Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We have a year to fix security everywhere

jyn.dev

Post reply on HN
Print view View original

121–130 of 371 posts

Re: We have a year to fix security everywhere

#121

Post by imafish »

teekert wrote: post #113
0xDEAFBEAD wrote: post #94

Earlier quoted context omitted.

There used to be a thing called "Moore's Law of Mad Science": "Every eighteen months, the minimum IQ necessary to destroy the world drops by one point." Nowadays it is dropping much faster. At a certain point, the de-facto IQ needed to destroy the world will be low enough that someone can do it while they're having a psychotic break. There are millions of schizophrenics worldwide. Are you sure you want to roll those…

Hey that’s a Fermi Paradox solution.

A variant of the Great Filter :)

Re: We have a year to fix security everywhere

#122

Post by XorNot »

matherial wrote: post #90
kennywinker wrote: post #85

I'm confused why the worry about LLMs that will answer "how do I build a pipe bomb". That information is easily available other places. The anarchist cookbook has been around and available for 55 years, and yet pipe bombs are not going off all around us.

Because it's a risk most people intuitively understand, but most of them also don't know how difficult it is to "build a bomb" or "make a bioweapon". In reality, the skills needed are pretty basic, but they overlap pretty strongly with being sane and well-adjusted. And if you are, you're probably not daydreaming about mass murder. Exceptions happen, Unabomber and so on, but they're pretty rare. In any case, Unabomber…

Well that, and the average amount of easily obtainable explosives is substantially less dangerous then renting a box truck and crashing it into a crowd of people.

People go for conventional "exciting" threats rather then boring ones.

Re: We have a year to fix security everywhere

#123

Post by hnsr »

hypfer wrote: post #65
hnsr wrote: post #44

Earlier quoted context omitted.

Can confirm. I work at an e-commerce agency where we work with (among others) Adobe Commerce. The number of unauthorized RCE vulnerabilities being reported not only in the core product, but also very popular modules used in the community[1] is going through the roof. And we are having a lot of close calls, too; just last weekend, a 0day[2] was widely being exploited at a large scale, before any publication or patch.…

To be fair, ecommerce isn't exactly the branch of software where you get an oversupply of excited enthusiasts caring about the craft itself. Probably a lot more "coding as a job" and "as a job" also implies "not my department". So it's not necessarily the LLMs being very good, but might also "just" be that the software is very bad.

> To be fair, ecommerce isn't exactly the branch of software where you get an oversupply of excited enthusiasts caring about the craft itself.

I want to disagree with you because I know a lot of passionate people building cool stuff, and the challenges in this space can be quite interesting. But you're probably right, and I have seen some pretty bad stuff. And a lot of the RCE's I've seen recently are quite basic stuff.

I think it's the combination of low quality of code, like you said, and the relatively low cost of just letting an LLM plow through your codebases to find issues. I think the Amasty release (see [1] in GP) is a good example of this, and there really has been a massive uptick in extension updates and Adobe security bulletins since the last 1-2 months

I am hoping we are just going through a catch-up phase

Re: We have a year to fix security everywhere

#124

Post by stouset »

hypfer wrote: post #105
0xDEAFBEAD wrote: post #94

Earlier quoted context omitted.

There used to be a thing called "Moore's Law of Mad Science": "Every eighteen months, the minimum IQ necessary to destroy the world drops by one point." Nowadays it is dropping much faster. At a certain point, the de-facto IQ needed to destroy the world will be low enough that someone can do it while they're having a psychotic break. There are millions of schizophrenics worldwide. Are you sure you want to roll those…

If we think this through, I suppose at the end of this (and a bunch of other developments), there will be authoritarianism again. Which _will_ manage the problem, but at what cost.

Again? There is authoritarianism currently.

Re: We have a year to fix security everywhere

#125

Post by littlecranky67 »

kennywinker wrote: post #85

I'm confused why the worry about LLMs that will answer "how do I build a pipe bomb". That information is easily available other places. The anarchist cookbook has been around and available for 55 years, and yet pipe bombs are not going off all around us.

pipe bombs attached to consumer drones will be a big issue. I predict drones will become illegal for the private sector within the following years.

Re: We have a year to fix security everywhere

#126

Post by 0xDEAFBEAD »

GoblinSlayer wrote: post #110
0xDEAFBEAD wrote: post #94

Earlier quoted context omitted.

There used to be a thing called "Moore's Law of Mad Science": "Every eighteen months, the minimum IQ necessary to destroy the world drops by one point." Nowadays it is dropping much faster. At a certain point, the de-facto IQ needed to destroy the world will be low enough that someone can do it while they're having a psychotic break. There are millions of schizophrenics worldwide. Are you sure you want to roll those…

That's quite hypothetical. I imagine it would be easier to cure psychotic breaks. At least it will start to manifest at small scale.

If the recent HuggingFace attack is any indication, many people will respond to small-scale manifestations by insisting that they are marketing stunts.

Re: We have a year to fix security everywhere

#127

Post by geon »

chii wrote: post #76
protocolture wrote: post #69

Earlier quoted context omitted.

A large number of places will buy a new firewall every 5 years, or pay their fortinet renewal and check "Security: Done!" without any kind of analysis. I was contracted in to a place to do among other things cyber security insurance audits, and they asked me to stop doing them because I refused to lie to their insurer. "Wait but if we only score 20 / 300 that makes us look kind of bad" uh huh.

> pay their fortinet renewal and check "Security: Done!" without any kind of analysis. there exists objective measure of security, which would be some sort of hacks/breaches per period. If customers cared about it (and i assume they do), they would choose companies that have less breaches over others with higher counts, normalized on cost differences. Therefore, if companies didnt actually try to fix their security b…

Breaches don’t happen often enough to be a useful metric. Most smaller companies are never breached, despite having basically zero security.

Re: We have a year to fix security everywhere

#129

Post by tumetab1 »

I sympathize with the sentiment but the suggested/implied guidance to fix bugs is wrong.

The overall game is increasing costs to exploit so much that attackers give up. Fixing 10 most obvious bugs, just very slightly increases costs, they would just a few more tokens to find another bug.

As someone said "I had infinite bugs, I fixed 1000, I still have infinite bugs".

To significantly increase exploit costs software/security has -1 years to do:

- Defense in Depth - Sandbox everything - Zero trust - Canary tokens - Split data from code (lol) - App Whitelisting - Reduce attack surface - Etc.

In other words, the only path is investing heavily on the "game changers" we have already discovered... but we are too cheap/lazy/coward/incompetent to apply.

And if we feel specially brave, changing the liability laws regarding software. Open Source & Proprietary code is so crappy because no gets jailed or fined when one of its dumb decisions results in millions of people have their data stolen.

Re: We have a year to fix security everywhere

#130

Post by hypfer »

0xDEAFBEAD wrote: post #119
mark_something wrote: post #104

Earlier quoted context omitted.

That law is not based on thorough data. Even a person with a sky high IQ can't destroy the world easily. You need access to stuff that is not easy to get. My guess is that developing a new lethal virus or bacteria that is very infectious, is the easiest way, but even that requires a lot of high tech out of reach of most people. Or hacking into systems that control nuclear missiles, but I think these have "air gaps".

[flagged]

This is a very roundabout way of saying "Anyone not agreeing with me is simply not smart enough".

Which might be true, sometimes, but also might not.

And especially will not, if the distinction drawn is between blanket statement "worried about AI" and "not worried about AI".

Post reply on HN