Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We have a year to fix security everywhere

jyn.dev

Post reply on HN
Print view View original

81–90 of 373 posts

Re: We have a year to fix security everywhere

#81

Post by chisleu »

simonw wrote: post #7
sho wrote: post #6

> On September 22, Apple is releasing the M5 Mac Studio with 256 GB of unified memory [..] it will probably [..] enough to write this snippet of code in 3 seconds The author has obviously never ran an LLM on a mac! In 3 seconds, it will have possibly started to think about maybe scheduling a date to contemplate the planning timeline for processing the second token in your prompt.

The difference is memory bandwidth. The M5 Ultra that's coming out on 22nd September can do 1,200GB/s. The M5 Max you can buy today only has 614GB/s.

It is and it isn't. Why are you comparing the m5max instead of the m4ultra?

The big deal to me is the number of compute cores for prefill tps, which is suppose to be 4x faster on the m5ultra.

It's my opinion that the m5 ultra is going to be a really big deal in terms of local AI accessibility. Flash sized models (~200-300b params) are going to be reasonably fast as long as you aren't throwing 40k context at it on each or the first request (ie, agentic harnesses).

Even agentic harnesses like Cline should move at a reasonable clip on m5 ultra. I suppose we will know sooner than later.

FYSA: Former m4 ultra 512GB owner and current 4x rtx6000 owner here. I upgraded because I needed more prompt processing speed and concurrency.

Re: We have a year to fix security everywhere

#82

Post by cuu508 »

ma2kx wrote: post #59

I don't see much hope since I last explored some github repositories. There was a time when a successful repo had about 10 - 20k stars and usually those older repos stay around this level. But now there is a ton of vibe coded slop 50k + stars. Most of them have a "nice look", maybe even extensive docs but are usually build with no security considerations at all. One recommended to provide a "google app password" to t…

It's a good time to reduce the reliance on technology.

Throw out the IoT and "smart" stuff from your home. Remove apps from your phone and leave the absolute basics. Go through the password manager and close accounts for sites you are no longer using. Start migrating off Google. Print out your most precious photos on paper. And so on :-)

Re: We have a year to fix security everywhere

#83

Post by Gigachad »

Helmut10001 wrote: post #54
pmlnr wrote: post #8

Here's an idea: as a first step, simplify everything, and make sure you're aware how your stack works, and what it imports. As an example: WordPress is a horrible thing, but the core has been through so much, that it's suprisingly secure. Then plugins and themes come, and whoosh, the security is gone. We need a new KISS: keep it simple, stupid, secure.

Static sites all the way (hugo, jekyll, mkdocs!). No one needs wordpress. There's even Sveltia or DecapCMS now, to give those WYSIWYG-people access to static site editing. Then, remove PHP and all the dependency overhead and attack surface and you have a stripped down nginx that is pretty simple, minimalistic and bulletproof.

The problem is no one ever built one that works for normal people.

Most Wordpress sites are not operated by programmers, they are run by non technical people who just want a wysiwyg editor and a save button. While static site builders ask you to write markdown files, compile the result, upload it to a server, and if you want to collaborate you have to add git to that.

There almost needs to be an admin app which presents a Wordpress admin like ui but has no public exposure, and then it compiles the site to dump on s3 for the production. But as far as I’m aware no one has built this.

Re: We have a year to fix security everywhere

#84

Post by mirashii »

ricardobayes wrote: post #58
mirashii wrote: post #9

Earlier quoted context omitted.

The "surprisingly secure" WordPress just had a unauthenticated RCE earlier this year. Just simplifying isn't going to be enough. https://nvd.nist.gov/vuln/detail/cve-2026-63030

If that's your benchmark for being unsecure, then React is unsecure too. https://react.dev/blog/2025/12/03/critical-security-vulnerab...

I would put both of those projects in the category of things I wouldn't call remarkably secure, yes.

To be remarkably secure, these projects would need to not have these kinds of defects, despite the combination of being written in languages have that have a long track record of footguns and lack of initiatives to fix them (proposal-symbol-proto, and PHP's list is too long to even start) and being themselves ecosystems with questionable track records on security in the related areas (Look at $wpdb in 2026, or overall code quality and willingness to modernize, or the entirety of the model of RSC for things that are just going to nearly guarantee you punch all kinds of holes on accident).

Re: We have a year to fix security everywhere

#86

Post by its-summertime »

simonw wrote: post #5

I don't think we even have a year. The current batch of LLMs are ferociously good at identifying vulnerabilities.

I guess the year mark is when things go from bad to worse? Instead of the financially motivated groups currently doing their work, it ends up being random people being able to say "Hack my ex's website" to a box they just bought and ran a program they downloaded onto it.

Re: We have a year to fix security everywhere

#87

Post by Helmut10001 »

Gigachad wrote: post #83
Helmut10001 wrote: post #54

Earlier quoted context omitted.

Static sites all the way (hugo, jekyll, mkdocs!). No one needs wordpress. There's even Sveltia or DecapCMS now, to give those WYSIWYG-people access to static site editing. Then, remove PHP and all the dependency overhead and attack surface and you have a stripped down nginx that is pretty simple, minimalistic and bulletproof.

The problem is no one ever built one that works for normal people. Most Wordpress sites are not operated by programmers, they are run by non technical people who just want a wysiwyg editor and a save button. While static site builders ask you to write markdown files, compile the result, upload it to a server, and if you want to collaborate you have to add git to that. There almost needs to be an admin app which prese…

Yes, you are right and I agree, there's little empathy with non-coders generally.

Re: We have a year to fix security everywhere

#88

Post by krrrh »

Gigachad wrote: post #83
Helmut10001 wrote: post #54

Earlier quoted context omitted.

Static sites all the way (hugo, jekyll, mkdocs!). No one needs wordpress. There's even Sveltia or DecapCMS now, to give those WYSIWYG-people access to static site editing. Then, remove PHP and all the dependency overhead and attack surface and you have a stripped down nginx that is pretty simple, minimalistic and bulletproof.

The problem is no one ever built one that works for normal people. Most Wordpress sites are not operated by programmers, they are run by non technical people who just want a wysiwyg editor and a save button. While static site builders ask you to write markdown files, compile the result, upload it to a server, and if you want to collaborate you have to add git to that. There almost needs to be an admin app which prese…

Movable type was the most popular blogging software in 2003 and it was essentially this. An admin app written in Perl that spit out static files.

It is kind of surprising that no one tried to do an updated version.

Re: We have a year to fix security everywhere

#89

Post by kennywinker »

Gigachad wrote: post #83
Helmut10001 wrote: post #54

Earlier quoted context omitted.

Static sites all the way (hugo, jekyll, mkdocs!). No one needs wordpress. There's even Sveltia or DecapCMS now, to give those WYSIWYG-people access to static site editing. Then, remove PHP and all the dependency overhead and attack surface and you have a stripped down nginx that is pretty simple, minimalistic and bulletproof.

The problem is no one ever built one that works for normal people. Most Wordpress sites are not operated by programmers, they are run by non technical people who just want a wysiwyg editor and a save button. While static site builders ask you to write markdown files, compile the result, upload it to a server, and if you want to collaborate you have to add git to that. There almost needs to be an admin app which prese…

I mean, github pages using the github editor to edit docs pretty much fits that bill

Re: We have a year to fix security everywhere

#90

Post by matherial »

kennywinker wrote: post #85

I'm confused why the worry about LLMs that will answer "how do I build a pipe bomb". That information is easily available other places. The anarchist cookbook has been around and available for 55 years, and yet pipe bombs are not going off all around us.

Because it's a risk most people intuitively understand, but most of them also don't know how difficult it is to "build a bomb" or "make a bioweapon".

In reality, the skills needed are pretty basic, but they overlap pretty strongly with being sane and well-adjusted. And if you are, you're probably not daydreaming about mass murder. Exceptions happen, Unabomber and so on, but they're pretty rare. In any case, Unabomber probably didn't need a tutorial.

We don't want ChatGPT to become an enabler and a co-conspirator for an unhinged person, but I think the concern is overdone.

Post reply on HN