Live data from Hacker News

Significant raise of reports

lwn.net

121–130 of 164 posts

Re: Significant raise of reports

#121
post #96
post #91

Earlier quoted context omitted.

Everything has a poor security track record. That's the point.

Well, except OpenBSD. They’ve only had two vulns in forever.

Only two remote code execution vulnerabilities in the default configuration. But that's not the only type of security bug.

Re: Significant raise of reports

#122
post #27
post #5

An AI enthusiast having a breathless and predictive position on the future of the technology? No way! It's almost like Wall Street is about to sour on the whole stack and there is a concerted effort to artificially push these views into the conversation to get people on board. Then again, I'm a known crank and aggressive cynic, but you never really see any gathered data backing these points up.

Sort of a tautology to just assert that someone saying good things about AI is an AI enthusiast and therefore their opinion should be dismissed. He also happens to have been a kernel maintainer, his experience as he's describing it should count for something.

> He also happens to have been a kernel maintainer

And a primary author of one of the most stable and used load balancers in the history of networking.

Re: Significant raise of reports

#123

Earlier quoted context omitted.

What do you mean "a priori understanding codebases"? Quantify it and let's test specifically what you mean. Linux is huge.

> What do you mean "a priori understanding codebases"? I took him to be distinguishing between (1) just reading the code/docs and reasoning about it, and (2) that + crafting and running tests.

I don't think that's it; both reading the code and running tests are a posteriori capabilities.

Re: Significant raise of reports

#124
post #119
post #98

Earlier quoted context omitted.

No it can't. These aren't "Show HN" posts about new programs people have conjured with Claude. They're either vulnerabilities or they're not. There's no such thing as a "slop vulnerability". The people who exploit those vulnerabilities do not care how much earlier reporters "gave a fuck" about their report. This is in the linked story: they're seeing increased numbers of duplicate findings , meaning, whatever valid b…

Everyone is free to be as snooty as they like. If a report is harder to read/understand/validate because the author just yolo'ed it with an LLM, that's on the report author, not on the maintainers. It's not okay to foist work onto other people because you don't think LLM slop is a problem. It is absolutely a problem, and no amount of apologizing and pontificating is going to change that. Grow up and own your work. St…

Try to make this sentiment coherent. "It's not OK to foist work onto other people". Ok, sure, I won't. The vulnerability still exists. The maintainers just don't get to know about it. I do, I guess. But not them: telling them would "make the world worse".

Re: Significant raise of reports

#125
post #96

Earlier quoted context omitted.

Well, except OpenBSD. They’ve only had two vulns in forever.

Only two remote code execution vulnerabilities in the default configuration. But that's not the only type of security bug.

They're trolling me. :)

Re: Significant raise of reports

#126

>software that used to follow the "release-then-go-back-to-cave" model will have to change to start dealing with maintenance for real, or to just stop being proposed to the world as the ultimate-tool-for-this-and-that because every piece of software becomes a target. Actually, some software are running the water-heater/heat-pump system in my basement. There is a small blue light screen, it keeps logs of consumed elec…

My gut feeling and expectation is that people will be turning their internet off at night, and at all times. At least for a while until this whole new security situation somehow settles with newly invented automation.

May sound weird, but as author of previous comment noted - a lot of appliances need not be connected ever and still benefit humanity.

Re: Significant raise of reports

#127

Earlier quoted context omitted.

Indeed, but it was pretty easy to develop the habit of hitting whatever function key was bound to "Save" fairly frequently. I certainly did. Also auto-save is a mixed bag. With manual save, I was free to start editing a document and then realize I want to save it as something else, or just throw away my changes and start over. With auto-save, I've already modified my original. It took me quite a while to adjust to th…

If your program's auto-save works like that, it's broken. Almost none do, though. Auto-save almost always writes to a temporary file, that is erased when you save manually.

Google Docs and VS Code are the first two that come to mind for autosave and they don't use a temp file.

Re: Significant raise of reports

#128
post #4

The last paragraph is interesting: "Overall I think we're going to see a much higher quality of software, ironically around the same level than before 2000 when the net became usable by everyone to download fixes. When the software had to be pressed to CDs or written to millions of floppies, it had to survive an amazing quantity of tests that are mostly neglected nowadays since updates are easy to distribute." Was so…

The quantity of tests, known as penetration attempts, that most critical software survives today in a networked environment, is magnitudes more daring that the easily-cracked software printed on CDs. I really don't understand how this argument about software made 26 years ago really stands any reasonable ground.

Re: Significant raise of reports

#129

Earlier quoted context omitted.

If your program's auto-save works like that, it's broken. Almost none do, though. Auto-save almost always writes to a temporary file, that is erased when you save manually.

Google Docs and VS Code are the first two that come to mind for autosave and they don't use a temp file.

Fun fact: I was on the Google Docs team from 2010-2015. Save didn't do anything but we still hooked up an impression to the keystroke to measure how often people tried to save. It was one of the top things people did in the app at first; it was comparable to how often people would bold and unbold text. And then as people gained confidence it went down over time.

Re: Significant raise of reports

#130

>software that used to follow the "release-then-go-back-to-cave" model will have to change to start dealing with maintenance for real, or to just stop being proposed to the world as the ultimate-tool-for-this-and-that because every piece of software becomes a target. Actually, some software are running the water-heater/heat-pump system in my basement. There is a small blue light screen, it keeps logs of consumed elec…

There's an anecdote I remember reading somewhere: When an 'embedded systems' engineer was to present a web-based product they were tasked to build, the managers/reviewers were puzzled they couldn't find any bugs. Asked about this, the engineer replied: "I didn't know that was an option". Definitely a different mindset/toolset is required when it comes to building systems that have to be working autonomously without "…

Web interfaces in embedded systems are very common remote exploit mechanisms, so this anecdote for sure isn't the typical experience.
Post reply on HN