Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vulnerability reports are not special anymore

words.filippo.io

Post reply on HN
Print view View original

51–60 of 249 posts

Re: Vulnerability reports are not special anymore

#51

Post by jamesfinlayson »

themanmaran wrote: post #30
Gigachad wrote: post #6

Earlier quoted context omitted.

I'm getting CVE fatigue with all of these super ultra critical 10/10 vulnerabilities that are some node package that compiles my frontend can get stuck if I give it a malicious regex. It's hard to spot the stuff that actually matters.

Seriously. We got 116 github dependabot alerts this week. Half of them for dev dependencies.

I tried to raise that with my internal security team recently - don't clutter my vulnerability dashboard with issues in dev dependencies. They somewhat rightly pointed out that malware needs to be dealt even if it's a dev dependency. So my suggestion went nowhere because I guess we can't filter by type of vulnerability.

Re: Vulnerability reports are not special anymore

#52

Post by crote »

bawolff wrote: post #13
user3939382 wrote: post #10

Earlier quoted context omitted.

Verifying correctness of an implementation is P NP, not serious CS research.

Verifying behaviour of an arbitrary program is uncomputable. However that doesnt mean you can't have proofs of behaviour of specific programs you create. Personally i have some doubts, a lot of research has gone into the idea without much to show for it, but its a very reasonable research area.

I fear it'll just move the problem one layer up. Sure, you've now proven that the code matches the specification - but how do you ensure the specification is watertight?

Re: Vulnerability reports are not special anymore

#53

Post by inigyou »

lemagedurage wrote: post #50
cleverfoo wrote: post #5

Earlier quoted context omitted.

Same experience here. I've run a successful vulnerability disclosure program for over a decade and paid out thousands of dollars in bounties for scanii.com (a malware identification API service), but recently (since the beginning of the year), we went from receiving maybe 5 per month to receiving 5 per day. These are clearly AI-generated and extremely low quality (albeit well-written). The rules of the program aren't…

Have you considered requiring a small payment for vulnerability disclosure? Refund it on payout. This should be very effective at deterring spammers. It also sucks for real reports, but beats shutting down the program entirely.

Why would anyone pay money to have a chance of being arrested?

Re: Vulnerability reports are not special anymore

#54

Post by jamesfinlayson »

Gigachad wrote: post #6
themanmaran wrote: post #2

I feel like it's also been overrun by a lot of spam. As someone running a company, I get 2-5 unsolicited "vulnerability reports" per week. Half of them are an LLM finding some bad CSS on our framer splash page. The other half I assume are an extortion attempt so we just mark as spam. Occasionally I see real security researchers on HN complaining that no one takes the disclosure seriously, or that people reply immedia…

I'm getting CVE fatigue with all of these super ultra critical 10/10 vulnerabilities that are some node package that compiles my frontend can get stuck if I give it a malicious regex. It's hard to spot the stuff that actually matters.

Yep. I remember years ago seeing the website for some guy who proudly listed all the CVEs he'd discovered. Clearly he'd written some scanning tool to look at regexes in open source projects and was creating CVEs for anything that might result in exponential time execution or whatever.

Re: Vulnerability reports are not special anymore

#55

Post by jcgrillo »

shakna wrote: post #48
david_shaw wrote: post #8

At risk of quoting too much of the article, it opens with this: > A requirement for staying sane while working in public as an open source maintainer is realizing that every issue, PR, and piece of feedback is a present, not an obligation. You can accept it, ignore it, and use it partially or not at all. > Except… > For years, as lead of the Go Security team at the time, I’ve told new team members that it doesn’t app…

> But that won't last forever, either. As LLMs find increasingly difficult-to-find vulnerabilities, there will be fewer of them to report. That is not my experience at all. People will continue to high-volume spam intended behaviour as if it is a bug. There will be fewer reports that matter as you fix things - but the volume of reports will either stay steady or go up. Making it harder to even notice the ones that ma…

The problem always existed, but nobody amassed a sufficiently large army of trolls to exploit it until now. So it wasn't a priority to solve it before, but now it is. We're going to have to learn to differentiate reports that matter from those that don't. Classifying reports might actually be something you could productively use an LLM for..

Re: Vulnerability reports are not special anymore

#56

Post by inigyou »

whimblepop wrote: post #19
cadamsdotcom wrote: post #4

Security through obscurity was never a great strategy.. and now it’s not a strategy at all.. Hopefully at the end of this decade, a ton of software practices have been overhauled to eliminate classes of problems. Memory-safe language use is a great start - but it’d be great to see innovation in checking for TOCTOU problems, improper/missing authn & authz, and many others. This is an engineering problem. It won’t be s…

Almost never do software companies even attempt to design secure systems. I'm not sure this requires new fundamental research so much as slightly giving a shit.

There is a reason Mythos only found one bug in curl and it wasn't very bad.

Re: Vulnerability reports are not special anymore

#57

Post by jacobgold »

themanmaran wrote: post #2

I feel like it's also been overrun by a lot of spam. As someone running a company, I get 2-5 unsolicited "vulnerability reports" per week. Half of them are an LLM finding some bad CSS on our framer splash page. The other half I assume are an extortion attempt so we just mark as spam. Occasionally I see real security researchers on HN complaining that no one takes the disclosure seriously, or that people reply immedia…

I hated these low-effort reports, so I created a simple automation that checks my security inbox, mentions me in #security on Slack for things that look legitimate so I see them quickly, and marks things that seem entirely automated as spam.

I still check the spam folder for legitimate emails, but so far there haven't been any false positives.

Re: Vulnerability reports are not special anymore

#58

Post by lemagedurage »

inigyou wrote: post #53
lemagedurage wrote: post #50

Earlier quoted context omitted.

Have you considered requiring a small payment for vulnerability disclosure? Refund it on payout. This should be very effective at deterring spammers. It also sucks for real reports, but beats shutting down the program entirely.

Why would anyone pay money to have a chance of being arrested?

If a vulnerability disclosure program has a good track record of paying out, and legitimate reports get refunded, why not?

Again, the alternative might be shutting down the program entirely.

Re: Vulnerability reports are not special anymore

#60

Post by inigyou »

calvinmorrison wrote: post #11
zeveb wrote: post #9

> If a security vulnerability is reported by someone who is also violating the CoC, what do you do? Do you ignore it? Fix it silently? Is this even a question? You triage and fix the vulnerability just like any other one. Are truths spoken by folks one dislikes — even for perfectly valid reasons — any less true? The only way I can imagine this somehow applying is if someone has a habit of reporting vulnerabilities wh…

Will xorg backport patches from Xlibre?

No, because xorg is a dead project that doesn't take any patches from anywhere and xlibre has shit code quality and is probably vibecoded now
Post reply on HN