Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Just the rumour of a bug is enough to find an exploit these days

anil.recoil.org

Post reply on HN
Print view View original

51–60 of 141 posts

Re: Just the rumour of a bug is enough to find an exploit these days

#51

Post by VladVladikoff »

novia wrote: post #27
godelski wrote: post #6

It's easier to find bugs, fix them, yet there's less will than ever. My bosses just want speed and will give me a 30 minute lecture on why I don't need to solve a bug that Claude solved in 5 minutes, I've verified, and it's already in an open PR. All the while we're pushing out bugs faster and faster. No matter how good AI gets at fixing bugs we'll never fix them when there's no will to fix things. Software will neve…

!!! You described my experience in the workforce to a t! So frustrating that tech managers look at tech debt as a thing to be maintained at a certain level instead of allowing us to achieve perfection

Perfection is the enemy of progress. There will always be a balancing act.

Re: Just the rumour of a bug is enough to find an exploit these days

#52

Post by swiftcoder »

odo1242 wrote: post #25
flanked-evergl wrote: post #11

Earlier quoted context omitted.

What law says software may not have bugs?!

Not explicitly laws, but like contracts, regulatory requirements, SLAs all indirectly enforce that

Well, they at least say that one is obligated to address bugs in a timely manner (where "not widely exploitable; won't fix" is a perfectly valid resolution).

Re: Just the rumour of a bug is enough to find an exploit these days

#53

Post by evilduck »

novia wrote: post #27
godelski wrote: post #6

It's easier to find bugs, fix them, yet there's less will than ever. My bosses just want speed and will give me a 30 minute lecture on why I don't need to solve a bug that Claude solved in 5 minutes, I've verified, and it's already in an open PR. All the while we're pushing out bugs faster and faster. No matter how good AI gets at fixing bugs we'll never fix them when there's no will to fix things. Software will neve…

!!! You described my experience in the workforce to a t! So frustrating that tech managers look at tech debt as a thing to be maintained at a certain level instead of allowing us to achieve perfection

Your tech manager is likely very aware of the imperfections and is making prioritizations and compromises to keep you employed.

Re: Just the rumour of a bug is enough to find an exploit these days

#54

Post by pixl97 »

x______________ wrote: post #46
nickcw wrote: post #3

This describes my life as an open source maintainer at the moment! In the first 10 years of the rclone project we received about 20 security disclosures through GitHub. We had to deal with over 40 in the last month! That has taken a huge amount of my time, even using AI tools to triage and come up with fixes for review. The hit rate for those security disclosures is pretty good - about 75% of them have a nugget of so…

> Not sure what the solution is Possibly some sort of ai agent code review system that churns through code looking for these vulns before the code is published. It feels like it's all about who has the resources to find bugs at the moment but that it should be a standard to catch issues before prod moving forward..

Yea, AI bug finding over entire projects, at least on SOTA models is super expensive, hence those with the resources setup to find the most bugs in an automated way.

That said there are a number of people and companies working on more focused means of driving the LLM to look were bugs would be the most dangerous and in doing so reduce the token spend of each bug found.

In some ways the better you are at security stuff the more you can reduce your spend by better driving the LLM to problem spots.

Re: Just the rumour of a bug is enough to find an exploit these days

#55

Post by illiac786 »

elmer2 wrote: post #50
godelski wrote: post #6

It's easier to find bugs, fix them, yet there's less will than ever. My bosses just want speed and will give me a 30 minute lecture on why I don't need to solve a bug that Claude solved in 5 minutes, I've verified, and it's already in an open PR. All the while we're pushing out bugs faster and faster. No matter how good AI gets at fixing bugs we'll never fix them when there's no will to fix things. Software will neve…

Something that might come out of all of this is that companies that previously slow rolled security fixes will now be forced to fix them quickly, because the speed of AI and the liability of being insecure.

Depends on the jurisdiction. Where I live, companies are not liable for insecure software, if sold to a private person for example. Enter huge botnets of crappy home routers. Hopefully this is going to change.

Re: Just the rumour of a bug is enough to find an exploit these days

#56

Post by pixl97 »

elmer2 wrote: post #50
godelski wrote: post #6

It's easier to find bugs, fix them, yet there's less will than ever. My bosses just want speed and will give me a 30 minute lecture on why I don't need to solve a bug that Claude solved in 5 minutes, I've verified, and it's already in an open PR. All the while we're pushing out bugs faster and faster. No matter how good AI gets at fixing bugs we'll never fix them when there's no will to fix things. Software will neve…

Something that might come out of all of this is that companies that previously slow rolled security fixes will now be forced to fix them quickly, because the speed of AI and the liability of being insecure.

Yea, when their cyber insurance policies start biting them because AI found a bug months ago and it was never fixed I figure we'll start seeing a change.

With that said there are numerous companies that are very concerned about the situation. They know AI is finding bugs in their software at an accelerated rate, one they are having difficult times keeping up with because they want human understanding and review of the fixes to avoid introducing new bugs.

Re: Just the rumour of a bug is enough to find an exploit these days

#57

Post by ftchd »

nickcw wrote: post #3

This describes my life as an open source maintainer at the moment! In the first 10 years of the rclone project we received about 20 security disclosures through GitHub. We had to deal with over 40 in the last month! That has taken a huge amount of my time, even using AI tools to triage and come up with fixes for review. The hit rate for those security disclosures is pretty good - about 75% of them have a nugget of so…

> I was considering just merging the fixes straight to master just to make my life easier

I felt that. The problem with doing that is you hate yourself afterwards so not a good solution either, gotta do it properly.

Thanks for working on rclone, Nick!

Re: Just the rumour of a bug is enough to find an exploit these days

#60

Post by 29349175 »

"This particular report arrived privately on a Slack channel via Jane Street last week, and was itself found via Claude Fable. That compresses all timelines considerably..."

So Fable knew about it. Maybe someone is running experiments again like in OpenAI's Huggingface hack.

Cute to see that the Glasswing apparatchiks still protect their income stream and hand out no accesse.

Post reply on HN