Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We have a year to fix security everywhere

jyn.dev

Post reply on HN
Print view View original

161–170 of 371 posts

Re: We have a year to fix security everywhere

#161

Post by wolvoleo »

mirashii wrote: post #9
pmlnr wrote: post #8

Here's an idea: as a first step, simplify everything, and make sure you're aware how your stack works, and what it imports. As an example: WordPress is a horrible thing, but the core has been through so much, that it's suprisingly secure. Then plugins and themes come, and whoosh, the security is gone. We need a new KISS: keep it simple, stupid, secure.

The "surprisingly secure" WordPress just had a unauthenticated RCE earlier this year. Just simplifying isn't going to be enough. https://nvd.nist.gov/vuln/detail/cve-2026-63030

WordPress and secure don't go together in the same sentence.

I mean the base is fairly secure if you religiously update it, but the problem is you won't avoid using plugins whose security is much more hit and miss, unless you are using the most basic blog site imaginable.

Re: We have a year to fix security everywhere

#162

Post by wolvoleo »

noio wrote: post #147
Gigachad wrote: post #83

Earlier quoted context omitted.

The problem is no one ever built one that works for normal people. Most Wordpress sites are not operated by programmers, they are run by non technical people who just want a wysiwyg editor and a save button. While static site builders ask you to write markdown files, compile the result, upload it to a server, and if you want to collaborate you have to add git to that. There almost needs to be an admin app which prese…

Pour one out for FrontPage

Ahhh the old positioning with  

I fixed so many sites back in the day by people who thought they knew what they were doing.

Re: We have a year to fix security everywhere

#163

Post by bpbp-mango »

Helmut10001 wrote: post #54
pmlnr wrote: post #8

Here's an idea: as a first step, simplify everything, and make sure you're aware how your stack works, and what it imports. As an example: WordPress is a horrible thing, but the core has been through so much, that it's suprisingly secure. Then plugins and themes come, and whoosh, the security is gone. We need a new KISS: keep it simple, stupid, secure.

Static sites all the way (hugo, jekyll, mkdocs!). No one needs wordpress. There's even Sveltia or DecapCMS now, to give those WYSIWYG-people access to static site editing. Then, remove PHP and all the dependency overhead and attack surface and you have a stripped down nginx that is pretty simple, minimalistic and bulletproof.

php is probably about as secure as nginx. big old bundles of C

Re: We have a year to fix security everywhere

#164

Post by wolvoleo »

jordand wrote: post #100
microtonal wrote: post #52

Earlier quoted context omitted.

How many devices/operating systems even use memory tagging? iOS, macOS and GrapheneOS, I think that's it? And iOS/macOS only use it for the kernel, a subset of system processes, and I think applications can opt in to it. Heck, Google may have even hampered MTE in Pixel 11 (since support has been disabled) and Snapdragon 8 Gen 5 only got basic support. We are moving way to slowly adopting hardware mitigations and memo…

There's some positive news from the GrapheneOS devs on Pixel 11 in the past week that's worth reading up on. The MTE hardware feature is still there, they're just not sure why Google disabled it

They said:

> It isn't clear if there are serious CPU errata or it simply performs very badly.

Meaning it's there but not terribly functional. They also said it's unreliable.

Re: We have a year to fix security everywhere

#166

Post by polishTar »

hypfer wrote: post #130
0xDEAFBEAD wrote: post #119

Earlier quoted context omitted.

[flagged]

This is a very roundabout way of saying "Anyone not agreeing with me is simply not smart enough". Which might be true, sometimes, but also might not. And especially will not, if the distinction drawn is between blanket statement "worried about AI" and "not worried about AI".

I heard someone use the analogy of "If Magnus Carlson played me at chess, I wouldn't be able to predict the moves he'd play since if I could I'd be at his level. He'll consider things I didn't and even though I don't know the route he'll take to win, I can be certain he will beat me." (not an exact quote).

We're not going to be smarter than a superintelligent AI. The things we conceive it doing if it were given a malicious task (bioterrorism, killer nano-machines, pure fusion bombs sidesteping the non-proliferation bottleneck of Pu239, etc) are likely not the full set of things it can do to harm us. I don't think it does us any favors to dismiss the risks here.

Even the things we can conceive of are very scary, to me at least.

Re: We have a year to fix security everywhere

#167

Post by calgoo »

0xDEAFBEAD wrote: post #119
mark_something wrote: post #104

Earlier quoted context omitted.

That law is not based on thorough data. Even a person with a sky high IQ can't destroy the world easily. You need access to stuff that is not easy to get. My guess is that developing a new lethal virus or bacteria that is very infectious, is the easiest way, but even that requires a lot of high tech out of reach of most people. Or hacking into systems that control nuclear missiles, but I think these have "air gaps".

[flagged]

Judging on what we see with these OpenAI and Anthropic models "escaping"; im less worried about a super massive AI taking over the world, and more worried about a massive AI wanting to cheat on some task and decides that removing half the worlds population is a easier cheat then to solve world hunger.

Re: We have a year to fix security everywhere

#168

Post by 0xDEAFBEAD »

Planktonne wrote: post #137
forgotusername6 wrote: post #131

Earlier quoted context omitted.

The super intelligent AI wouldn't ask you to do anything. It would find the right people and trick them into doing the necessary steps, whatever they are.

This is groundless speculation; if you're going to go that far off the map, then we don't need to worry because a good AI (blue eyes not red) will have learnt to love by then and will save us. There is currently no reason to believe that such a superintelligence is likely or would have any of the powers people claim.

>This is groundless speculation; if you're going to go that far off the map, then we don't need to worry because a good AI (blue eyes not red) will have learnt to love by then and will save us.

By shutting down open-weight models? Why not just do it now then?

Re: We have a year to fix security everywhere

#169

Post by 0xDEAFBEAD »

nextlevelwizard wrote: post #153
0xDEAFBEAD wrote: post #119

Earlier quoted context omitted.

[flagged]

Who are these dedicated schizophrenics who are running long term super smart AIs to kill everyone without anyone noticing? Or are you implying that running LLM chatbots will give them this ability?

We're talking about open-weight models.

It only takes one.

Re: We have a year to fix security everywhere

#170

Post by 0xDEAFBEAD »

TacticalCoder wrote: post #157
0xDEAFBEAD wrote: post #94

Earlier quoted context omitted.

There used to be a thing called "Moore's Law of Mad Science": "Every eighteen months, the minimum IQ necessary to destroy the world drops by one point." Nowadays it is dropping much faster. At a certain point, the de-facto IQ needed to destroy the world will be low enough that someone can do it while they're having a psychotic break. There are millions of schizophrenics worldwide. Are you sure you want to roll those…

> There are millions of schizophrenics worldwide. Are 95% of worldwide terror attacks done by schizos?

Terrorists represent an additional threat model.

https://casp.ac/reports/ai-enabled-terrorism

Post reply on HN