Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vulnerability reports are not special anymore

words.filippo.io

Post reply on HN
Print view View original

171–180 of 249 posts

Re: Vulnerability reports are not special anymore

#171

Post by jeroenhd »

socalgal2 wrote: post #34

I feel like the current situation is temporary. LLMs are finding all the bugs. LLMs are also help fixing most of the bugs. Once most of the bugs are fixed, LLMs should be good at finding bugs before shipping them, the stream of bug reports will die down, and we'll be back to vulnerabiltiy reports being special. Further, the fact that bugs are so easy to find by LLMs means there is strong incentives to find ways to mi…

LLMs are finding bugs where there aren't any and wasting human time trying to disprove the slop.

If all LLM reports were accurate, they'd be of any value. However, that's not what is happening. If you have even mentioned something about a bug bounty anywhere, waves of slop peddlers will flood you with fake reports marking every minor bug as a critical problem, hoping to catch a handful of dollars in the process.

These models do find some problems and may even provide decent suggestions to fix them (though they really want to add code above anything else, quickly leading to spaghetti if you accept it all). That's not the issue at the moment, and as long as people try to incentivize people to report bugs, the issue will remain.

I do expect this to be temporary, though. Not because LLMs will fix all the bugs, but because the flood of slop will shut down most public bug bounties.

Re: Vulnerability reports are not special anymore

#172

Post by FiloSottile »

jupenur wrote: post #124

This whole blog post makes me sad. I've been active on both sides of the vulnerability disclosure process for well over a decade and have reported a whole bunch [1] of security bugs to the Go security team. I was there back when Filippo was running the show and have continued since Roland took over. My experience with the people there has always been great. > Ultimately, it all stems from our responsibility to our us…

Thanks for the comment, I was actually hoping to get your take on this! I linked to it from the article.

> Still on Hacker News, Juho Forsén, one of the most prolific reporters of Go security issues, wrote a long interesting comment that makes the argument that instead we should lean harder into trust relationships with individual researchers. It'd certainly be worth it with Juho, in retrospect, but it's unclear if it would pay off often enough, in the same way that training new contributors who might leave the project in a month or two is not always worth it.

Re: Vulnerability reports are not special anymore

#173

Post by ttoinou »

cadamsdotcom wrote: post #160
jstimpfle wrote: post #147

Earlier quoted context omitted.

It might just mean the opposite. Unergonomic and/or slow memory safe languages might not be needed anymore at some point, because LLM can check for reasonable programming patterns and can do some amount of vulnerability checking upfront. But seriously the first point -- as long as you keep to a known set of reasonable patterns (much larger set than the sets accepted by restrictive and cumbersome type systems), memory…

> can reliably find some Some. In software & in security, 99% is a failing grade. So is 99.99%, so is 99.999%, and any other amount less than 100%. It’s not enough to point 5 LLMs at it and it’s not enough to point 500 LLMs at it. The field needs to seek deterministic & comprehensive solutions to whole problem classes.

Okay, so the whole world is failing and success doesn't exist.

Maybe now you need a better criteria than your previous failure / success_100%_infiniteCost to observe and understand the the world

Re: Vulnerability reports are not special anymore

#174

Post by bcjdjsndon »

naturalmovement wrote: post #40

Linus Torvalds once went on record saying security vulnerabilities are no more important than regular bugs. This of course made vulnerability researchers seethe worse than aggrieved Redditors. It turns out he was right all along. The author also gets it wrong by assuming that regular bug reporters are not "providing a service". They are. When I wrote up a bug report, I made sure it's thorough with detailed steps to r…

[flagged]

Re: Vulnerability reports are not special anymore

#175

Post by ozim »

inigyou wrote: post #142
ozim wrote: post #107

Earlier quoted context omitted.

Making, payment/refund setup is more complicated than „set and forget”. First question: Do you keep money for shit reports? Well no, you have to pay it back like credit card validation. There is no pain for posting shit report just inconvenience. There is no legal way where you can keep the money.

Why not?

Because you are not providing any service not selling anything. There is no real way as a company to withhold someone’s money and that it goes through accounting.

I am not an accountant so ask some accountants why not.

Re: Vulnerability reports are not special anymore

#176

Post by torginus »

I wonder if LLM's 'jagged intelligence' will come to bite here again. AI might be better at finding certain kind of bugs, to the degree outperfoming the best humans, but that doesn't mean a skilled human can't find an issue which is hard for LLMs incredibly easily.

Re: Vulnerability reports are not special anymore

#177

Post by himata4113 »

esperent wrote: post #164
himata4113 wrote: post #154

Earlier quoted context omitted.

This is where you're wrong, I ran an experiment and told it to find bugs in a ~200 LoC project. The models are tuned in a way to where they're expected to generate issue reports so a codebase that had zero bugs, zero vulnerabilities and zero changes needed it found 3 low severity issues (cosmetic) 1 medium severity issue and 1 critical severity issue. The critical severity issue was accepting unvalidated user input,…

Did you make any attempt at tuning the prompt to reduce false positives? Or did you just say "find bugs"? Because if you tell it to do that, it will.

The point I was trying to make is that there will always be people reporting "critical" bugs.

Re: Vulnerability reports are not special anymore

#178

Post by paddybyers »

FiloSottile wrote: post #172
jupenur wrote: post #124

This whole blog post makes me sad. I've been active on both sides of the vulnerability disclosure process for well over a decade and have reported a whole bunch [1] of security bugs to the Go security team. I was there back when Filippo was running the show and have continued since Roland took over. My experience with the people there has always been great. > Ultimately, it all stems from our responsibility to our us…

Thanks for the comment, I was actually hoping to get your take on this! I linked to it from the article. > Still on Hacker News, Juho Forsén, one of the most prolific reporters of Go security issues, wrote a long interesting comment that makes the argument that instead we should lean harder into trust relationships with individual researchers. It'd certainly be worth it with Juho, in retrospect, but it's unclear if i…

I've run a disclosure program for ~7 years, which is an open paid program. However, over that time we've developed relationships with the most active and successful contributors, to the point that we'll now give them early access to new features to try out (all still paid for on the basis of rewards for problems found). This is proving especially valuable now in triaging the new deluge of noise from impactful issues.
Post reply on HN