Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AI is breaking two vulnerability cultures

jefftk.com

Post reply on HN
Print view View original

141–150 of 188 posts

Re: AI is breaking two vulnerability cultures

#141

Post by deng »

tptacek wrote: post #41

This has been a very long time coming and the crackup we're starting to see was predicted long before anyone knew what an LLM is. The catalyst is the shift towards software transparency: both the radically increased adoption of open source and source-available software, and the radically improved capabilities of reversing and decompilation tools. It has been over a decade since any ordinary off-the-shelf closed-sourc…

> based on the unquestioned premise that delaying disclosure for the operational convenience of system administrators is a good thing. There are reasons to question that premise!

Care to mention these reasons?

With "convenience of system administrators", I'm guessing you mean that there's a patch available that sysadmins can install, ideally before the vulnerability is disclosed? What else are sysadmins supposed to do, in your opinion? Fix the vulnerability themselves? Or simply shutdown the servers?

With the various copyfails of recent, it at least was possible to block the affected modules. If that were not the case, what would you have done, as a sysadmin?

Re: AI is breaking two vulnerability cultures

#142

Post by fragmede »

dakolli wrote: post #114
fragmede wrote: post #88

Earlier quoted context omitted.

Mozilla seems to think it can. https://blog.mozilla.org/en/privacy-security/ai-security-zer...

Ahh yes, I'm sure agents did this all autonomously without any human in the loop what so ever. They are useless without experts to handle them.

So then have the Linux-using organizations employ experts to handle them then.

Re: AI is breaking two vulnerability cultures

#145

Post by ptx »

dnnddidiej wrote: post #118
chuckadams wrote: post #77

Earlier quoted context omitted.

Basically make software development so legally risky that only multi-billion dollar corporations will ever engage in it.

We could get somewhere where clouds can provide a framework of secure primitives that act as a framework. E.g. you build an app, it stores data via api etc. etc. You can test in sandbox. The cloud deploys for customer who paid you via that cloud and you work at arms length. You may not even know their name. You just get the pro subscription fees. The idea bubbling in my head would be an app store for cloud products.…

> This is similar to buying a hammer.

No, it's similar to letting someone else do all your hammering because using a hammer is too dangerous. And then, to make the process more efficient, letting them take control of your home to be able to provide hammering services while making sure you can't touch the hammer.

Re: AI is breaking two vulnerability cultures

#146

Post by alt227 »

Izkata wrote: post #101
organsnyder wrote: post #26

Earlier quoted context omitted.

Finding a vulnerability by looking at the diff that fixed it is very different than just looking through the code.

They're saying to do that scan to every diff before release, to see if it finds anything.

The point is that even if all code commits are scanned as safe by ai, black hats can still analyse the commits and diffs to find vulnerabilites for people who havent patched yet.

Scanning every commit doesnt automatically make everyone in the world patch immediately, vulns can still be found from commits and diffs and used against those who havent patched yet.

Re: AI is breaking two vulnerability cultures

#147

Post by luipugs »

riknos314 wrote: post #104
Izkata wrote: post #101

Earlier quoted context omitted.

They're saying to do that scan to every diff before release, to see if it finds anything.

I believe their point was that: "How likely is this diff a patch for an existing vulnerability?" Seems to be an easier question to answer than "Are there any new vulnerabilities introduced by this diff?" In other words identifying that a patch is for a vulnerability is typically easier than finding the vulnerability in the first place.

If the diff will just be fed to LLMs regardless then what is easier is probably a moot point.

Re: AI is breaking two vulnerability cultures

#148

Post by lofaszvanitt »

0xbadcafebee wrote: post #67

We need automated patch and release cycles. So far we've relied on incredibly slow manual processes to accept reports, investigate, verify, patch, and prepare releases. Releasing a fix often takes months. This is way too slow when attackers can just churn out new exploits in hours. We need to iterate on value chain bottlenecks to lower Mean Time To Patch . We should be able to turn around a bug report to a patched pr…

what could go wrong? :DDD

imagine patching everything up automatically and it's a malware

everything cooked

Re: AI is breaking two vulnerability cultures

#149

Post by dnnddidiej »

ptx wrote: post #145
dnnddidiej wrote: post #118

Earlier quoted context omitted.

We could get somewhere where clouds can provide a framework of secure primitives that act as a framework. E.g. you build an app, it stores data via api etc. etc. You can test in sandbox. The cloud deploys for customer who paid you via that cloud and you work at arms length. You may not even know their name. You just get the pro subscription fees. The idea bubbling in my head would be an app store for cloud products.…

> This is similar to buying a hammer. No, it's similar to letting someone else do all your hammering because using a hammer is too dangerous. And then, to make the process more efficient, letting them take control of your home to be able to provide hammering services while making sure you can't touch the hammer.

I guess. It is like a writer letting someone else print the books, maybe?

Re: AI is breaking two vulnerability cultures

#150

Post by brabel »

jefftk wrote: post #83
awesome_dude wrote: post #24

Earlier quoted context omitted.

That's correlation, not causation. It could equally be argued that the AI slop that's being produced makes for a lot more vulnerabilities being shipped. The bigger target makes for the easier discovery.

It's likely varies enormously between projects. Linux remains extremely low in slop, and the vulnerabilities being fixed are quite old, so it's improving. Many vibe coded projects are very sloppy, and are adding a lot of vulnerabilities. Total number of vulnerabilities likely goes up over time weighting all projects equally, but goes down over time weighting by usage.

Is there evidence serious vulnerabilities are the result of vibe coding already? I haven’t seen any so if you have some references, please share.
Post reply on HN