Live data from Hacker News

Just the rumour of a bug is enough to find an exploit these days

anil.recoil.org

81–90 of 141 posts

Re: Just the rumour of a bug is enough to find an exploit these days

#81
post #6

It's easier to find bugs, fix them, yet there's less will than ever. My bosses just want speed and will give me a 30 minute lecture on why I don't need to solve a bug that Claude solved in 5 minutes, I've verified, and it's already in an open PR. All the while we're pushing out bugs faster and faster. No matter how good AI gets at fixing bugs we'll never fix them when there's no will to fix things. Software will neve…

I spent about a decade coding, then half a decade in QA. QA has always been a thorn in everyone's side. The amount of money some companies spend on these departments just to ignore them is wild.

Now we've got an ability to push code out faster than ever, and absolutely zero innovation for QA. You simply cannot trust AI to verify your code is working. You can't have Quality Assurance without some form of assurance. So you're either hiring twice as many QA guys for the 10x output, or you're mostly ignoring the idea.

Economics has bubbles. Does computer science? Anyways, screw this. I'm moving to nursing.

Re: Just the rumour of a bug is enough to find an exploit these days

#82
post #81
post #6

It's easier to find bugs, fix them, yet there's less will than ever. My bosses just want speed and will give me a 30 minute lecture on why I don't need to solve a bug that Claude solved in 5 minutes, I've verified, and it's already in an open PR. All the while we're pushing out bugs faster and faster. No matter how good AI gets at fixing bugs we'll never fix them when there's no will to fix things. Software will neve…

I spent about a decade coding, then half a decade in QA. QA has always been a thorn in everyone's side. The amount of money some companies spend on these departments just to ignore them is wild. Now we've got an ability to push code out faster than ever, and absolutely zero innovation for QA. You simply cannot trust AI to verify your code is working. You can't have Quality Assurance without some form of assurance. So…

Unfortunately, in many smaller companies, QA is no longer even a separate entity. It is foisted upon developers (and sometimes PMs.) It went the way of agile, similar to sysadmins and DBAs.

Re: Just the rumour of a bug is enough to find an exploit these days

#83

Earlier quoted context omitted.

You haven't worked at conservative software shops I guess. The last place I worked at had this huge song and dance with you trying to raise a PR that looked irrelevant to the task at hand would lead to meeting with your lead dev, your manager and your skip level as you tried to explain why the bug needs fixing... The worst one was where I fixed a datetime bug and although it had been sending out false alerts, I was a…

But, isn’t it our job to impress upon the managers the importance, in a certain regard? Alternatively, what about just doing the right thing? Either you convince them to take this stuff seriously or you find alternate employment. How can you subject yourself to the moral degradation and conflict of principles? I could understand for someone with no other financial options, or in some sort of oppressive culture/econom…

  > But, isn’t it our job to impress upon the managers the importance, in a certain regard?
I think it is. But this appears to be an unpopular opinion and I'm not sure why. The question I'm still unsure about is if managers realize they are surrounding themselves with "yes men". The other question I'm still unsure about is if people realizing that not saying "no" (or "yes, but") is not meaningfully different from being a "yes man".

Our job is to engineer. Our job is to build (good) products. Information can't just flow top down, it has to go the other way too.

What seems weird to me is that during "the good times" in our field, that happened more frequently. A strong employee market (as opposed to an /employeer/ market) seemed to be good for employee, employeer, and the people buying everything. But myopia is quick to set in.

  > Alternatively, what about just doing the right thing?
That's the main motivation of why I speak up. There are consequences to our actions. Our choices may have small or little influence, but unfortunately the problem is that the world is complicated. The problems we face are mainly composed of many small issues that add up. I am surprised this is more contentious in places like HN as we deal with this every day. The way we solve big problems is we break them down into many different small and manageable problems. The only difference here is that we're viewing things bottom up rather than explicitly breaking them down. Though that is harder to figure out which small problems add up to the big problem. But we deal with this type of problem solving in programming all the time too.

If you haven't heard it before, allow me to introduce you to Pournelle's Iron Law of Bureaucracy[0]. I think one of the important things it states is that the second group is actually bad for business. I think there's a common misconception. People are often saying "well it is good for business", pointing to all kinds of messed up shit. I don't buy that. It is myopically good for business, but not in any meaningful length of time. Though then again, as Buffet says "The market can stay irrational longer than you can stay solvent." Michael Burry famous learned this first hand.

[0] https://www.jerrypournelle.com/reports/jerryp/iron.html

  In any bureaucratic organization there will be two kinds of people:
    -  First, there will be those who are devoted to the goals of the organization. Examples are dedicated classroom teachers in an educational bureaucracy, many of the engineers and launch technicians and scientists at NASA, even some agricultural scientists and advisors in the former Soviet Union collective farming administration.
    - Secondly, there will be those dedicated to the organization itself. Examples are many of the administrators in the education system, many professors of education, many teachers union officials, much of the NASA headquarters staff, etc.
  The Iron Law states that in every case the second group will gain and keep control of the organization. It will write the rules, and control promotions within the organization.

Re: Just the rumour of a bug is enough to find an exploit these days

#84

I built a tool that monitors commits and tries to detect silent bug fixes. With GPT-5.5-class models, it can identify fixes hidden within otherwise routine commits quite reliably. Obfuscating the code changes enough to avoid detection is difficult. I have heard of at least one project (c-lightning?) temporarily releasing a closed-source binary as a workaround until users could update safely.

People are trying to secretly fix bugs?

Yes, they don't want the vulnerabilities exposed so they ship the fix in secret, contained in unrelated features.

Re: Just the rumour of a bug is enough to find an exploit these days

#85

Earlier quoted context omitted.

You haven't worked at conservative software shops I guess. The last place I worked at had this huge song and dance with you trying to raise a PR that looked irrelevant to the task at hand would lead to meeting with your lead dev, your manager and your skip level as you tried to explain why the bug needs fixing... The worst one was where I fixed a datetime bug and although it had been sending out false alerts, I was a…

But, isn’t it our job to impress upon the managers the importance, in a certain regard? Alternatively, what about just doing the right thing? Either you convince them to take this stuff seriously or you find alternate employment. How can you subject yourself to the moral degradation and conflict of principles? I could understand for someone with no other financial options, or in some sort of oppressive culture/econom…

[deleted]

Re: Just the rumour of a bug is enough to find an exploit these days

#86
post #16

Earlier quoted context omitted.

Thank you for making and maintaining rclone. It is truly a blessing.

I came across rclone at work because "Copy or move data to Azure Storage by using AzCopy v10" is a lie, it literally can't `move` files, only `copy` them. I can't express in polite words how pathetic it is to see the only official blob storage bulk transfer CLI tool from a multi-trillion-dollar company fail to do the simplest, most essential functionality after ten major revisions. Meanwhile, rclone Just Works(tm). T…

Do not try and move the files; that's impossible. Instead, only try to realize the truth... Delete them after you copy.

Re: Just the rumour of a bug is enough to find an exploit these days

#87
post #6

It's easier to find bugs, fix them, yet there's less will than ever. My bosses just want speed and will give me a 30 minute lecture on why I don't need to solve a bug that Claude solved in 5 minutes, I've verified, and it's already in an open PR. All the while we're pushing out bugs faster and faster. No matter how good AI gets at fixing bugs we'll never fix them when there's no will to fix things. Software will neve…

It is not "will" it always is money.

There was an article some days ago where someone was claiming "with AI only you decide how many bugs you have" — well no the same forces apply because tokens are not free and business wants to do stuff that directly earns money.

Well we have to make cases and measure where the bug costs money and how. Lots of bugs are irrelevant and not blocking people from using the software. If bug doesn't drop database but is "dropdown doesn't exactly align" or "given precodnitions A,B and C something bad will happen" while A, B and C have very small possibility of occuring.

Re: Just the rumour of a bug is enough to find an exploit these days

#88
post #86

Earlier quoted context omitted.

I came across rclone at work because "Copy or move data to Azure Storage by using AzCopy v10" is a lie, it literally can't `move` files, only `copy` them. I can't express in polite words how pathetic it is to see the only official blob storage bulk transfer CLI tool from a multi-trillion-dollar company fail to do the simplest, most essential functionality after ten major revisions. Meanwhile, rclone Just Works(tm). T…

Do not try and move the files; that's impossible. Instead, only try to realize the truth... Delete them after you copy.

Bend the spoon*

* for people who don’t know the ref

Re: Just the rumour of a bug is enough to find an exploit these days

#89

I built a tool that monitors commits and tries to detect silent bug fixes. With GPT-5.5-class models, it can identify fixes hidden within otherwise routine commits quite reliably. Obfuscating the code changes enough to avoid detection is difficult. I have heard of at least one project (c-lightning?) temporarily releasing a closed-source binary as a workaround until users could update safely.

People are trying to secretly fix bugs?

Yes. The problem with openly releasing a fix for a security bug is that people are not always quick to update their instances. It only takes one black-hat monitoring your releases by some means to dissect the changes, find the hole, and make an exploit that can be immediately used against unpatched systems, and the sudden availability of better automated tools for that makes it a much bigger problem than it was a year or more ago.

Information about the problem then gets released later, once everyone has had appropriate time to get up-to-date. Or not, and we are non the wiser.

Re: Just the rumour of a bug is enough to find an exploit these days

#90

I built a tool that monitors commits and tries to detect silent bug fixes. With GPT-5.5-class models, it can identify fixes hidden within otherwise routine commits quite reliably. Obfuscating the code changes enough to avoid detection is difficult. I have heard of at least one project (c-lightning?) temporarily releasing a closed-source binary as a workaround until users could update safely.

Have you heard of these things called LLMs are that are quite good at reversing changes in closed source binaries?

you can diff binaries in a disassembler, the technique has been used for a long time to discover patched Microsoft vulnerabilities, create exploits and then race the world.

now you can instruct an LLM to do this with MCP...

Post reply on HN