under the rug is how we get insecurity. Sunshine is the best disinfectant.

Re: Welcome to the Strip Mining Era of OSS Security

#69

Post by Arainach »

tptacek wrote: post #59
Arainach wrote: post #58

Earlier quoted context omitted.

> OSS maintainer burnout is strictly a less important concern than software security, Burnout means that no more fixes come - ever - and that things sit vulnerable until everyone relying on that tool takes the time to build and switch to a replacement. Maintainer burnout is perhaps the single biggest threat to the ecosystem right now.

That can't possibly be an argument for forbearing security vulnerabilities in software. It's an argument for prioritizing hypothetical flaws over real ones.

If these flaws are so important, users of open source (business or individual) need to pay up - literally. Pay the maintainers enough to justify spending the time on these things, including the opportunity cost of not working at other software jobs during that time.

Pay each maintainer an absolute minimum of $200K a year or shut up and do the work yourself - in a fork if necessary.

Re: Welcome to the Strip Mining Era of OSS Security

#70

Post by ajross »

ahlCVA wrote: post #38

Whenever one of these vulnerability apocalypse posts comes along I cannot help but think of the Litany of Gendlin: What is true is already so. Owning up to it doesn't make it worse. Not being open about it doesn't make it go away. And because it's true, it is what is there to be interacted with. Anything untrue isn't there to be lived. People can stand what is true, for they are already enduring it. I cannot wrap my…

> The code already was broken before somebody published the vulnerability. The difference now only is that you know about this.

The philosophy in this subthread may be too deep for me.

Me and the Jedi at the ends of the bell curve are just thinking "It's bad when your attackers know your code is vulnerable"

Post reply on HN