Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Welcome to the Strip Mining Era of OSS Security

metabase.com

Post reply on HN
Print view View original

21–30 of 94 posts

Re: Welcome to the Strip Mining Era of OSS Security

#21

Post by embedding-shape »

aetherspawn wrote: post #10

Say I had $1000, how do I get the best value for money to discover vulnerabilities? Are there any worthwhile LLM powered services that are turnkey and ready to go?

Not sure about turnkey solutions for finding vulnerabilities that doesn't involve having to hand over a bunch of identity proofs for them to store on their insecure infra and also enrolling in programs.

Besides that, hiring a beefy GPU instance at Vast.ai or similar places then running your own uncensored models on it, I've had great success with AEON-7/Qwen3.6-27B-AEON-Ultimate-Uncensored-NVFP4, smart + uncensored, but there are lots of options, probably some are already tailored for security research.

Re: Welcome to the Strip Mining Era of OSS Security

#22

Post by _alternator_ »

The article focuses on OSS, but closed-source software is at major risk too. Perhaps more.

It's gotten much easier to reverse engineer binaries in general, and security patches in particular. Basically, an LLM can turn binaries into 'readable' code, and then reason about said code.

Re: Welcome to the Strip Mining Era of OSS Security

#23

Post by embedding-shape »

salsakran wrote: post #20
ben_w wrote: post #18

Earlier quoted context omitted.

From what I've heard, every LLM before Mythos (which you can't get, they'll call you if you're big enough) will have far too many false positives to be helpful, so I guess the best option would be to use an agent to help you (not lights-off vibe coding!*) take advantage of all the older tools like valgrind and closing all the compiler warnings? * I presume I'm not the only one to find the agents tasked with adding un…

With all respect to the Anthropic folks, that's just marketing. (If they're reading this: let us into the program so I can be proven wrong here.) I'm sure what they have is awesome, but it's clear that there are people out there with some decent prompts that are getting results out of widely available models as well. The big thing we're sharing is: bulk scanning by random people in random geographies got a _lot_ bett…

> prompts that are getting results out of widely available models as well.

Absolutely, and the "false-positive" issue people keep citing as why Mythos is so good is easily solved in the harness, simplest solution is starting fresh context with another prompt to evaluate if it's a false-positive or not, just adding that drastically cuts down the rate.

Re: Welcome to the Strip Mining Era of OSS Security

#24

Post by bluGill »

dynawicki wrote: post #8
salsakran wrote: post #6

Earlier quoted context omitted.

That was true last year -- things changes. Ignore (admittedly low-effort LLM generated) reports at your own peril.

Software will eventually become "unmaintainable due to lack of interest", because of this very thing. People not invested in this are not "in peril" in any way.

A lot of people are invested without realizing it. I'm typing this on a computer running linux, with all the standard services/software. I maintain one OSS project (icecc - we have always said only run on trusted networks. I'm sure there are a lot of issues in our code but nobody has bothered run a scan yet to my knowledge), but I don't pay attention to everything. I'm sure there are known easy to exploit (with a LLM) issues on this computer just because my distro hasn't updated yet. (I need a better distro, but even the most up to date will constantly have these issues)

Re: Welcome to the Strip Mining Era of OSS Security

#25

Post by 4ladf1 »

bluGill wrote: post #19
as3qkaH wrote: post #16

Apparently the AI company Metabase has a very poor code base. Like so many others, instead of questioning their own (or AI) output, they help their AI overlords by promoting security scans. Fact is that Mythos found only one issue in curl and nothing at all in most code bases. It is getting quiet around Mythos, and the AI companies will move on to the next scam.

Mythos found only one issue in curl - but it didn't start until many other LLMs had been run and found a lot of issues that were fixed. If Mythos was run a year ago it would have found over 100 issues (of course it didn't exist a year ago, nor did the other tools).

Curl had many old protocols and code from the 1990s that no one used. Besides, Mythos was claimed to be better than existing tools.

In most open source projects, Mythos or similar tools have found nothing. The AI people only contact the projects where they find something, because it would be bad for marketing otherwise.

Re: Welcome to the Strip Mining Era of OSS Security

#26

Post by salsakran »

_alternator_ wrote: post #22

The article focuses on OSS, but closed-source software is at major risk too. Perhaps more. It's gotten much easier to reverse engineer binaries in general, and security patches in particular. Basically, an LLM can turn binaries into 'readable' code, and then reason about said code.

Perhaps -- but I think for most people, the vast majority of proprietary software they consume is over the network.

But yeah, if you're distributing binaries publicly, then you're going to have very similar problems.

Re: Welcome to the Strip Mining Era of OSS Security

#27

Post by bluGill »

ben_w wrote: post #18
aetherspawn wrote: post #10

Say I had $1000, how do I get the best value for money to discover vulnerabilities? Are there any worthwhile LLM powered services that are turnkey and ready to go?

From what I've heard, every LLM before Mythos (which you can't get, they'll call you if you're big enough) will have far too many false positives to be helpful, so I guess the best option would be to use an agent to help you (not lights-off vibe coding!*) take advantage of all the older tools like valgrind and closing all the compiler warnings? * I presume I'm not the only one to find the agents tasked with adding un…

That is false. A year ago every LLM generated report was slop - more likely a false positive than correct. However in the past few months nearly every LLM generated report is real.

Re: Welcome to the Strip Mining Era of OSS Security

#28

Post by redanddead »

salsakran wrote: post #26
_alternator_ wrote: post #22

The article focuses on OSS, but closed-source software is at major risk too. Perhaps more. It's gotten much easier to reverse engineer binaries in general, and security patches in particular. Basically, an LLM can turn binaries into 'readable' code, and then reason about said code.

Perhaps -- but I think for most people, the vast majority of proprietary software they consume is over the network. But yeah, if you're distributing binaries publicly, then you're going to have very similar problems.

That happens a lot though, even OpenAI is attempting to lock functionality (like computer-use, 2 weeks ago) behind a binary -- Mac only they said, no EU. I saw a guy crack it the same day, ported to Windows. There are many many things like Rive that use binaries, obfuscation and uglification has been the name of the proprietary game for a long ass time, with the only protection being an assumption that "nobody would go through that trouble", yeah an LLM would ralph loop through it all day long, and make what you paid good money for pretty much free for anyone to use whenever they feel like it, we're back to the the "you wouldn't download a car would you?" argument

Re: Welcome to the Strip Mining Era of OSS Security

#29

Post by dynawicki »

bluGill wrote: post #24
dynawicki wrote: post #8

Earlier quoted context omitted.

Software will eventually become "unmaintainable due to lack of interest", because of this very thing. People not invested in this are not "in peril" in any way.

A lot of people are invested without realizing it. I'm typing this on a computer running linux, with all the standard services/software. I maintain one OSS project (icecc - we have always said only run on trusted networks. I'm sure there are a lot of issues in our code but nobody has bothered run a scan yet to my knowledge), but I don't pay attention to everything. I'm sure there are known easy to exploit (with a LLM…

What you just described may be accurate. But it also is the essence of a "trap". My comment about investment was more to that point.

If software "is a trap", even my ever-computing loving wrote first programs on an Apple II in the 80s will only be as you sort of describe invested in by reference (minimal usage).

But no-one will sign up for a "trap" as a career, and only those who do will deal with its problems. The first thing that comes to mind is "Johns", "Hotels", and the trappings of the sex trade.

Re: Welcome to the Strip Mining Era of OSS Security

#30

Post by hrjriritifif »

I do not think author understands how opensource works. You have a problem on your computer, in __your__ software, and somehow some random dude is responsible for fixing it? Sure if you gimme a few kilo USDs I will drop everything and come to rescue you. But for free it is a volunteer gig I do once a month....
Post reply on HN