Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cybersecurity looks like proof of work now

dbreunig.com

Post reply on HN
Print view View original

171–180 of 230 posts

Re: Cybersecurity looks like proof of work now

#171

Post by xeyownt »

misja111 wrote: post #163
self_awareness wrote: post #150

Earlier quoted context omitted.

The question is what "complex" means. Complex for us doesn't mean it's complex for LLM. And vice-versa. So I wouldn't value this approach at all.

I disagree. Much of what makes software complex for us, makes it complex for LLM just as well. E.g: - a very large codebase - a codebase which is not modularized into cohesive parts - niche languages or frameworks - overly 'clever' code

Yeah, the main problem is that most companies / people don't give a f*ck about security because it is not a key feature. It's only a marketing stamp. You want it good enough to sell the products, but you don't want to spent too much on it. So instead you go vibe coding. The baby is dead born.

Re: Cybersecurity looks like proof of work now

#172

Post by eru »

bryanrasmussen wrote: post #132
eru wrote: post #107

Earlier quoted context omitted.

> Taken to an extreme, the end result is a dark forest. Sorry, how does that work?

since the suggestion is that the new security bug finding LLMs will increase protection because it will have access to the full source code then, the dark forest fear would be, if it is possible for an attacker to get all the source the attacker will be in a better position. This seems wrong however, as it ignores the arrow of time. The full source code has been scanned and fixed for things that LLMs can find before…

Does this have anything to do with the other 'dark forest'? https://en.wikipedia.org/wiki/Dark_forest_hypothesis

I don't see the connection.

Re: Cybersecurity looks like proof of work now

#173

Post by antirez »

Why this is the wrong analogy: finding hash collisions, while exponentially harder with N, is guaranteed to find, with enough work, some S so that H(S) satisfies N, so an asymmetry of resources used will have the side with more work eventually winning. But bugs are different: 1. different LLMs executions take different branches, but eventually the branches possible based on the code possible states are saturated. 2. if we imagine sampling the model for a bug in a given code M times, with M large, eventually the cap becomes not M (because of saturated state so of the code and the LLM sampler) but I, the model intelligence level. The OpenBSD SACK bug easily shows that: you can run an inferior model for an infinite number of times, it will never realize that the lack of validation of the start window if put together with the integer overflow then put together with the fact the branch where the node should never be NULL is entered produce the bug. So cyber security of tomorrow will not be like proof of work "more GPU wins", but better models and faster access to such models win.

Re: Cybersecurity looks like proof of work now

#174

Post by xeyownt »

codazoda wrote: post #65

> Classical software engineering would have you believe that dependencies are good (we’re building pyramids from bricks) Would it? I’m old school but I’ve never trusted these massive dependency chains. That’s a nit. We’re going to have to write more secure software, not just spend more.

Yeah, exactly.

Your wall should be made of a small number bricks you bet your life on.

All the rest goes inside.

Re: Cybersecurity looks like proof of work now

#175

Post by chrisjj »

somesortofthing wrote: post #7

There's still the question of access to the codebase. By all accounts, the best LLM cyber scanning approaches are really primitive - it's just a bash script that goes through every single file in the codebase and, for each one and runs a "find the vulns here" prompt. The attacker usually has even less access than this - in the beginning, they have network tools, an undocumented API, and maybe some binaries. You can d…

> By all accounts, the best LLM cyber scanning approaches are really primitive - it's just a bash script that goes through every single file in the codebase and, for each one and runs a "find the vulns here" prompt

Primitive? I'd say simple and thorough.

Re: Cybersecurity looks like proof of work now

#176

Post by motbus3 »

Interesting reading, but it brings me some thoughts.

Security was always about having more money/resources. Using more tokens is just another measure for the same.

Some previous post, which I cannot verify myself, stated that mythos is not as powerful as it seems to be as the same bugs could be found using much smaller/simpler models and that the method is the key part.

Re: Cybersecurity looks like proof of work now

#177

Post by chrisjj »

fragmede wrote: post #111
theptip wrote: post #103

Earlier quoted context omitted.

It’s a good thing to keep in mind, but LLM + scaffolding is clearly superior. So if you just use vanilla LLMs you will always be behind. I think the important thing is to avoid over-optimizing. Your scaffold, not avoid building one altogether.

It's wild to me that a paragraph or 7 of plain English that amounts to "be good at things" is enough to make a material difference in the LLM's performance.

There will always be bosses who/which think telling workers to work well works well.

Re: Cybersecurity looks like proof of work now

#179

Post by lmeyerov »

somesortofthing wrote: post #7

There's still the question of access to the codebase. By all accounts, the best LLM cyber scanning approaches are really primitive - it's just a bash script that goes through every single file in the codebase and, for each one and runs a "find the vulns here" prompt. The attacker usually has even less access than this - in the beginning, they have network tools, an undocumented API, and maybe some binaries. You can d…

Most companies and their vendor ecosystems run on OSS

Worse, "attackers no longer break in, they log in", so the supply chain attacks harvesting credentials have been frightening

Re: Cybersecurity looks like proof of work now

#180

Post by high_na_euv »

somesortofthing wrote: post #15
Retr0id wrote: post #8

Earlier quoted context omitted.

Tokens can also be burnt on decompilation.

Another asymmetric advantage for defenders - attackers need to burn tokens to form incomplete, outdated, and partially wrong pictures of the codebase while the defender gets the whole latest version plus git history plus documentation plus organizational memory plus original authors' cooperation for free.

>original authors' cooperation

Ha

>for free.

Haha, it is more complicated in reality

Post reply on HN