Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Open Source Isn't Dead

strix.ai

Post reply on HN
Print view View original

131–140 of 200 posts

Re: Open Source Isn't Dead

#131

Post by bmurphy1976 »

Aurornis wrote: post #4
tananaev wrote: post #3

I have an open source project and started receiving a lot of security vulnerability reports in the last few months. A lot of them are extremely corner cases, but there were some legit ones. They're all fixed now. Closed source software won't receive any reports, but it will be exploited with AI. So I definitely agree with the message of this article.

> Closed source software won't receive any reports Not from the automated repo scanners, but bug bounty programs can generate a lot of reports in my experience. AI tools are becoming a problem there, too, because amateurs are drawn to the bounties and will submit anything the AI hallucinates. Closed source companies can (and should!) also run their own security audits rather than passively waiting for volunteers to s…

You don't even need a bug bounty program. In my experience there's an army of individuals running low-quality security tools spamming every endpoint they can think (webmaster@ support@ contact@ gdpr@ etc.) with silly non-vulnerabilities asking for $100. They suck now but they will get more sophisticated over time.

Re: Open Source Isn't Dead

#132

Post by giancarlostoro »

tananaev wrote: post #3

I have an open source project and started receiving a lot of security vulnerability reports in the last few months. A lot of them are extremely corner cases, but there were some legit ones. They're all fixed now. Closed source software won't receive any reports, but it will be exploited with AI. So I definitely agree with the message of this article.

> Closed source software won't receive any reports, but it will be exploited with AI.

This is what worries me about companies sleeping on using AI to at a bare minimum run code audits and evaluate their security routinely. I suspect as models get better we're going to see companies being hacked at a level never seen before.

Right now we've seen a few different maintainers for open source packages get hacked, who knows how many companies have someone infiltrating their internal systems with the help of AI because nobody wants to do the due dilligence of having a company do security audits on their systems.

Re: Open Source Isn't Dead

#133

Post by poorcedural »

jongjong wrote: post #41

I decided to not open source my latest project but it has nothing to do with security concerns. My code is perfectly secure and bug-free. My concern is mostly financial. Most people would be in a better position to monetize my software than I am... Using AI to obfuscate the origin while appropriating all the key innovations. I wouldn't get any credit. Also, I'm not really interested in humans anymore. I have human fa…

Humans are fine, the problem is your worth.

Re: Open Source Isn't Dead

#134

Post by [deleted] »

BloondAndDoom wrote: post #97
shevy-java wrote: post #67

Earlier quoted context omitted.

Is it good marketing though? I mean personally I do not use AI, and I don't think this opinion of mine will change. I can't look into the future, but right now I don't use nor do I depend on AI. I guess it may work for some people, but even then I am unsure whether that is really good marketing. Riding on a hype train (which AI right now still is) is indeed easier, so that has to be considered.

They are in HN front page, therefore it’s good marketing.

[deleted]

Re: Open Source Isn't Dead

#135

Post by kelnos »

CodesInChaos wrote: post #2

> The reasoning provided by their CEO, Bailey Pumfleet, is that AI has automated vulnerability discovery at scale, That sounds like an excuse. The real reason is probably that it's hard to make a viable business out of developing open source.

Yes, it feels like they've been looking for an excuse to go closed-source, and this one is plausible enough to make it sound like they're only doing it because they "have to".

Re: Open Source Isn't Dead

#136

Post by avivo »

Open source is one of the main reasons I recommended cal.com to everyone — I just did so yesterday again in fact!

I'm disappointed to hear this especially since I don't think the rationale makes sense, from what I understand of the security landscape, and it also makes me a little more skeptical of cal.com in general.

Re: Open Source Isn't Dead

#137

Post by avivo »

baileypumfleet wrote: post #125
CodesInChaos wrote: post #2

> The reasoning provided by their CEO, Bailey Pumfleet, is that AI has automated vulnerability discovery at scale, That sounds like an excuse. The real reason is probably that it's hard to make a viable business out of developing open source.

We've run an extremely profitable business for five years, raised a seed and a Series A, and grown at 300% a year sustainably while being open source. Going closed source actually hurts our business more than it benefits it. But it ultimately protects customer data, and that's what we care about the most.

I think if it ultimately protects customer data in a significant way, I would be for it.

Are you able to share any more detail on how you determined this is the best route? It would be a significant implication for many other pieces of open source software also if so.

(And I say this is someone who just recommended cal.com to someone a few days ago specifically citing the fact that it was open source, that led to increased trust in it.)

I did find the video valuable, for reference for others: https://www.youtube.com/watch?v=JYEPLpgCRck

I think if you are committed to switching back to open source as soon as the threat landscape changes, and you have some metric for what that looks like, that would be valuable to share now.

I would like to see the analysis that you're referencing around open source being 5-10x less secure.

Re: Open Source Isn't Dead

#138

Post by kelnos »

short_sells_poo wrote: post #61
dom96 wrote: post #51

Isn’t the real danger now not the ability to find security vulnerabilities, but rather, the ability of anyone to ask an LLM agent to rewrite your open source project in another language and thus work around whatever license your project has?

This is happening quite a lot actually. People just feed an existing project into their agent harness and have it regenerate more or less the same with a few tweaks and then they publish it. I'm not sure how this works in the legal sense. A human could ostensibly study an existing project and then rewrite it from scratch. The original work's license shouldn't apply as long as code wasn't copy & pasted, right? What ha…

> A human could ostensibly study an existing project and then rewrite it from scratch.

And likely there would be enough similarities that the rewrite would be considered a derived work under copyright law.

> The original work's license shouldn't apply as long as code wasn't copy & pasted, right?

You don't need to do a literal copy & paste for it to be copyright infringement.

> What happens when an automated tool does the same? It's basically just a complicated copy & paste job.

Sounds like copyright infringement to me.

Re: Open Source Isn't Dead

#139

Post by robocat »

flkiwi wrote: post #128
robocat wrote: post #119

Earlier quoted context omitted.

I assumed they were trying to be humorous . Although I find that type of humour obnoxious enough that it would put me off the project.

I gave it a good minute of reading and re-reading because I thought it SURELY was meant tongue in cheek, but I couldn’t make it work.

Maybe I was being too generous - jongjong seems cynical and old enough but can't read similar "humour" from others: https://news.ycombinator.com/item?id=47426320

I previously failed to summarise HN guidelines on sarcasm: https://news.ycombinator.com/item?id=38585465

Re: Open Source Isn't Dead

#140

Post by kelnos »

micromacrofoot wrote: post #105
dom96 wrote: post #51

Isn’t the real danger now not the ability to find security vulnerabilities, but rather, the ability of anyone to ask an LLM agent to rewrite your open source project in another language and thus work around whatever license your project has?

A lot of open source projects already have licenses that allow forking and selling the fork, it hasn't been a problem most of the time... there's a lot more to operating open source as a business beyond just shipping the code

> A lot of open source projects already have licenses that allow forking and selling the fork

If we go by the OSI's definition, a project that doesn't allow this is not "open source". So all open source projects -- not just "a lot" -- allow this.

Post reply on HN