Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cybersecurity looks like proof of work now

dbreunig.com

Post reply on HN
Print view View original

161–170 of 230 posts

Re: Cybersecurity looks like proof of work now

#161

Post by venzaspa »

direwolf20 wrote: post #152
gerdesj wrote: post #76

Earlier quoted context omitted.

"The real reason why they are unhappy with you having an unsupported browser" I tend to encourage Firefox over Cr flavoured browsers because FF (for me) are the absolute last to dive in with fads and will boneheadedly argue against useful stuff until the cows come home ... Web Serial springs to mind (which should finally be rocking up real soon now). Oh and they are not sponsored by Google errm ... 8) I'm old enough…

> Web Serial why in the absolute fuck would I want random web pages to be able to control all the devices connected to my computer?

It's essentially for programming microcontrollers, ESP32's and the like. It's really handy. You have to confirm the connection every time.

Re: Cybersecurity looks like proof of work now

#162

Post by necovek »

mikewarot wrote: post #118

Long ago, during the Viet Nam conflict, the US government learned that computers needed to be able to securely process data from multiple levels of classification simultaneously. Research in the 1970s found solutions that were adopted in the Mainframe world, like KeyKOS and EROS. Then the PC revolution swept all that away, and we're here 40+ years later, with operating systems that trust every bit of code the user ru…

While I agree we are re-learning lessons from ages ago and reinventing the same tech, I believe the problem comes from the desire to manage the same data with different software. On desktops, imagine your photo library that you might view with one set of programs, modify with another, try out a completely new one to make videos out of photos...

As soon as there are multiple programs with full authority on your data, "cybersecurity" happens. And internet/web is that to the power of 100.

Re: Cybersecurity looks like proof of work now

#163

Post by misja111 »

self_awareness wrote: post #150
nostrademons wrote: post #2

Relevant Tony Hoare quote: “There are two approaches to software design: make it so simple there are obviously no deficiencies, or make it so complex there are no obvious deficiencies”.

The question is what "complex" means. Complex for us doesn't mean it's complex for LLM. And vice-versa. So I wouldn't value this approach at all.

I disagree. Much of what makes software complex for us, makes it complex for LLM just as well. E.g:

- a very large codebase

- a codebase which is not modularized into cohesive parts

- niche languages or frameworks

- overly 'clever' code

Re: Cybersecurity looks like proof of work now

#164

Post by lelanthran »

eru wrote: post #106
somesortofthing wrote: post #7

There's still the question of access to the codebase. By all accounts, the best LLM cyber scanning approaches are really primitive - it's just a bash script that goes through every single file in the codebase and, for each one and runs a "find the vulns here" prompt. The attacker usually has even less access than this - in the beginning, they have network tools, an undocumented API, and maybe some binaries. You can d…

> There's a massive cost asymmetry between the "hardening" phase for the defender and the "discovering exploits" phase for the attacker. Well, you need to harden everything, the attacker only needs to find one or at most a handful of exploits.

> Well, you need to harden everything, the attacker only needs to find one or at most a handful of exploits.

Yeah, but it's not like the attacker knows where to look without checking everything, it it?

If you harden and fix 90% of vulns, the attacker may give up when their attempts reach 80% of vulns.

It's the same as it has ever been; you don't need to outrun the bear, you only need to outrun the other runners.

Re: Cybersecurity looks like proof of work now

#165

Post by jdthedisciple »

I don't understand the nature of the supposed security incidents found by LLMs:

Are these totally previously unknown security holes or are they still generally within the umbrella of our understanding of cybersecurity itself?

If it's the latter, why can't we systematically find and fix them ourselves?

Re: Cybersecurity looks like proof of work now

#167

Post by lelanthran »

echelon wrote: post #109
jeffmcjunkin wrote: post #41

Earlier quoted context omitted.

Can confirm. Matching decompilation in particular (where you match the compiler along with your guess at source, compile, then compare assembly, repeating if it doesn't match) is very token-intensive, but it's now very viable: https://news.ycombinator.com/item?id=46080498 Of course LLMs see a lot more source-assembly pairs than even skilled reverse engineers, so this makes sense. Any area where you can get unlimited…

Has anyone used an LLM to deobfuscate compiled Javascript?

> Has anyone used an LLM to deobfuscate compiled Javascript?

Seems like a waste of money; wouldn't it be better to extract the AST deterministically, write it out and only then ask an LLM to change those auto-generated symbol names with meaningful names?

Re: Cybersecurity looks like proof of work now

#168

Post by jorvi »

anitil wrote: post #53
somesortofthing wrote: post #7

There's still the question of access to the codebase. By all accounts, the best LLM cyber scanning approaches are really primitive - it's just a bash script that goes through every single file in the codebase and, for each one and runs a "find the vulns here" prompt. The attacker usually has even less access than this - in the beginning, they have network tools, an undocumented API, and maybe some binaries. You can d…

On that latest episode of 'Security Cryptography Whatever' [0] they mention that the time spent on improving the harness (at the moment) end up being outperformed by the strategy of "wait for the next model". I doubt that will continue, but it broke my intuition about how to improve them [0] https://securitycryptographywhatever.com/2026/03/25/ai-bug-f...

That seems very unlikely.

Chinese AI vendors specifically pointed out that even a few gens ago there was maybe 5-15% more capability to squeeze out via training, but that the cost for this is extremely prohibitive and only US vendors have the capex to have enough compute for both inference and that level of training.

I'd take their word over someone that has a vested interested in pushing Anthropic's latest and greatest.

The real improvements are going to be in tooling and harnessing.

Re: Cybersecurity looks like proof of work now

#169

Post by ozim »

somesortofthing wrote: post #7

There's still the question of access to the codebase. By all accounts, the best LLM cyber scanning approaches are really primitive - it's just a bash script that goes through every single file in the codebase and, for each one and runs a "find the vulns here" prompt. The attacker usually has even less access than this - in the beginning, they have network tools, an undocumented API, and maybe some binaries. You can d…

Still it makes cost of making software higher.

You cannot get away with „well no one is going to spend time writing custom exploit to get us” or „just be faster than slowest running away from the bear”.

Re: Cybersecurity looks like proof of work now

#170

Post by xeyownt »

somesortofthing wrote: post #7

There's still the question of access to the codebase. By all accounts, the best LLM cyber scanning approaches are really primitive - it's just a bash script that goes through every single file in the codebase and, for each one and runs a "find the vulns here" prompt. The attacker usually has even less access than this - in the beginning, they have network tools, an undocumented API, and maybe some binaries. You can d…

One defender, many attackers, I don't see how the economy of scale can be positive for the defender.

Assuming your code is inaccessible isn't good for security. All security reviews are done assuming code source is available. If you don't provide the source, you'll never score high in the review.

Post reply on HN