Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vulnerability reports are not special anymore

words.filippo.io

Post reply on HN
Print view View original

131–140 of 249 posts

Re: Vulnerability reports are not special anymore

#131

Post by thomashabets2 »

themanmaran wrote: post #30
Gigachad wrote: post #6

Earlier quoted context omitted.

I'm getting CVE fatigue with all of these super ultra critical 10/10 vulnerabilities that are some node package that compiles my frontend can get stuck if I give it a malicious regex. It's hard to spot the stuff that actually matters.

Seriously. We got 116 github dependabot alerts this week. Half of them for dev dependencies.

I got reminded every week that my static site generator "Jekyll" is insecure.

Ok. Hacking me by changing the input to my Jekyll rather involves being on the other side of the airtight hatch.

Re: Vulnerability reports are not special anymore

#132

Post by walnut_water »

jopsen wrote: post #98
crote wrote: post #52

Earlier quoted context omitted.

I fear it'll just move the problem one layer up. Sure, you've now proven that the code matches the specification - but how do you ensure the specification is watertight?

The specification doesn't have to be. But yeah, writing specs is usually harder than reviewing the code 4 times :)

It kinda does.

See WPA2 KRACK, you could've had a formally verified WPA2 implementation and it still would've been exploitable because the flaw was the specification itself.

Re: Vulnerability reports are not special anymore

#134

Post by [deleted] »

ThreatSystems wrote: post #130
Gigachad wrote: post #90

Earlier quoted context omitted.

It's easier to keep stuff up to date these days. If you have a project with typescript, unit tests, and end to end tests like cypress you can just have dependabot create the PRs to update packages. If everything passes you just have to hit the merge button. Just updating everything is probably easier than assessing if it's possible to trigger an exploit with the way you use the package.

In agreement with frodd above. Dependencies and supply chain attacks are probably the greatest risk to a lot of software orgs, as they run them across all their environments: Development (with secrets and other valuable artefacts on developer VMs), CI/CD pipelines which may have access tokens to production (and other) environments, and production itself. Notably even security companies are being impacted by this[0].…

[deleted]

Re: Vulnerability reports are not special anymore

#135

Post by varjag »

jamesfinlayson wrote: post #87
Quothling wrote: post #79

Earlier quoted context omitted.

Working in the EU energy sector where we have to work with NIS2 compliance, I'd argue that your security team rightly pointed it out. I suspect that's what you mean though, and the rightly is just there because you agree with it but don't like it. We work with even more tight dependencies policies than just having alerts. We have a set of pre-approved and yearly vetted packages, like pandas or pyarrow for Python data…

Yeah I completely understand their intent, but I might get 30 vulnerabilities across a multiple repos flagged in a week. It is already tedious to check them all and assess if they're worth worrying about let alone having to update them. These are 99% Javascript though - I suspect other ecosystems are much more manageable.

I unironically think the solution is vibecoding your own Javascript blobs that use no frameworks and have no (or minimal) external dependencies. At this point it is entirely feasible for many kinds of projects.

Re: Vulnerability reports are not special anymore

#136

Post by CamouflagedKiwi »

Gigachad wrote: post #6
themanmaran wrote: post #2

I feel like it's also been overrun by a lot of spam. As someone running a company, I get 2-5 unsolicited "vulnerability reports" per week. Half of them are an LLM finding some bad CSS on our framer splash page. The other half I assume are an extortion attempt so we just mark as spam. Occasionally I see real security researchers on HN complaining that no one takes the disclosure seriously, or that people reply immedia…

I'm getting CVE fatigue with all of these super ultra critical 10/10 vulnerabilities that are some node package that compiles my frontend can get stuck if I give it a malicious regex. It's hard to spot the stuff that actually matters.

Yeah. We used to get a bunch for OS things inside containers (the ones that had OSes in there) like "Perl regex has exploitable something-or-other". They always came in at high priority so we had to fix them, but realistically they were irrelevant.

Re: Vulnerability reports are not special anymore

#137

Post by paddybyers »

jupenur wrote: post #124

This whole blog post makes me sad. I've been active on both sides of the vulnerability disclosure process for well over a decade and have reported a whole bunch [1] of security bugs to the Go security team. I was there back when Filippo was running the show and have continued since Roland took over. My experience with the people there has always been great. > Ultimately, it all stems from our responsibility to our us…

I wrote about this this morning [1]:

> We're keeping our vulnerability disclosure program open - because even though they are rare, the genuine critical reports we receive, in amongst the noise, are still highly valuable. I don't think we're at the stage yet where finding those issues is a purely mechanical process; persistent, imaginative researchers still make a contribution to the process by finding things that LLMs by themselves, so far, haven't.

[1] https://www.linkedin.com/feed/update/urn:li:activity:7475447...

Re: Vulnerability reports are not special anymore

#138

Post by cuu508 »

jeremyjh wrote: post #66
mackenney wrote: post #45

Earlier quoted context omitted.

That supposes that LLMs can write secure software. Also, if we assume that finding bugs is easier that not creating them (reasonable I would say), the supply of bugs will never be exhausted.

How can it be easier to find them than to not create them? Whatever you do to find them, you could do before you release.

You can accidentally create a bug that you yourself cannot find.

Re: Vulnerability reports are not special anymore

#139

Post by mawadev »

I read a casual teams message from one consultant type of guy who said "the low level linux hackers who don't care about best practices, code quality and security get what they deserve". I don't know how to feel about this other than disgust. The entire space has been overrun by LLMs making stuff up or finding things that aren't critical while some roles capitalize on the fear. There is just so much wrong with saying such things in such a way, I couldn't describe.

This entire demeanor of the way people and ai people talk about software and technical people is getting absurd and simply unprofessional. It is as if we stopped being adults.

Re: Vulnerability reports are not special anymore

#140

Post by adrianN »

crote wrote: post #52
bawolff wrote: post #13

Earlier quoted context omitted.

Verifying behaviour of an arbitrary program is uncomputable. However that doesnt mean you can't have proofs of behaviour of specific programs you create. Personally i have some doubts, a lot of research has gone into the idea without much to show for it, but its a very reasonable research area.

I fear it'll just move the problem one layer up. Sure, you've now proven that the code matches the specification - but how do you ensure the specification is watertight?

Moving the problem one layer up is the desired outcome because it makes exploitation much more difficult. Your attack surface becomes much smaller.
Post reply on HN