101–110 of 200 posts
Isn’t the real danger now not the ability to find security vulnerabilities, but rather, the ability of anyone to ask an LLM agent to rewrite your open source project in another language and thus work around whatever license your project has?
There are real limitations of course.
AI generated bullshit PRs are clearly the bigger issue in the OSS space.
Cal.com folks are getting a red team for free, wouldn't that further convince them their closed source software is strong enough?
Isn't Strix's business companies paying for scans regardless of whether the software scanned is open source or closed?
The future is sharing, you may not believe because your income is tied to being clever. Long term we are all more clever because of the sharing, and your contribution sometimes does not add to your personal success. Asking a company or its individuals to forego their success will not make them add more to our future. But they will add to our future nonetheless, because they all feel like we all do, that adding is what we are all meant to do.
Isn’t the real danger now not the ability to find security vulnerabilities, but rather, the ability of anyone to ask an LLM agent to rewrite your open source project in another language and thus work around whatever license your project has?
I have an open source project and started receiving a lot of security vulnerability reports in the last few months. A lot of them are extremely corner cases, but there were some legit ones. They're all fixed now. Closed source software won't receive any reports, but it will be exploited with AI. So I definitely agree with the message of this article.
I’ve recently set up nightly automated pentest for my open-source project. I’m considering starting to publish these reports as proof of security posture. If the cost of security audit becomes marginal, it would seem reasonable to expect projects to publish results of such audits frequently. There’s probably a quite hefty backlog of medium- and low-severity issues in existing projects for maintainers to suffer throug…
Brilliant piece of content marketing: 1) Pulls you in with a catchy title, that at first glance seems like a dunk on Cal.com (whatever that is). 2) Takes the "we understand your pain" approach to empathize w/ Cal.com, so you feel like you're on the good vibes side. 3) Provides a genuine response to the actual problem Cal.com is dealing with. Something you can't dismiss out of hand. 4) But in the end of the day, the r…
The real content could fit in a comment.
I have an open source project and started receiving a lot of security vulnerability reports in the last few months. A lot of them are extremely corner cases, but there were some legit ones. They're all fixed now. Closed source software won't receive any reports, but it will be exploited with AI. So I definitely agree with the message of this article.
What makes you so sure that closed-source companies won't run those same AI scanners on their own code?
It's closed to the public, it's not closed to them!
Earlier quoted context omitted.
I’ve recently set up nightly automated pentest for my open-source project. I’m considering starting to publish these reports as proof of security posture. If the cost of security audit becomes marginal, it would seem reasonable to expect projects to publish results of such audits frequently. There’s probably a quite hefty backlog of medium- and low-severity issues in existing projects for maintainers to suffer throug…
What do you use for the pentests? any oss libraries?
> The reasoning provided by their CEO, Bailey Pumfleet, is that AI has automated vulnerability discovery at scale, That sounds like an excuse. The real reason is probably that it's hard to make a viable business out of developing open source.