feels like the real shift is not open vs closed, but reaction time AI attackers don’t need perfect access anymore, just enough surface and time. So the question becomes:
can you detect+respond faster than they can iterate in that sense, open source might even help -more eyes reduces time to fix, not just time to find
Open Source Isn't Dead
151–160 of 200 posts
Re: Open Source Isn't Dead
#152Earlier quoted context omitted.
> Closed source software won't receive any reports, but it will be exploited with AI. What makes you so sure that closed-source companies won't run those same AI scanners on their own code? It's closed to the public, it's not closed to them!
As someone who works on closed source software and has done for a couple of decades, most companies won't even know about that and of those who do only a fraction give enough of a shit about it to do anything until they are caught with their pants down.
Yup, closed source software is a huge pile of shit with good marketing teams. Always was.
Re: Open Source Isn't Dead
#153I have an open source project and started receiving a lot of security vulnerability reports in the last few months. A lot of them are extremely corner cases, but there were some legit ones. They're all fixed now. Closed source software won't receive any reports, but it will be exploited with AI. So I definitely agree with the message of this article.
> Closed source software won't receive any reports, but it will be exploited with AI. What makes you so sure that closed-source companies won't run those same AI scanners on their own code? It's closed to the public, it's not closed to them!
[dead]
Re: Open Source Isn't Dead
#154[dead]
Re: Open Source Isn't Dead
#155I have an open source project and started receiving a lot of security vulnerability reports in the last few months. A lot of them are extremely corner cases, but there were some legit ones. They're all fixed now. Closed source software won't receive any reports, but it will be exploited with AI. So I definitely agree with the message of this article.
> Closed source software won't receive any reports Not from the automated repo scanners, but bug bounty programs can generate a lot of reports in my experience. AI tools are becoming a problem there, too, because amateurs are drawn to the bounties and will submit anything the AI hallucinates. Closed source companies can (and should!) also run their own security audits rather than passively waiting for volunteers to s…
> Not from the automated repo scanners, but bug bounty programs can generate a lot of reports in my experience. AI tools are becoming a problem there, too, because amateurs are drawn to the bounties and will submit anything the AI hallucinates
So just like a pre-AI or worse?
Re: Open Source Isn't Dead
#156[flagged]
Re: Open Source Isn't Dead
#157Earlier quoted context omitted.
Came here to say the same. Same tools + private. In security two different defense-mechanisms are always better than one.
Same tools A, B and C, but minus tools D, E and F, and with a smaller chance that any tools at all will even be used. Not claiming that it's a slam dunk for open source, but the inverse does not seem correct either.
Fair enough
Re: Open Source Isn't Dead
#158Earlier quoted context omitted.
Claude is already shockingly good at reverse engineering. Try it – it's really a step change. It has infinite patience which was always the limited resource in decompiling/deobfuscating most software.
It's SaaS though. You don't have access to the binary to decompile. There's only so much you can reverse-engineer through public URLs and APIs, especially if the SaaS uses any form of automatic detection of bot traffic.
Thanks you. This is what the parent post was trying to say. Don't know why it is down-voted. AI or not, if the API end points are well secured, for example use uuid-v7, then their is little that the ai can gain from just these points.
Re: Open Source Isn't Dead
#159Earlier quoted context omitted.
Came here to say the same. Same tools + private. In security two different defense-mechanisms are always better than one.
Same tools A, B and C, but minus tools D, E and F, and with a smaller chance that any tools at all will even be used. Not claiming that it's a slam dunk for open source, but the inverse does not seem correct either.
> Same tools A, B and C, but minus tools D, E and F,
Why "minus D, E and F"? After all, once you have the harness set up, there's no additional work to add in new models, right?
Re: Open Source Isn't Dead
#160Earlier quoted context omitted.
Exactly. I respect their decision to go closed source if that's what they need to do to make it a viable business, but just be honest about it. Don't make up some excuse around security and open source.
I don't know if I fully agree with this -- how many people were actually self-hosting cal infra? I def could be wrong though
it's not necessarily about people self hosting it, it's about people preferring to pay for hosted stuff that is open source (e.g. I pay for Plausible).
Now it's a lot easier to rewrite open source stuff to get around licensing requirements and have an LLM watch the repo and copy all improvements and fixes, so the bar for a competitor to come along and get 10 years of work for free it a lot lower.