Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We have a year to fix security everywhere

jyn.dev

Post reply on HN
Print view View original

71–80 of 371 posts

Re: We have a year to fix security everywhere

#71

Post by LoganDark »

jsiepkes wrote: post #50
Gigachad wrote: post #34

Earlier quoted context omitted.

That’s fine for your home server, but if you want an actual server that the general public can use, it has to be exposed to the internet.

But not everything needs to be directly exposed to the internet. Framework had their data leaked because their metabase instance was hacked with a zero-day. Why was it directly exposed to the Internet? Why not require the use of a VPN like a Wireguard based solution or Nebula for these "internal" kind of apps?

> Framework had their data leaked because their metabase instance was hacked with a zero-day.

No, Framework had their data leaked because they stored it in the cloud with Metabase the company, which got hacked. Not because of any vulnerability on-premises.

Re: We have a year to fix security everywhere

#73

Post by anilakar »

pmlnr wrote: post #8

Here's an idea: as a first step, simplify everything, and make sure you're aware how your stack works, and what it imports. As an example: WordPress is a horrible thing, but the core has been through so much, that it's suprisingly secure. Then plugins and themes come, and whoosh, the security is gone. We need a new KISS: keep it simple, stupid, secure.

Probably nine out of ten Wordpress sites do not need active content. Why are we not rendering static copies and serving them to customers?

Re: We have a year to fix security everywhere

#74

Post by snvzz »

thunderfork wrote: post #3
hn_submit wrote: post #2

Or we could just dump Linux and Windows and switch to a microkernel operating system, which is much more secure. These endless patching cycles are simply not going to work in the long run. Operating systems get orphaned all the time, especially the ones in cheap Chinese stuff.

"throw away all software written before 2026" does technically solve this problem, if you ignore everything else the article is talking about (deployment and continuity of service)

Throwing away old software is not a requirement, as demonstrated very successfully by Genode and its SculptOS.

Re: We have a year to fix security everywhere

#75

Post by nojs »

simonw wrote: post #7
sho wrote: post #6

> On September 22, Apple is releasing the M5 Mac Studio with 256 GB of unified memory [..] it will probably [..] enough to write this snippet of code in 3 seconds The author has obviously never ran an LLM on a mac! In 3 seconds, it will have possibly started to think about maybe scheduling a date to contemplate the planning timeline for processing the second token in your prompt.

The difference is memory bandwidth. The M5 Ultra that's coming out on 22nd September can do 1,200GB/s. The M5 Max you can buy today only has 614GB/s.

The complaint is about prefill which is not memory bandwidth bound, it's compute bound. But they added neural accelerators for matmuls to the shader cores which should make prefill faster.

Re: We have a year to fix security everywhere

#76

Post by chii »

protocolture wrote: post #69
archi42 wrote: post #39

Zzzzz, we should have gotten security right a few decades ago. But security costs money and isn't a flashy feature to attract new customers, or cuts into your margin if you're a "real" business producing stuff or offering some service. Or whatever the decision makers in Berlin were thinking when they ignored security. Yeah, we would still see hacks, but we would see less of them if security wasn't optional. Maybe the…

A large number of places will buy a new firewall every 5 years, or pay their fortinet renewal and check "Security: Done!" without any kind of analysis. I was contracted in to a place to do among other things cyber security insurance audits, and they asked me to stop doing them because I refused to lie to their insurer. "Wait but if we only score 20 / 300 that makes us look kind of bad" uh huh.

> pay their fortinet renewal and check "Security: Done!" without any kind of analysis.

there exists objective measure of security, which would be some sort of hacks/breaches per period. If customers cared about it (and i assume they do), they would choose companies that have less breaches over others with higher counts, normalized on cost differences.

Therefore, if companies didnt actually try to fix their security but instead just checked boxes, they would get breached more often, resulting in customer losses.

The only thing stopping this from actually occurring is the lack of mandatory regulatory reporting of it. So this is where gov't needs to step in and mandate disclosure etc.

Re: We have a year to fix security everywhere

#77

Post by Gigachad »

tgv wrote: post #46
Gigachad wrote: post #34

Earlier quoted context omitted.

That’s fine for your home server, but if you want an actual server that the general public can use, it has to be exposed to the internet.

Still, it doesn't have to ping back, and ssh can (should) be very restrictive.

Ping and ssh are pretty much never the things being hacked though. Turn password auth off and it’s very secure.

What gets hacked all the time is the actual web app itself. Which has to be exposed to be useful.

Re: We have a year to fix security everywhere

#79

Post by LoganDark »

m_mueller wrote: post #28
taurath wrote: post #21

Earlier quoted context omitted.

Meanwhile a huge portion of management and leadership in software companies are encouraging everyone to de facto stop looking at code and let the LLM and a bunch of boundaries handle this for you.

“You are a CISO who needs to review and secure all our slop, and you never make mistakes or you get shut down immediately!”

"You are a Miso soup..."

Re: We have a year to fix security everywhere

#80

Post by Gigachad »

Cthulhu_ wrote: post #45
Gigachad wrote: post #31

Earlier quoted context omitted.

Thankfully we have already made good progress towards things like arm memory tagging and memory safe languages. It’s a rocky period right now but the future will be much more secure after all the low hanging fruit are found.

That's definitely an improvement, but it's just one aspect of cybersecurity. Logical errors allowing people to e.g. log into services and extract data are likely everywhere still.

If we can eliminate entire classes of bugs from being possible. It frees up resources to investigate the ones that are still possible.

I suspect after a few years of LLM assisted bug hunting, everything will have a baseline security that is very good. Much like how stronger viruses simply create stronger immune systems.

Post reply on HN