Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Just the rumour of a bug is enough to find an exploit these days

anil.recoil.org

Post reply on HN
Print view View original

111–120 of 142 posts

Re: Just the rumour of a bug is enough to find an exploit these days

#111

Post by NateEag »

dingdongditchme wrote: post #105
godelski wrote: post #6

It's easier to find bugs, fix them, yet there's less will than ever. My bosses just want speed and will give me a 30 minute lecture on why I don't need to solve a bug that Claude solved in 5 minutes, I've verified, and it's already in an open PR. All the while we're pushing out bugs faster and faster. No matter how good AI gets at fixing bugs we'll never fix them when there's no will to fix things. Software will neve…

My take is that when the bubble bursts good software will remain. Right now all the big players are hiding the cost. Anthropic (in my mind) is especially egregious at tokenmaxxing without telling you whats going on. A simple request to edit a text file launches multiple agents which takes ages, and burns tokens. All the while it calles it "Sautéeing" or whatever random verb they spew out as you wait for your answer.

> All the while it calles it "Sautéeing" or whatever random verb they spew out as you wait for your answer.

Today, while bitterly staring at Claude per my current employer's "use genAI or else" mandate, I got "bloviating."

Re: Just the rumour of a bug is enough to find an exploit these days

#112

Post by inigyou »

TomatoCo wrote: post #98
stavros wrote: post #86

Earlier quoted context omitted.

Do not try and move the files; that's impossible. Instead, only try to realize the truth... Delete them after you copy.

Right? If you move between file system or device I would expect "move" to be impossible. At best you could copy a logical block and then delete a logical block. If you share a filesystem then perhaps a logical block is a few hundred kilobytes. If you don't then I'd expect the smallest logical block to be the file itself.

Moving on the same filesystem moves the pointer to the file.

Re: Just the rumour of a bug is enough to find an exploit these days

#113

Post by novia »

evilduck wrote: post #53
novia wrote: post #27

Earlier quoted context omitted.

!!! You described my experience in the workforce to a t! So frustrating that tech managers look at tech debt as a thing to be maintained at a certain level instead of allowing us to achieve perfection

Your tech manager is likely very aware of the imperfections and is making prioritizations and compromises to keep you employed.

Nah, I quit at the end of 2023, so much for those compromises

I have pride in my work, and having to watch it be destroyed repeatedly is not a way to keep me around.

Re: Just the rumour of a bug is enough to find an exploit these days

#115

Post by brabel »

denkmoon wrote: post #74
ryandrake wrote: post #15

Earlier quoted context omitted.

Most places I've worked have been infuriatingly uninterested in fixing bugs, and would release software with major known bugs and a vague plan to fix them later. Of course, when "later" came, there were more features to cram. No time to fix those bugs. I'm hoping one of the unintended side effect of it being essentially free to find and exploit (and fix) software bugs is that companies become less cavalier about ship…

Bugs are a choice by managers, not developers.

You probably never had developers working for you. First, if you don’t give them a deadline they will work on it for months trying to get it perfect, but it will still be buggy and do the wrong thing unless you keep very close attention. Second, because you must give deadlines due to the previous point, the result will be buggier still, as they will spend most of their times on what to name variables and how to structure the packages and modules. Their testing will cover their mocks and when put together in the real thing most functionality will just not work at all. I’ve seen this happen even with senior developers. With juniors it’s guaranteed to happen without a very good tutor. Take some fucking responsibility. If you deliver software, make sure it’s in a working state. Don’t blame your manager for everything, they did not force you to write shitty code, if you think they can do that you are not ready to work as a professional developer, you are just a code monkey.

Re: Just the rumour of a bug is enough to find an exploit these days

#116

Post by thedonncha »

nickcw wrote: post #3

This describes my life as an open source maintainer at the moment! In the first 10 years of the rclone project we received about 20 security disclosures through GitHub. We had to deal with over 40 in the last month! That has taken a huge amount of my time, even using AI tools to triage and come up with fixes for review. The hit rate for those security disclosures is pretty good - about 75% of them have a nugget of so…

Same with some of the projects I maintain. The reports came in for one project over a few months and then once those dried up, and they did become increasingly unlikely or appear to be edge cases, the reports started to accumulate for another project. Great to get these issues addressed but it's exhausting.

Re: Just the rumour of a bug is enough to find an exploit these days

#117

Post by Leherenn »

talon8635 wrote: post #66
stephbook wrote: post #32

I think roll-out and deployment are even bigger issues. Who updates their software stack within 10 minutes? Most CI runs take longer to verify the business logic is still working. Add to that the danger of supply-chain attacks where you don't even want automatic updates.

Your last point is the conundrum I keep running up against It’s a trap regardless: A) run a known vuln B) accept and run any and all updates immediately… which could be compromised Maybe A is worse because it’s a known vuln?

AI auditing of dependency updates will mostly likely come soon (if it's not already there), and should mitigate the most obvious cases at least.

(By this I mean integrated in something like dependabot, not just some security companies doing it and publishing reports.)

Re: Just the rumour of a bug is enough to find an exploit these days

#118

Post by nickcw »

dingdongditchme wrote: post #104
nickcw wrote: post #3

This describes my life as an open source maintainer at the moment! In the first 10 years of the rclone project we received about 20 security disclosures through GitHub. We had to deal with over 40 in the last month! That has taken a huge amount of my time, even using AI tools to triage and come up with fixes for review. The hit rate for those security disclosures is pretty good - about 75% of them have a nugget of so…

Thank you for the insight! Are you going back to the changelog and editing the CVE-PENDING? I think this would be a justifiable edit of the release history that I'm not sure is possible on github.

Yes I update the CVE-PENDING once the CVEs are in to keep the record straight.

Re: Just the rumour of a bug is enough to find an exploit these days

#119

Post by denkmoon »

brabel wrote: post #115
denkmoon wrote: post #74

Earlier quoted context omitted.

Bugs are a choice by managers, not developers.

You probably never had developers working for you. First, if you don’t give them a deadline they will work on it for months trying to get it perfect, but it will still be buggy and do the wrong thing unless you keep very close attention. Second, because you must give deadlines due to the previous point, the result will be buggier still, as they will spend most of their times on what to name variables and how to struc…

>as they will spend most of their times on what to name variables and how to structure the packages and modules.

Incredible strawman of dev behaviour, I can only assume you are a manager yourself. I assure you, that's not what we're doing.

Re: Just the rumour of a bug is enough to find an exploit these days

#120

Post by hypfer »

> The big engineering shops (like Google) have been building microupdates directly into their software to ensure that fixes directly reach users as a priority over (e.g.) being fixed in the Chrome code repository.

Yes, no. Do not even think about doing that. You cannot, should not, and must not "microupdate" code running on users machines without their consent.

Also, the whole idea is completely insane. "We might have unpatched 0days in the field, so to mitigate that, we shall add arbitrary and remote code execution via the cloud"

___

And even if you were to think that taking a page out of googles book - you know, the company known for being laser focused on having the wrongest opinions - is a good idea, you shouldn't do so for free.

Live patching is something enterprises pay a lot of money for. Making it a Foss expectation is insane.

Post reply on HN