Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We have a year to fix security everywhere

jyn.dev

Post reply on HN
Print view View original

321–330 of 373 posts

Re: We have a year to fix security everywhere

#321

Post by chii »

IAmBroom wrote: post #284
chii wrote: post #76

Earlier quoted context omitted.

> pay their fortinet renewal and check "Security: Done!" without any kind of analysis. there exists objective measure of security, which would be some sort of hacks/breaches per period. If customers cared about it (and i assume they do), they would choose companies that have less breaches over others with higher counts, normalized on cost differences. Therefore, if companies didnt actually try to fix their security b…

The number of breaches would have to be honestly reported for that idea to work. None of the security firms would want to do that; least of all the lowest quartile of them.

> would have to be honestly reported for that idea to work.

and why does this idea work for accounting audits, but not for security? As long as regulations for companies exist, they would necessarily follow it, and this would lead to reporting of security breaches just like companies would have to report their financials honestly.

Re: We have a year to fix security everywhere

#322

Post by oblio »

0xDEAFBEAD wrote: post #305
oblio wrote: post #304

Earlier quoted context omitted.

I'm also a techie, so I've also read a lot of SF. But I've also read about retrofuturism. If you want to live far into the future, 20 years from now what you will and imagine looks very quaint, because the future never plays out like we think it does. OpenAI is a lot closer to bankruptcy than to ASI. I'm perfectly fine with this prediction aging badly.

>the future never plays out like we think it does Consider this 1926 government report: https://www.derekthompson.org/p/america-1926-an-absurdly-dee... "The authors of Recent Social Trends were astonishingly prescient about the direction of technology." There have been many successful predictions, e.g. the internet was predicted, AI was predicted, moon landings were predicted, etc. >OpenAI is a lot closer to bankrupt…

There have been many successful predictions about the future. In my personal experience probably 100 out of 10 million predictions.

Re: We have a year to fix security everywhere

#324

Post by forshaper »

kennywinker wrote: post #85

I'm confused why the worry about LLMs that will answer "how do I build a pipe bomb". That information is easily available other places. The anarchist cookbook has been around and available for 55 years, and yet pipe bombs are not going off all around us.

In our town, a single homeless man has caused millions in infrastructure damage (and 24-48 hr hold ups of utilities) every year. I imagine what one determined, clear-headed individual might do and...it certainly wouldn't take a single LLM interaction.

Re: We have a year to fix security everywhere

#325

Post by thunderfork »

chii wrote: post #321
IAmBroom wrote: post #284

Earlier quoted context omitted.

The number of breaches would have to be honestly reported for that idea to work. None of the security firms would want to do that; least of all the lowest quartile of them.

> would have to be honestly reported for that idea to work. and why does this idea work for accounting audits, but not for security? As long as regulations for companies exist, they would necessarily follow it, and this would lead to reporting of security breaches just like companies would have to report their financials honestly.

Accounting is generally both easier to do correctly and easier to verify than security practices, unfortunately

Re: We have a year to fix security everywhere

#326

Post by thunderfork »

iCarrot wrote: post #96
Gigachad wrote: post #83

Earlier quoted context omitted.

The problem is no one ever built one that works for normal people. Most Wordpress sites are not operated by programmers, they are run by non technical people who just want a wysiwyg editor and a save button. While static site builders ask you to write markdown files, compile the result, upload it to a server, and if you want to collaborate you have to add git to that. There almost needs to be an admin app which prese…

Is this not it? https://pagescms.org/

>github repository

You have already lost the "normal people" audience

Re: We have a year to fix security everywhere

#327

Post by thunderfork »

weeks wrote: post #102
Gigachad wrote: post #83

Earlier quoted context omitted.

The problem is no one ever built one that works for normal people. Most Wordpress sites are not operated by programmers, they are run by non technical people who just want a wysiwyg editor and a save button. While static site builders ask you to write markdown files, compile the result, upload it to a server, and if you want to collaborate you have to add git to that. There almost needs to be an admin app which prese…

https://jamstack.org You're describing the Jamstack or headless CMS concept verbatim.

>Jamstack is an architectural approach that decouples the web experience layer from data and business logic, improving flexibility, scalability, performance, and maintainability.

>Jamstack removes the need for business logic to dictate the web experience.

>It enables a composable architecture for the web where custom logic and 3rd party services are consumed through APIs.

How far into this front page blurb do you think the average non-dev would get before they realize this is supposed to be a thing they can use in place of WordPress?

Re: We have a year to fix security everywhere

#328

Post by ErroneousBosh »

zahlman wrote: post #204
ErroneousBosh wrote: post #140

Earlier quoted context omitted.

Also, LLMs never *write* code snippets, they just pirate them from somewhere else.

Can you show me an example of a time that you prompted an LLM to provide some code, it did so, and then you were able to track down an original source for the output?

Every time I've asked an LLM to provide some code, it's given me an example from my own github repos.

Granted, I've only asked it about some of the weirdly specific technological niche that my code inhabits.

Re: We have a year to fix security everywhere

#329

Post by bamboozled »

FeepingCreature wrote: post #219
bamboozled wrote: post #158

Earlier quoted context omitted.

Ignorant question but won’t there be much smarter teams if people using LLMs to workout how to mitigate these threats. It seems like more of a problem if only a few people have access.

It seems like there would be a massive attacker bias in multiple ways. Defenders need consent, attacker does not. Defenders have to work with the human body, attackers only have to break it. Defenders have to stick to the law, which may prevent them from releasing anything at all, attackers do not. And so on. I would not surprised if the attacker's task is a hundred times easier here.

I guess any virus that is super destructive is probably not something that can spread very far as it kills its hosts beforehand ?

Re: We have a year to fix security everywhere

#330

Post by preg_match »

lelanthran wrote: post #295
mark_something wrote: post #143

Earlier quoted context omitted.

I wonder why C and C++ are usually regarded as equally insecure. In C you need to carefully check that you free allocated memory, and that you don't use it after you free it. In C++ this is automated by using classes like std::string and std::vector, once they go out of scope their memory is freed and you can't use it anymore. It is still possible, e.g. by using a for loop that iterates over a vector, and removing or…

> I wonder why C and C++ are usually regarded as equally insecure. They aren't, usually. C++ has all the C problems, and multiples more on top of those. It's a broad attack surface - literally no one is going to claim to be proficient in every single C++ feature available to their compiler. It's also quite opaque to visual inspection (making double-checking with an LLM difficult as it needs whole-program reasoning in…

I disagree, the minimalism of C results in writing overly complex code to solve simple problems. Things like type punning and bit hacks are common place in C.

The end result is equivalent C code is much more complex than C++. For example, you need to remember to call free every time, forever, in every function. In C++ you just use unique ptr or shared ptr and you’re done. It’s a simpler model, enabled by the more complex feature of RAII.

Something like std::vector isn’t hard to write in C, it’s impossible. The language semantics don’t allow it. So you have to do hacks and remember to free, over and over again forever. It only takes just one time forgetting, and that’s a memory bug.

I mean, consider a large codebase. How many free calls does C++ eliminate altogether? Thousands, maybe tens of thousands? You just need to forget one of those in C, or even just put it in the wrong place.

And that’s just one class of things. Generics are much more complex in C, too. The type system in C is more complex IMO because it can be so easily defeated at every turn. C gives you practically no guarantees, no tools, for anything. The result is you are forced to write extremely defensive code everywhere, complex code.

The analogy I use is to physical tools. A screwdriver is simple, but building a house with only a screwdriver is complex. A suite of power tools is complex, but building a house with them is simple.

Post reply on HN