Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AI is breaking two vulnerability cultures

jefftk.com

Post reply on HN
Print view View original

131–140 of 188 posts

Re: AI is breaking two vulnerability cultures

#131

Post by globalnode »

reactordev wrote: post #123
Izkata wrote: post #97

Earlier quoted context omitted.

Because while you could get something that drives a dumb interface, by moving the work and data to the server it's not available for the emulation software to use.

If the contract is well defined, the LLM can infer what it's purpose is, implementation, possibly even your secret sauce. There is no software moat anymore.

yes this is what i was trying to say. its quite common on older client-server games to do this sort of thing. powerful ai models will just make the work to recreate/emulate servers faster.

Re: AI is breaking two vulnerability cultures

#133

Post by j16sdiz »

sedatk wrote: post #112
dataflow wrote: post #102

Earlier quoted context omitted.

Sounds dubious, do you have a citation? The disassembly looks very straightforward for a lot of Windows code.

They're not encoded, but the code blocks are shuffled. That's why disassembly does look straightforward, but it used to thwart BinDiff at the time.

If I understand correctly, that is just randomness comes from parallel compiling and linking.

If you saying there is a whole step just scrambling blobs, i will be very surprised.

Re: AI is breaking two vulnerability cultures

#136

Post by rmunn »

0xbadcafebee wrote: post #124
chuckadams wrote: post #77

Earlier quoted context omitted.

Basically make software development so legally risky that only multi-billion dollar corporations will ever engage in it.

Legal risk is what insurance is for. You get ensured for a small fee and you go about your job. That's how the non-software world operates anyway

You're assuming the fee would be small. Put yourself in the shoes of an insurance company, deciding what to charge for liability insurance. The potential cost if you have to pay out on the insurance is very very large: depending on the project, software vulnerabilities can cause millions to billions of damage to the economy. And the chance of you having to pay out is a complete unknown.

Unknown chance of having to pay out x large payout amount if you do = very very high premiums. Or not being willing to underwrite the insurance at all.

Remember, insurance is just gambling. The company is betting that the amount of money they'll make from everyone's total premiums added together is greater than the amount they'll have to pay out. Dumb gamblers don't last long. Smart gamblers will evaluate the risk and say "Okay, that'll be $X million a month in premiums", or even "Nope, we won't cover you". Can most open-source projects afford that?

Re: AI is breaking two vulnerability cultures

#137

Post by [deleted] »

tptacek wrote: post #41

This has been a very long time coming and the crackup we're starting to see was predicted long before anyone knew what an LLM is. The catalyst is the shift towards software transparency: both the radically increased adoption of open source and source-available software, and the radically improved capabilities of reversing and decompilation tools. It has been over a decade since any ordinary off-the-shelf closed-sourc…

[deleted]

Re: AI is breaking two vulnerability cultures

#138

Post by riknos314 »

tptacek wrote: post #117
riknos314 wrote: post #105

Earlier quoted context omitted.

I believe this premise that the cost of identification of vulnerabilities via diffs is going down over time begs the question "what do our processes need to look like if simply making the patch public is the disclosure?" Current coordinated disclosure practices have a dependency on patching and disclosure being separate, but the gap between them seems to be asymptomatically approaching zero.

Right, all I'm saying is that we were asymptotically close many years ago; all that's changed is that nobody can kid themselves about it anymore. The actual policy responses to it, I couldn't say! I've always believed, even when there was a meaningful gap between patching and disclosing, that coordinated disclosure norms were a bad default .

What process or mechanism would you prefer to use instead of coordinated disclosure?

Re: AI is breaking two vulnerability cultures

#139

Post by slim »

dmurray wrote: post #99

Obviously the solution is for Linux to move to a closed-source development model. Security researchers should report their findings to a committee that includes some big companies (IBM and Oracle seem like trustworthy choices here, but ideally we should find a way to get Microsoft included). Those companies would apply the security patches and distribute binary builds of Linux to their customers. Users fortunate enou…

There are already closed source operating systems you can use instead of linux. No need to enshittify linux

Re: AI is breaking two vulnerability cultures

#140

Post by thinking_cactus »

thereisnospork wrote: post #25
Hizonner wrote: post #20

Earlier quoted context omitted.

> With skill, and usually not consistently and systematically. How do you know? If the people who like to crow about vulnerabilities aren't doing it, it doesn't mean that the people who are actually in a position to exploit them systematically and effectively aren't doing it. Those embargoes have always been dangerous, because they create a false sense of security. But, as you point out... > With AI, anyone can do th…

>any vulnerability in any software available for inspection is going to be instant public knowledge. Or at least public among anybody who matters. Shouldn't this naturally lead to a state where all (new) code is vulnerability-free? If AI vulnerability detection friction becomes low enough it'll become common/forced practice to pre-scan code.

Remeber (to you both) extrapolation is a perilous business.

Obligatory xkcd https://xkcd.com/605/

Post reply on HN