Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Open Source Isn't Dead

strix.ai

Post reply on HN
Print view View original

171–180 of 200 posts

Re: Open Source Isn't Dead

#171

Post by njyx »

valeriozen wrote: post #163
sdoering wrote: post #142

Earlier quoted context omitted.

Seconded. Having worked in quite a few agency/consultancy situations, it is far more productive to smash your head against a wall till bleeding, than to get a client to pay for security. The regular answer: "This is table stakes, we pay you for this." Combined with: "Why has velocity gone down, we don't pay you for that security or documentation crap." There are unexploited security holes in enterprise software you c…

Yea, its fundamentally an issue of asymmetric economics. Running AI scanners internally costs money, dev time, and management buy in to actually fix the mountain of tech debt the scanners uncover. As you said there is no incentive for that But for bad actors the cost of pointing an LLM at an exposed endpoint or reverse engineered binary has dropped to near zero. The attackers tooling just got exponentially cheaper an…

In theory though, there is now a new way for community to support open source, but running vulnerability scans in white-hat mode, reporting and patching. That way they burn tokens for a project they love. Even if they couldn't actually contribute code before.

There should be a way to donate your unused tokens on every cycle to open source like rounding up at the chekout!

Re: Open Source Isn't Dead

#172

Post by bluebarbet »

lelanthran wrote: post #159
bluebarbet wrote: post #130

Earlier quoted context omitted.

Same tools A, B and C, but minus tools D, E and F, and with a smaller chance that any tools at all will even be used. Not claiming that it's a slam dunk for open source, but the inverse does not seem correct either.

> Same tools A, B and C, but minus tools D, E and F, Why "minus D, E and F"? After all, once you have the harness set up, there's no additional work to add in new models, right?

The point being that there are always going to be more eyes, and more knowledge of available tools (i.e. including "D, E and F"), and more experience using them, with open source than with a single in-house dev team.

Re: Open Source Isn't Dead

#173

Post by pembrook »

victorbjorklund wrote: post #165

I don’t believe for a second that the real reason is security by obscurity. They probably believe they can make more money not being open source and this sounds like a better excuse than ”we wanna make more money”.

Probably, and I don’t care and kinda wish they boldly said so too. It’s their product to do with what they want, they built it.

One of the ugliest parts of open source is people believing they’re entitled to you working for free forever. And instead of being thankful you gave years of your labor for free, people get angry at you for not continuing to do so forever. And try to shame you as if you’re somehow greedy if that changes.

Do you work exclusively pro-bono on open source projects? Or do you work a job where you only go in if you get paid?

Re: Open Source Isn't Dead

#174

Post by riazrizvi »

CodesInChaos wrote: post #2

> The reasoning provided by their CEO, Bailey Pumfleet, is that AI has automated vulnerability discovery at scale, That sounds like an excuse. The real reason is probably that it's hard to make a viable business out of developing open source.

Yes. Before AI the source was a demonstration of your substance. Users would be encouraged to reach out to maintainers to pay for upgrades or custom tweaks or training. Or indirectly pay for advertising while reading docs. After AI those revenue streams have collapsed. Now you have to withdraw enough of the work to make it hard for an individual to recreate with an LLM. The open source needs to be restricted to a rich interaction layer. Cloudflare just announced they are using that model with their services which were already closed source but now they are exposing them through new APIs. So they can capitalize on existing services that were not ripe enough for SaaS before AI, that had to be handled by their in-house professionals services folks. With this move they are using AI to expand/automate their white glove professional services business to smaller customers.

Re: Open Source Isn't Dead

#175

Post by cyanydeez »

lelanthran wrote: post #108
tananaev wrote: post #3

I have an open source project and started receiving a lot of security vulnerability reports in the last few months. A lot of them are extremely corner cases, but there were some legit ones. They're all fixed now. Closed source software won't receive any reports, but it will be exploited with AI. So I definitely agree with the message of this article.

> Closed source software won't receive any reports, but it will be exploited with AI. What makes you so sure that closed-source companies won't run those same AI scanners on their own code? It's closed to the public, it's not closed to them!

Because they're a company. Even if the bar to entry can fit a normal sized american, doesn't mean they will do it, or do it in a systematic way; We know very well that nothing about AI is naturally systematic, so why would you assume it'll happen in a systematic way.

Re: Open Source Isn't Dead

#177

Post by lelanthran »

bluebarbet wrote: post #172
lelanthran wrote: post #159

Earlier quoted context omitted.

> Same tools A, B and C, but minus tools D, E and F, Why "minus D, E and F"? After all, once you have the harness set up, there's no additional work to add in new models, right?

The point being that there are always going to be more eyes, and more knowledge of available tools (i.e. including "D, E and F"), and more experience using them, with open source than with a single in-house dev team.

There's no more "eyes" though, it's all models, and they are all converging pretty damn fast.

Re: Open Source Isn't Dead

#178

Post by lelanthran »

valeriozen wrote: post #163
sdoering wrote: post #142

Earlier quoted context omitted.

Seconded. Having worked in quite a few agency/consultancy situations, it is far more productive to smash your head against a wall till bleeding, than to get a client to pay for security. The regular answer: "This is table stakes, we pay you for this." Combined with: "Why has velocity gone down, we don't pay you for that security or documentation crap." There are unexploited security holes in enterprise software you c…

Yea, its fundamentally an issue of asymmetric economics. Running AI scanners internally costs money, dev time, and management buy in to actually fix the mountain of tech debt the scanners uncover. As you said there is no incentive for that But for bad actors the cost of pointing an LLM at an exposed endpoint or reverse engineered binary has dropped to near zero. The attackers tooling just got exponentially cheaper an…

Hang on, why is it costly for in-house to run AI scanners but near zero for threat actors to do the same?

I've seen multiple proprietary places now including a routine AI scan of their code because it's so cheap and they may as well use-up unused tokens at the end of the week.

I mean, it's literally zero because they already paid for CC for every developer. You can't get cheaper than that.

Re: Open Source Isn't Dead

#179

Post by topopopo »

baileypumfleet wrote: post #123
lelanthran wrote: post #108

Earlier quoted context omitted.

> Closed source software won't receive any reports, but it will be exploited with AI. What makes you so sure that closed-source companies won't run those same AI scanners on their own code? It's closed to the public, it's not closed to them!

As I mentioned above, we actually do run these AI scanners on our code, but the problem is it's simply not enough. These AI scanners, including STRIX, don't find everything. Each scanning tool actually finds different results from the other, and so it's impossible to determine a benchmark of what's secure and what's not.

I think it makes it all the more apparent that writing EAL4 code with as little design competence as possible was taking advantage of some strange scarcity economics.. It's now even easier to make something with endless technical debt and security vs backwards compatibility liability but is anyone going to keep paying for things that aren't correct and to the point if some market participants structure their agent usage toward verifiable quality and don't actually have more cost any more?

Re: Open Source Isn't Dead

#180

Post by bluebarbet »

lelanthran wrote: post #177
bluebarbet wrote: post #172

Earlier quoted context omitted.

The point being that there are always going to be more eyes, and more knowledge of available tools (i.e. including "D, E and F"), and more experience using them, with open source than with a single in-house dev team.

There's no more "eyes" though, it's all models, and they are all converging pretty damn fast.

If true then logically it will be sufficient to run this "master model" once before any code release for the level playing field to be restored. After all, even open-source software is private until it is released.
Post reply on HN