Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Open Source Isn't Dead

strix.ai

Post reply on HN
Print view View original

141–150 of 200 posts

Re: Open Source Isn't Dead

#141

Post by themafia »

> In the past, exploiting an application required a highly skilled hacker with years of experience and a significant investment of time to find and exploit vulnerabilities. The reality is that humans don’t have the time, attention, or patience to find everything.

I read this as:

"We figured no one was looking so we just shipped unsafe garbage for years. We never once did an internal audit, never once paid a hacker to try to exploit our product, never thought we'd get caught with our substandard products."

If a guy in his basement with $200 dollars can ruin your company then you were trading on vapor the entire time. I'm sorry you had to find out this way.

Re: Open Source Isn't Dead

#142

Post by sdoering »

440bx wrote: post #117
lelanthran wrote: post #108

Earlier quoted context omitted.

> Closed source software won't receive any reports, but it will be exploited with AI. What makes you so sure that closed-source companies won't run those same AI scanners on their own code? It's closed to the public, it's not closed to them!

As someone who works on closed source software and has done for a couple of decades, most companies won't even know about that and of those who do only a fraction give enough of a shit about it to do anything until they are caught with their pants down.

Seconded.

Having worked in quite a few agency/consultancy situations, it is far more productive to smash your head against a wall till bleeding, than to get a client to pay for security. The regular answer: "This is table stakes, we pay you for this." Combined with: "Why has velocity gone down, we don't pay you for that security or documentation crap."

There are unexploited security holes in enterprise software you can drive a boring machine through. There is a well paid "security" (aka employee surveillance) company using python2.7 (no, not patched) on each and every machine their software runs on. At some of the biggest companies in this world. They just don't care for updating this, because, why should they. There is no incentive. None.

Re: Open Source Isn't Dead

#143

Post by tonymet »

> Closing your source code does not stop an AI from probing your API or finding an authorization bypass in your webhooks.

I see this trope a lot in security discussions. “Obscurity isn’t security” or “since you can’t protect against X you may as well do Y”.

This is a harmful trope, which discourages perfectly good protections. Sure, closing source is not a perfect protection, but it is a defense against a large band of attacks.

Think of the entire field of potential vulnerability probes attackers have. Closing the source closes many of them off, likely most of them.

A pen-tester model with implementation will be loads more effective than one with only a black box. And that will give cal.com time to run the pen testing model on the source and address the vulns , hopefully before they are exploited.

I tested this myself, first using black box model attacks, secondly using the source code. The model with the source found and exploited the vulns instantly . The model without failed.

The lesson is: obscurity is not security ALONE, but it is a component of security.

Re: Open Source Isn't Dead

#144

Post by advael »

baileypumfleet wrote: post #121
tananaev wrote: post #3

I have an open source project and started receiving a lot of security vulnerability reports in the last few months. A lot of them are extremely corner cases, but there were some legit ones. They're all fixed now. Closed source software won't receive any reports, but it will be exploited with AI. So I definitely agree with the message of this article.

We actually run AI scanners on our code internally, so we get the benefit of security through obscurity while also layering on AI vulnerability scanning, manual human penetration testing, and a huge array of other defence mechanisms.

"Security through obscurity" is a term popularized entirely by the long-standing consensus among security researchers and any expert not being paid to say otherwise that this is a bad idea that doesn't work

Re: Open Source Isn't Dead

#145

Post by advael »

cm2187 wrote: post #76
tananaev wrote: post #3

I have an open source project and started receiving a lot of security vulnerability reports in the last few months. A lot of them are extremely corner cases, but there were some legit ones. They're all fixed now. Closed source software won't receive any reports, but it will be exploited with AI. So I definitely agree with the message of this article.

> Closed source software won't receive any reports, but it will be exploited with AI How so? AI won't have access to the source code. In some cases AI may have access to deployed binaries (if your business deploys binaries) but I am not aware that it has the same capabilities against compiled code than source code. But in a SAAS world, all AI has access to is your API. It might be still be up to no good but surely yo…

The opposite is true. Open source barely matters to attackers, especially ones that can be automated. It mostly enables more people (or agents, or people with agents) to notice and fix your vulnerabilities. Secrecy and other asymmetries in the information landscape disproportionately benefit attackers, and the oft-repeated corporate claim that proprietary software is more secure is summarily discounted by most cybersecurity professionals, whether in industry or academic research. This is also seldom the motivation for making products proprietary, but it's more PR-friendly to claim that closing your source code is for security reasons than it is to say that it's for competitive advantage or control over your customers

Re: Open Source Isn't Dead

#146

Post by [deleted] »

bmurphy1976 wrote: post #131
Aurornis wrote: post #4

Earlier quoted context omitted.

> Closed source software won't receive any reports Not from the automated repo scanners, but bug bounty programs can generate a lot of reports in my experience. AI tools are becoming a problem there, too, because amateurs are drawn to the bounties and will submit anything the AI hallucinates. Closed source companies can (and should!) also run their own security audits rather than passively waiting for volunteers to s…

You don't even need a bug bounty program. In my experience there's an army of individuals running low-quality security tools spamming every endpoint they can think (webmaster@ support@ contact@ gdpr@ etc.) with silly non-vulnerabilities asking for $100. They suck now but they will get more sophisticated over time.

[deleted]

Re: Open Source Isn't Dead

#147

Post by [deleted] »

bmurphy1976 wrote: post #131
Aurornis wrote: post #4

Earlier quoted context omitted.

> Closed source software won't receive any reports Not from the automated repo scanners, but bug bounty programs can generate a lot of reports in my experience. AI tools are becoming a problem there, too, because amateurs are drawn to the bounties and will submit anything the AI hallucinates. Closed source companies can (and should!) also run their own security audits rather than passively waiting for volunteers to s…

You don't even need a bug bounty program. In my experience there's an army of individuals running low-quality security tools spamming every endpoint they can think (webmaster@ support@ contact@ gdpr@ etc.) with silly non-vulnerabilities asking for $100. They suck now but they will get more sophisticated over time.

[deleted]

Re: Open Source Isn't Dead

#148

Post by luke5441 »

janalsncm wrote: post #120

Reading between the lines, it seems like they were working with cal.com and used red team bots to find vulnerabilities in cal.com’s code. And they probably found bugs a lot faster than cal.com could fix them. So the CEO balked at the estimated cost of fixing and took his ball home. This article is effectively an announcement that cal.com is riddled with vulnerabilities, which should be easy to find in an archive of t…

Alternatively those scanning tools have the same issue all other security scanners have in that they have too many false positives. And when tuning them to have only few false positives, they miss the true positives.

Then the real work is in investigating each false positive. Can still be useful compared to manual review, but requires real resources.

Meanwhile the flood of false positives causes reputation loss if not addressed. Reputation loss that closed source software does not get. Hence perhaps going closed source.

Re: Open Source Isn't Dead

#149

Post by yc-kraln »

every line of code is a liability. open, closed, doesn't matter. companies will have to treating it that way--which means actual engineering--or they will get burnt, and hard.

Re: Open Source Isn't Dead

#150

Post by evanelias »

geoffschmidt wrote: post #86
cm2187 wrote: post #76

Earlier quoted context omitted.

> Closed source software won't receive any reports, but it will be exploited with AI How so? AI won't have access to the source code. In some cases AI may have access to deployed binaries (if your business deploys binaries) but I am not aware that it has the same capabilities against compiled code than source code. But in a SAAS world, all AI has access to is your API. It might be still be up to no good but surely yo…

Claude is already shockingly good at reverse engineering. Try it – it's really a step change. It has infinite patience which was always the limited resource in decompiling/deobfuscating most software.

It's SaaS though. You don't have access to the binary to decompile. There's only so much you can reverse-engineer through public URLs and APIs, especially if the SaaS uses any form of automatic detection of bot traffic.
Post reply on HN