Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Open Source Isn't Dead

strix.ai

Post reply on HN
Print view View original

111–120 of 200 posts

Re: Open Source Isn't Dead

#111

Post by LunicLynx »

lelanthran wrote: post #108
tananaev wrote: post #3

I have an open source project and started receiving a lot of security vulnerability reports in the last few months. A lot of them are extremely corner cases, but there were some legit ones. They're all fixed now. Closed source software won't receive any reports, but it will be exploited with AI. So I definitely agree with the message of this article.

> Closed source software won't receive any reports, but it will be exploited with AI. What makes you so sure that closed-source companies won't run those same AI scanners on their own code? It's closed to the public, it's not closed to them!

Came here to say the same. Same tools + private. In security two different defense-mechanisms are always better than one.

Re: Open Source Isn't Dead

#112

Post by LunicLynx »

tananaev wrote: post #17
Aurornis wrote: post #4

Earlier quoted context omitted.

> Closed source software won't receive any reports Not from the automated repo scanners, but bug bounty programs can generate a lot of reports in my experience. AI tools are becoming a problem there, too, because amateurs are drawn to the bounties and will submit anything the AI hallucinates. Closed source companies can (and should!) also run their own security audits rather than passively waiting for volunteers to s…

Of course everyone should do their own due diligence, but my point is mostly that open source will have many more eyes and more effort put into it, both by owners, but also community.

But also tools that might not be nice and report security vulnerabilities, but exploit them.

There is no guarantee that open means that they will be discovered.

Re: Open Source Isn't Dead

#113

Post by ihaveajob »

lelanthran wrote: post #108
tananaev wrote: post #3

I have an open source project and started receiving a lot of security vulnerability reports in the last few months. A lot of them are extremely corner cases, but there were some legit ones. They're all fixed now. Closed source software won't receive any reports, but it will be exploited with AI. So I definitely agree with the message of this article.

> Closed source software won't receive any reports, but it will be exploited with AI. What makes you so sure that closed-source companies won't run those same AI scanners on their own code? It's closed to the public, it's not closed to them!

More eyes, more chances that someone will actually use the tools. Also, the tools and how you use them are not all the same.

Re: Open Source Isn't Dead

#114

Post by teunispeters »

simonreiff wrote: post #71

Is there any recent research on whether open or closed-source projects are more secure? I am genuinely curious if anyone has studied the question.

I mean "yes but" lots from 2015 and before, on a scholarly paper search engine. (I do not have access to most, but there are some public ones)

I mean as a convention when dealing with cryptography, so far the only organization that has succeeded in doing closed-source cryptography securely, has been the USA's "NSA", and mostly their algorithms are public.

I mostly work in the closed source world, however my observation from all the code bases I've seen is "mostly open source are more secure", except when very thorough following of formal security specifications are followed, and then security is as good as the specifications. (YMMV there, of course).

Re: Open Source Isn't Dead

#115

Post by erelong »

I'll admit that I agree with a lot of the post but that I can't fully wrap myself around the cybersecurity situation today, is it basically:

-if code is open source or closed source, AI bots can still look for exploits

-so we need to use AI to develop a checklist program regardless to check for currently known and unknown exploits given our current state of AI tools

-we have to just keep running AI tools looking for more security issues as AI models become more powerful, which empowers AI bots attacking but also then AI bots to defensively find exploits and mitigate them

-so it's an ongoing effort to work on

I understand the logic of closing the source to prevent AI bot scans of the code but also fundamentally people won't trust your closed source code because it could contain harmful code, thus forcing it to be open source

Edit: Another thing that comes to mind is people are often dunking here on "vibe coding" however can't we just develop "standards / tools" to "harden" vibe coded software and also help guide well for decisions related to architecture of the program, and so on?

Re: Open Source Isn't Dead

#116

Post by tetha »

bigbadfeline wrote: post #92
rd wrote: post #60

Earlier quoted context omitted.

I don't follow. It seems obvious that there's more to gain for attackers using AI agents to exploit open source repositories, than there is for good samaritan defenders. In this new closed-source world (for Cal.com), there's nothing stopping them from running their own internal security agent audits, all whilst at least blocking the easiest method of finding zero-days - that is, being open source. This really just se…

> It seems obvious that there's more to gain for attackers using AI agents to exploit open source repositories, than there is for good samaritan defenders. Actually the opposite is obvious - the comment you replied too talked about an abundance of good Samaritan reports - it's strange to speculate on some nebulous "gain" when responding to facts about more then enough reports concerning open source code. > In this ne…

The main drawback is that you will need to be able to patch quick in the next 3-5 years. We are already seeing this in a few solutions getting attention from various AI-driven security topics and our previous stance of letting fixes "ripen" on the shelf for a while - a minor version or two - is most likely turning problematic. Especially if attackers start exploiting faster and botnets start picking up vulnerabilities faster.

But at that point, "fighting fire with fire" is still a good point. Assuming tokens are available, we could just dump the entire code base, changesets and all, our dependent configuration on the code base, company-internal domain knowledge and previous upgrade failures into a folder and tell the AI to figure out upgrade risks. Bonus points if you have decent integration tests or test setups to all of that through.

It won't be perfect, but combine that with a good tiered rollout and increasing velocity of rollouts are entirely possible.

It's kinda funny to me -- a lot of the agentic hype seems to be rewarding good practices - cooperation, documentation, unit testing, integration testing, local test setups hugely.

Re: Open Source Isn't Dead

#117

Post by 440bx »

lelanthran wrote: post #108
tananaev wrote: post #3

I have an open source project and started receiving a lot of security vulnerability reports in the last few months. A lot of them are extremely corner cases, but there were some legit ones. They're all fixed now. Closed source software won't receive any reports, but it will be exploited with AI. So I definitely agree with the message of this article.

> Closed source software won't receive any reports, but it will be exploited with AI. What makes you so sure that closed-source companies won't run those same AI scanners on their own code? It's closed to the public, it's not closed to them!

As someone who works on closed source software and has done for a couple of decades, most companies won't even know about that and of those who do only a fraction give enough of a shit about it to do anything until they are caught with their pants down.

Re: Open Source Isn't Dead

#118

Post by phendrenad2 »

ihaveajob wrote: post #113
lelanthran wrote: post #108

Earlier quoted context omitted.

> Closed source software won't receive any reports, but it will be exploited with AI. What makes you so sure that closed-source companies won't run those same AI scanners on their own code? It's closed to the public, it's not closed to them!

More eyes, more chances that someone will actually use the tools. Also, the tools and how you use them are not all the same.

With enough copies of GPT printing out the same bulleted list, all bugs are

1. shallow

2. hollow

3. flat

...

Re: Open Source Isn't Dead

#119

Post by robocat »

flkiwi wrote: post #54
jongjong wrote: post #41

I decided to not open source my latest project but it has nothing to do with security concerns. My code is perfectly secure and bug-free. My concern is mostly financial. Most people would be in a better position to monetize my software than I am... Using AI to obfuscate the origin while appropriating all the key innovations. I wouldn't get any credit. Also, I'm not really interested in humans anymore. I have human fa…

> My code is perfectly secure and bug-free. I mean, bold statement but statistically speaking it's almost certainly incorrect. I will say that, irrespective of whether source is open or closed, I would be deeply skeptical of a project that made this assertion.

I assumed they were trying to be humorous . Although I find that type of humour obnoxious enough that it would put me off the project.

Re: Open Source Isn't Dead

#120

Post by janalsncm »

Reading between the lines, it seems like they were working with cal.com and used red team bots to find vulnerabilities in cal.com’s code. And they probably found bugs a lot faster than cal.com could fix them. So the CEO balked at the estimated cost of fixing and took his ball home.

This article is effectively an announcement that cal.com is riddled with vulnerabilities, which should be easy to find in an archive of their code.

Post reply on HN