Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Just the rumour of a bug is enough to find an exploit these days

anil.recoil.org

Post reply on HN
Print view View original

121–130 of 141 posts

Re: Just the rumour of a bug is enough to find an exploit these days

#121

Post by denkmoon »

godelski wrote: post #79
denkmoon wrote: post #74

Earlier quoted context omitted.

Bugs are a choice by managers, not developers.

I disagree, a bit. There should always be some contention between manager and developer. It's healthy. But I think many developers just remain silent and are afraid to speak up. They are afraid of losing their jobs, or worse, getting kicked out of the country. It's reasonable, but it is one of many factors that contribute to the negative feedback loop of myopic management. We've all seen developers who game the syste…

>They get rewarded because they appear to move fast, eventually become management, and the whole thing gets worse as time goes on.

We've got a winner. Devs respond to the incentives set by management, and the message I have received loud and clear, my entire career, despite protestation, is that I should ship faster and not worry about bugs so much, big or small.

That I take pride in what I do is the only reason motivating me to not ship bugs. That and the thought of being the cause of an incident makes me physically ill, even though we have "blameless culture".

Re: Just the rumour of a bug is enough to find an exploit these days

#122

Post by MrQuincle »

Yeah, but what does need to change? Replacing the binary at runtime without downtime is indeed one way. What about making stuff read-only on a much more expansive scale? Config, data, code, etc is all seen as the same thing and cannot be easily managed separately. Roll-back should also be made easy. Handwaving perhaps but I think additional granularity of permissions and control is inevitable.

Re: Just the rumour of a bug is enough to find an exploit these days

#123

Post by chews »

nickcw wrote: post #3

This describes my life as an open source maintainer at the moment! In the first 10 years of the rclone project we received about 20 security disclosures through GitHub. We had to deal with over 40 in the last month! That has taken a huge amount of my time, even using AI tools to triage and come up with fixes for review. The hit rate for those security disclosures is pretty good - about 75% of them have a nugget of so…

Thank you good human, you're being that little block in the xkcd comic.

Re: Just the rumour of a bug is enough to find an exploit these days

#124

Post by ozim »

godelski wrote: post #108
ozim wrote: post #87

Earlier quoted context omitted.

It is not "will" it always is money. There was an article some days ago where someone was claiming "with AI only you decide how many bugs you have" — well no the same forces apply because tokens are not free and business wants to do stuff that directly earns money. Well we have to make cases and measure where the bug costs money and how. Lots of bugs are irrelevant and not blocking people from using the software. If…

> It is not "will" it always is money. Bullshit. There are so many ways to make money. And let's be honest, are the levels of wealth these people have money is entirely meaningless. There is nothing Elon can obtain, through money, that Alex Karp can't. That is despite more than an order of magnitude difference in wealth. So it isn't money. You can argue that it is power, that the money is the proxy, but this still wo…

Your answer makes sense for me only if your boss is Elon.

For all the other companies fixing a bug has opportunity cost, they pick what to spend their resources on. Some 5 minute bug feels insignificant but if all devs start picking 5 minute bugs they fancy in a system company won't do what is needed to keep running I guess.

Re: Just the rumour of a bug is enough to find an exploit these days

#125

Post by tancop »

godelski wrote: post #108
ozim wrote: post #87

Earlier quoted context omitted.

It is not "will" it always is money. There was an article some days ago where someone was claiming "with AI only you decide how many bugs you have" — well no the same forces apply because tokens are not free and business wants to do stuff that directly earns money. Well we have to make cases and measure where the bug costs money and how. Lots of bugs are irrelevant and not blocking people from using the software. If…

> It is not "will" it always is money. Bullshit. There are so many ways to make money. And let's be honest, are the levels of wealth these people have money is entirely meaningless. There is nothing Elon can obtain, through money, that Alex Karp can't. That is despite more than an order of magnitude difference in wealth. So it isn't money. You can argue that it is power, that the money is the proxy, but this still wo…

At some point money stops being about what you can buy and turns to a competition. You become addicted to the feeling of getting ahead of your rivals on the Forbes list, watching your companies stock price tick up after a good quarter, coming up with megalomaniac plans and then feeling happy when you can finally afford them even if you never actually wanted to pull them off.

Being a billionaire is a conscious decision. You can always choose to give away your shares to employees or sell them and donate the profit like Warren Buffett. If you decide you want to keep all of it for yourself that means you are a selfish person and probably a psychopath. And for these types making money is a goal by itself.

Re: Just the rumour of a bug is enough to find an exploit these days

#126

Post by kova12 »

Lvl999Noob wrote: post #110
elmer2 wrote: post #50

Earlier quoted context omitted.

Something that might come out of all of this is that companies that previously slow rolled security fixes will now be forced to fix them quickly, because the speed of AI and the liability of being insecure.

USA has that digital misuse law that makes it a crime to use software in unintended ways. So claude or codex finding bugs in their software is actually illegal... I am not sure if really no one tried this yet or if they did and I just missed the news.

DMCA is one of those bullshit laws which caused incalculable damage and we have not even started to address this gaping wound to stop the bleeding.

Re: Just the rumour of a bug is enough to find an exploit these days

#127

Post by newsomix9xl »

lbreakjai wrote: post #67
godelski wrote: post #61

Earlier quoted context omitted.

Did CrowdStrike actually suffer? That was a huge outage and their stock is today at an all time high. Seems like no one actually cares. Neither the companies providing the software, the companies purchasing the software, nor the markets. To me, this is the craziest part about all of it. Why doesn't anyone seem to care?

Why would they suffer? They showcased that they were big enough to disrupt the global economy. Why _wouldn't_ you invest in something so big and powerful? This is the same as when junkies specifically seek batches of drugs on which others overdosed.

The ODs are proof the drugs are good!

Re: Just the rumour of a bug is enough to find an exploit these days

#128

Post by zdragnar »

dingdongditchme wrote: post #103
rq1 wrote: post #88

Earlier quoted context omitted.

Bend the spoon* * for people who don’t know the ref

The star only confuses me more...?

It's a pointer to a reference you don't have.

Also, a line from a scene in the Matrix.

Re: Just the rumour of a bug is enough to find an exploit these days

#129

Post by jbeninger »

denkmoon wrote: post #119
brabel wrote: post #115

Earlier quoted context omitted.

You probably never had developers working for you. First, if you don’t give them a deadline they will work on it for months trying to get it perfect, but it will still be buggy and do the wrong thing unless you keep very close attention. Second, because you must give deadlines due to the previous point, the result will be buggier still, as they will spend most of their times on what to name variables and how to struc…

>as they will spend most of their times on what to name variables and how to structure the packages and modules. Incredible strawman of dev behaviour, I can only assume you are a manager yourself. I assure you, that's not what we're doing.

Also, attacking good naming and structure belies their claim of knowing anything about dev at all. If you can't tell the quality difference between a well-structured program and spaghetti code consisting of single-letter variables, you don't belong in software.

Honestly, from the tone, I suspect the gp post is just trying to get a rise.

Re: Just the rumour of a bug is enough to find an exploit these days

#130

Post by godelski »

ozim wrote: post #124
godelski wrote: post #108

Earlier quoted context omitted.

> It is not "will" it always is money. Bullshit. There are so many ways to make money. And let's be honest, are the levels of wealth these people have money is entirely meaningless. There is nothing Elon can obtain, through money, that Alex Karp can't. That is despite more than an order of magnitude difference in wealth. So it isn't money. You can argue that it is power, that the money is the proxy, but this still wo…

Your answer makes sense for me only if your boss is Elon. For all the other companies fixing a bug has opportunity cost, they pick what to spend their resources on. Some 5 minute bug feels insignificant but if all devs start picking 5 minute bugs they fancy in a system company won't do what is needed to keep running I guess.

  > Your answer makes sense for me only if your boss is Elon.
What about for everyone that works for a big tech company. The same still applies.

I know I picked very big numbers, but let's be honest, a more "modest" $50m and you have everything you could ask for. Put that in a safe 5% earning account and you're making $2.5m/yr, sitting on your ass doing nothing. Good luck spending all that in a year, consistently. There's nearly nothing out of reach.

There's far more people whose bosses are richer than that. But I think the problem is people don't understand what these levels of wealth actually mean. Money works differently at that level as it becomes harder to spend it faster than you earn it. Even those get in big tech jobs aren't living at those levels.

Clearly these people are addicted to something other than money. No billionaire actually cares about money. The money is a proxy

Post reply on HN