Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Open Source Isn't Dead

strix.ai

Post reply on HN
Print view View original

181–190 of 200 posts

Re: Open Source Isn't Dead

#181

Post by ValentineC »

njyx wrote: post #171
valeriozen wrote: post #163

Earlier quoted context omitted.

Yea, its fundamentally an issue of asymmetric economics. Running AI scanners internally costs money, dev time, and management buy in to actually fix the mountain of tech debt the scanners uncover. As you said there is no incentive for that But for bad actors the cost of pointing an LLM at an exposed endpoint or reverse engineered binary has dropped to near zero. The attackers tooling just got exponentially cheaper an…

In theory though, there is now a new way for community to support open source, but running vulnerability scans in white-hat mode, reporting and patching. That way they burn tokens for a project they love. Even if they couldn't actually contribute code before. There should be a way to donate your unused tokens on every cycle to open source like rounding up at the chekout!

That sounds like a great idea. I'd love to be able to contribute the remainder of my monthly AI subscriptions for something like this, especially since some of them bill and refresh their quotas by calendar month.

Re: Open Source Isn't Dead

#182

Post by harlequinetcie »

We need to be more bullish as a community.

So many people discussing things like UBI, however we selfishly create our own little projects all the time.

We need to center our shared efforts, send open source is a step on that.

Nowadays, every closed source solution should be seen as 'you are the product' type of deal.

Re: Open Source Isn't Dead

#183

Post by lelanthran »

baileypumfleet wrote: post #123
lelanthran wrote: post #108

Earlier quoted context omitted.

> Closed source software won't receive any reports, but it will be exploited with AI. What makes you so sure that closed-source companies won't run those same AI scanners on their own code? It's closed to the public, it's not closed to them!

As I mentioned above, we actually do run these AI scanners on our code, but the problem is it's simply not enough. These AI scanners, including STRIX, don't find everything. Each scanning tool actually finds different results from the other, and so it's impossible to determine a benchmark of what's secure and what's not.

> As I mentioned above, we actually do run these AI scanners on our code, but the problem is it's simply not enough. These AI scanners, including STRIX, don't find everything. Each scanning tool actually finds different results from the other, and so it's impossible to determine a benchmark of what's secure and what's not.

Yeah, but with closed source it's cheaper for the defender than for the attacker - the defender can scan their sources and their PRs as well as the compiled output. The attacker can only scan the compiled output, and they have to perform repeated scans.

Re: Open Source Isn't Dead

#184

Post by lelanthran »

bluebarbet wrote: post #180
lelanthran wrote: post #177

Earlier quoted context omitted.

There's no more "eyes" though, it's all models, and they are all converging pretty damn fast.

If true then logically it will be sufficient to run this "master model" once before any code release for the level playing field to be restored. After all, even open-source software is private until it is released.

> If true then logically it will be sufficient to run this "master model" once before any code release for the level playing field to be restored.

I'm struggling to see how it is a level playing field:

1. Closed-source: defender runs llms to check the sources for vulns, runs llms on each PR, runs llm on deployment of the compiled output. Attacker runs llm only on compiled output.

2. Open-source: both attacker and defender runs llms on source, on PRs and on compiled output.

Re: Open Source Isn't Dead

#185

Post by edmondx »

I’m afraid the balance of open source wasn’t broken today. It happened quite a long time ago. It’s just not something people usually talk about. Companies have been using open source code for years to build paid products without giving anything back. Take PHP as an example: a language widely used across the internet, yet with a very limited budget.

Re: Open Source Isn't Dead

#186

Post by dspillett »

lelanthran wrote: post #108
tananaev wrote: post #3

I have an open source project and started receiving a lot of security vulnerability reports in the last few months. A lot of them are extremely corner cases, but there were some legit ones. They're all fixed now. Closed source software won't receive any reports, but it will be exploited with AI. So I definitely agree with the message of this article.

> Closed source software won't receive any reports, but it will be exploited with AI. What makes you so sure that closed-source companies won't run those same AI scanners on their own code? It's closed to the public, it's not closed to them!

> What makes you so sure that closed-source companies won't run those same AI scanners on their own code?

How many companies take the time to use penetration testing tools, that have been available for many years, to verify their software (or pay a penetration testing company to do a more thorough job than they have the experience to do internally)?

Some, certainly. Many, possibly. Most, I would wager not.

Re: Open Source Isn't Dead

#188

Post by rule_of_cool »

pixl97 wrote: post #100
reenorap wrote: post #91

Earlier quoted context omitted.

Why would I create content that I don't get paid for and I don't even get credit for? Everyone who creates free content right now is simply doing the work of AI companies to make them more useful for free. Search engines will cease to exist, so no one will search your content and then click on your link. AI will simply regurgitate your content and take the money for tokens or subscription and not acknowledge you at a…

>There isn't a rule of economics that says better technology makes more, better jobs for horses. It sounds shockingly dumb to even say that --Humans need not apply. It's kind of funny that you think you're going to be making money writing software. If you lock up your software who exactly are you selling it to anyway? It's like you're thinking 25% through the situation then going "I can stay where I am and I don't ha…

buying into the marketing I see? Might as well making stealing easier just cause they will probably manage to steal everything in the end is an interesting thought.

Like yes if the AI thing works out the theft will be retroactively okay because the people that stole will now be the ruling class, but assuming AI models will write good code one day and do all work, when that hasn't happened yet is just repeating corporate propaganda while presuming being convinced you are some sort of cynical truth tell that's telling it how it is.

Re: Open Source Isn't Dead

#189

Post by rule_of_cool »

pixl97 wrote: post #82
jongjong wrote: post #41

I decided to not open source my latest project but it has nothing to do with security concerns. My code is perfectly secure and bug-free. My concern is mostly financial. Most people would be in a better position to monetize my software than I am... Using AI to obfuscate the origin while appropriating all the key innovations. I wouldn't get any credit. Also, I'm not really interested in humans anymore. I have human fa…

>My concern is mostly financial. Then AI will eat your lunch anyway if the financial part has anything at all to do with the code. AI can decompile code very well.

have you like used AI? it's barely usable for anything other than grunt work. You actually have to tell the truth for the cynical but correct trope to work. If it's about now might be time to re-calibrate the hype, if it's about the future, well then there the worst case scenario is far worse than the worst case scenario cynics and LLM company CEOs talk about, human extinction is really the medium bad case if they actually manage to create AGI.

Re: Open Source Isn't Dead

#190

Post by necheffa »

lelanthran wrote: post #108
tananaev wrote: post #3

I have an open source project and started receiving a lot of security vulnerability reports in the last few months. A lot of them are extremely corner cases, but there were some legit ones. They're all fixed now. Closed source software won't receive any reports, but it will be exploited with AI. So I definitely agree with the message of this article.

> Closed source software won't receive any reports, but it will be exploited with AI. What makes you so sure that closed-source companies won't run those same AI scanners on their own code? It's closed to the public, it's not closed to them!

The economic motivation just simply isn't there. I'm sure we could cherry pick a few examples of companies where things like quality and security really are part of the culture, not just feel-good lip services. The reality is that companies are in business to make money and corner cutting is the easiest way to pad the margins.
Post reply on HN