AI is breaking two vulnerability cultures • Hacker News Board

Re: AI is breaking two vulnerability cultures

#101

Post by Izkata » Sat, May 09, 2026, 1:09 AM UTC

organsnyder wrote: post #26

thereisnospork wrote: post #25

Earlier quoted context omitted.

>any vulnerability in any software available for inspection is going to be instant public knowledge. Or at least public among anybody who matters. Shouldn't this naturally lead to a state where all (new) code is vulnerability-free? If AI vulnerability detection friction becomes low enough it'll become common/forced practice to pre-scan code.

Finding a vulnerability by looking at the diff that fixed it is very different than just looking through the code.

They're saying to do that scan to every diff before release, to see if it finds anything.

Re: AI is breaking two vulnerability cultures

#102

Post by dataflow » Sat, May 09, 2026, 1:11 AM UTC

sedatk wrote: post #93

tptacek wrote: post #41

This has been a very long time coming and the crackup we're starting to see was predicted long before anyone knew what an LLM is. The catalyst is the shift towards software transparency: both the radically increased adoption of open source and source-available software, and the radically improved capabilities of reversing and decompilation tools. It has been over a decade since any ordinary off-the-shelf closed-sourc…

> BinDiff: you can't patch software without disclosing vulnerabilities That’s why Microsoft has been obfuscating its binary builds for at least the last two decades so that even the two builds from the same source would produce very different blobs.

Sounds dubious, do you have a citation? The disassembly looks very straightforward for a lot of Windows code.

Re: AI is breaking two vulnerability cultures

#103

Post by manquer » Sat, May 09, 2026, 1:13 AM UTC

fragmede wrote: post #54

rikafurude21 wrote: post #3

This feels more like an old problem getting reframed as an AI problem. people were already diffing kernel commits and figuring out which ones were security fixes long before llms. if a patch lands publicly, the race has basically already started. also not sure shorter embargoes really help. the orgs that can patch in hours are already fine. everyone else still takes days or weeks. if anything, cheaper exploit generat…

Reminder: the Ksplice patent expires October 1, 2028.

I don't think hot patching holds the same relevance it did in 2010.

Much of today's workloads are containerized and run on roughly ephemeral nodes that can be switched out easily- K8s version upgrades force this more or less. We tent to run more and more of-the shelf hardware and worry less about individual node failures now.

In-memory updates also not magic , and can be limited as they requires data structure semantics to not really change and can create its own class of issues/bugs including security ones.

While am sure there are still use cases which dictate this type of update, the need is lot less than 15 years ago that the patent expiry will do much to the ecosystem.

Re: AI is breaking two vulnerability cultures

#104

Post by riknos314 » Sat, May 09, 2026, 1:32 AM UTC

Izkata wrote: post #101

organsnyder wrote: post #26

Earlier quoted context omitted.

Finding a vulnerability by looking at the diff that fixed it is very different than just looking through the code.

They're saying to do that scan to every diff before release, to see if it finds anything.

I believe their point was that:

"How likely is this diff a patch for an existing vulnerability?"

Seems to be an easier question to answer than

"Are there any new vulnerabilities introduced by this diff?"

In other words identifying that a patch is for a vulnerability is typically easier than finding the vulnerability in the first place.

Re: AI is breaking two vulnerability cultures

#105

Post by riknos314 » Sat, May 09, 2026, 1:40 AM UTC

tptacek wrote: post #41

This has been a very long time coming and the crackup we're starting to see was predicted long before anyone knew what an LLM is. The catalyst is the shift towards software transparency: both the radically increased adoption of open source and source-available software, and the radically improved capabilities of reversing and decompilation tools. It has been over a decade since any ordinary off-the-shelf closed-sourc…

I believe this premise that the cost of identification of vulnerabilities via diffs is going down over time begs the question "what do our processes need to look like if simply making the patch public is the disclosure?"

Current coordinated disclosure practices have a dependency on patching and disclosure being separate, but the gap between them seems to be asymptomatically approaching zero.

Re: AI is breaking two vulnerability cultures

#106

Post by 23fedner » Sat, May 09, 2026, 2:03 AM UTC

[dead]

Re: AI is breaking two vulnerability cultures

#107

Post by raincole » Sat, May 09, 2026, 2:08 AM UTC

dmurray wrote: post #99

Obviously the solution is for Linux to move to a closed-source development model. Security researchers should report their findings to a committee that includes some big companies (IBM and Oracle seem like trustworthy choices here, but ideally we should find a way to get Microsoft included). Those companies would apply the security patches and distribute binary builds of Linux to their customers. Users fortunate enou…

I like how after so many years, people finally start recognizing that obscurity is a part of security. Not the whole security, obviously, but a part of it.

Re: AI is breaking two vulnerability cultures

#108

Post by skinfaxi » Sat, May 09, 2026, 2:10 AM UTC

Izkata wrote: post #101

organsnyder wrote: post #26

Earlier quoted context omitted.

Finding a vulnerability by looking at the diff that fixed it is very different than just looking through the code.

They're saying to do that scan to every diff before release, to see if it finds anything.

The diff yields the patched code which is used to produce the exploit.

Re: AI is breaking two vulnerability cultures

#109

Post by cormacrelf » Sat, May 09, 2026, 2:10 AM UTC

xiaoyu2006 wrote: post #9

The quick test doesn't show a lot - by out straight asking if this is a security patch, it implies and guides AI to have output more probably to agree on this assumption. A confusion matrix is more useful. Nonetheless of course this is not a detailed ai capability testing blog.

Realistically, if you are scanning each kernel commit to check if they might be patching a security issue, you are going to be asking an LLM "is this security related, if so vaguely how" with low effort and taking "maybe" as a yes before feeding it to a more expensive model. You aren't trying to establish a probability of an ultimately unknowable fact, there is ground truth that you can find by producing an exploit, so you are just trying to pre-filter before spending the money to find it.

Re: AI is breaking two vulnerability cultures

#110

Post by wisty » Sat, May 09, 2026, 2:12 AM UTC

A 3rd culture - the "security though obscurity" culture where some random little library might be a potential weak link, but will anyone really bother to hack it?

Not as worrysome in a philosophical way (since it's not a serious culture) but it's a real issue. And just wait for a nation state to start astroturing helpful little libraries at scale ...