Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cybersecurity looks like proof of work now

dbreunig.com

Post reply on HN
Print view View original

201–210 of 230 posts

Re: Cybersecurity looks like proof of work now

#201

Post by balamatom »

PunchyHamster wrote: post #195
slow_typist wrote: post #142

Earlier quoted context omitted.

Problem is, the way economic activity is organised in general, there is no transition path from complex bloated systems to well designed completely human auditable systems. For example given the inherent (and proven) security risks of the Wordpress ecosystem, nobody should run WP anymore.

I'd hazard a guess 90% of WP instances could be replaced by static site generator + some tiny app to handle forms, and the 9/10th of remaining ones with static gen + form + some external commenting system, whether in cloud or something like commento.

Correct. And yet, people are not doing it.

Re: Cybersecurity looks like proof of work now

#203

Post by jtbayly »

fragmede wrote: post #111
theptip wrote: post #103

Earlier quoted context omitted.

It’s a good thing to keep in mind, but LLM + scaffolding is clearly superior. So if you just use vanilla LLMs you will always be behind. I think the important thing is to avoid over-optimizing. Your scaffold, not avoid building one altogether.

It's wild to me that a paragraph or 7 of plain English that amounts to "be good at things" is enough to make a material difference in the LLM's performance.

I read once (so no idea if it is true) that in voice lessons, one of the most effective things you can do to improve people's technique is to tell them to pretend to be an opera singer.

Re: Cybersecurity looks like proof of work now

#204

Post by linkregister »

wafflemaker wrote: post #200
linkregister wrote: post #135

Earlier quoted context omitted.

Yes, having a good development env with synthetic data, and an inaccessible, secure prod env just got justification. I never considered the secondary SRE laptop but I think it might be a good idea.

Please explain the second laptop. I'm studying cybersecurity, so think I should know why. Or is it a joke?

The value-add is having a workstation that's disconnected from work that would be susceptible to traditional vectors that endpoints are vulnerable to. For example, building software that pulls in potentially malicious dependencies, installing non-essential software, etc. The "SRE laptop" would only have a browser and the official CLI tools from confirmed good cloud and infrastructure vendors, e.g. gcloud, terraform.

I think that such a posture would only be possible in a mature company where concerns are already separated to the point where only a handful of administrators have actual SSO or username/passphrase access to important resources.

Re: Cybersecurity looks like proof of work now

#205

Post by bryanrasmussen »

eru wrote: post #172
bryanrasmussen wrote: post #132

Earlier quoted context omitted.

since the suggestion is that the new security bug finding LLMs will increase protection because it will have access to the full source code then, the dark forest fear would be, if it is possible for an attacker to get all the source the attacker will be in a better position. This seems wrong however, as it ignores the arrow of time. The full source code has been scanned and fixed for things that LLMs can find before…

Does this have anything to do with the other 'dark forest'? https://en.wikipedia.org/wiki/Dark_forest_hypothesis I don't see the connection.

I guess the connection would be human history, a dark forest is a scene of lawlessness and violence and danger in much of that history - at least where stories are concerned.

In the use of the phrase Dark Forest to explain the Fermi paradox it suggests that alien civilizations have kept themselves dark out of fear that the rest of the forest is actually lawless and violent.

In this case though we are entering a dark forest, like Hansel and Gretel, supposedly defenseless against the monsters that lurk in there, but really - they weren't that defenseless were they? I don't think the phrase that apt.

Re: Cybersecurity looks like proof of work now

#206

Post by linkregister »

btown wrote: post #198
bryanrasmussen wrote: post #132

Earlier quoted context omitted.

since the suggestion is that the new security bug finding LLMs will increase protection because it will have access to the full source code then, the dark forest fear would be, if it is possible for an attacker to get all the source the attacker will be in a better position. This seems wrong however, as it ignores the arrow of time. The full source code has been scanned and fixed for things that LLMs can find before…

Any single company might be able to proactively defend themselves from attackers, but will companies invest the tokens in this? Most people simply don't care until it's too late. And in a world where companies begin to suffer from attacks as a result - can the ones who are willing to invest in security defend themselves, not just against cyberattackers, but against a broader investor and customer backlash that believ…

The pressure by internal auditors and cyber insurance providers to implement these programs will be strong. I have been at organizations where EDR was added only due to the board of directors following the recommendation of 3rd parties. Of course, there will be new companies that haven't achieved the maturity to have had these pressures. But new companies being thoroughly compromised is hardly a recent phenomenon.

Re: Cybersecurity looks like proof of work now

#207

Post by linkregister »

nl wrote: post #140
somesortofthing wrote: post #7

There's still the question of access to the codebase. By all accounts, the best LLM cyber scanning approaches are really primitive - it's just a bash script that goes through every single file in the codebase and, for each one and runs a "find the vulns here" prompt. The attacker usually has even less access than this - in the beginning, they have network tools, an undocumented API, and maybe some binaries. You can d…

> By all accounts, the best LLM cyber scanning approaches are really primitive - it's just a bash script that goes through every single file in the codebase What accounts are these? I've seen some people use this but I cannot imaging that anyone thinks this is the best. For example I've had success telling LLMs to scan from application entry points and trace execution, and that seems an extremely obvious thing to do.…

Indeed, all the hot security scanning vendors are using custom prompts to capture a more holistic approach. There are of course plenty of legacy scanners that still focus on OS package versions and static configs, but the parts of the industry leaning into LLMs have genuine value to add.

I don't expect Claude Code Review to be a replacement for a good vendor's solution.

Re: Cybersecurity looks like proof of work now

#208

Post by kansface »

nl wrote: post #140
somesortofthing wrote: post #7

There's still the question of access to the codebase. By all accounts, the best LLM cyber scanning approaches are really primitive - it's just a bash script that goes through every single file in the codebase and, for each one and runs a "find the vulns here" prompt. The attacker usually has even less access than this - in the beginning, they have network tools, an undocumented API, and maybe some binaries. You can d…

> By all accounts, the best LLM cyber scanning approaches are really primitive - it's just a bash script that goes through every single file in the codebase What accounts are these? I've seen some people use this but I cannot imaging that anyone thinks this is the best. For example I've had success telling LLMs to scan from application entry points and trace execution, and that seems an extremely obvious thing to do.…

This feels pretty fertile atm to me, because it has been prohibitively expensive to do. I expect there is a ton of low hanging fruit. Why not in the age of AI?

Re: Cybersecurity looks like proof of work now

#209

Post by fragmede »

wafflemaker wrote: post #200
linkregister wrote: post #135

Earlier quoted context omitted.

Yes, having a good development env with synthetic data, and an inaccessible, secure prod env just got justification. I never considered the secondary SRE laptop but I think it might be a good idea.

Please explain the second laptop. I'm studying cybersecurity, so think I should know why. Or is it a joke?

It's not a joke. Supply chain attacks are a thing, but Google Chromebooks are about the most trustable consumer machine you can run custom code on short of a custom app on an iPad. The Chromebook would only ever have access to get the root AWS (or whatever) credentials to delete, say, the load balancer for the entire SaaS company's API/website. If my main laptop gets hacked somehow, the attacker can't get access to the root AWS credentials because the main laptop doesn't have them. The second laptop would only be used sparingly, but it would have access to those root credentials.

Re: Cybersecurity looks like proof of work now

#210

Post by H8crilA »

jdthedisciple wrote: post #199
H8crilA wrote: post #191

Earlier quoted context omitted.

"why isn't everything that could be discovered already discovered"

So you believe AI actually discovered novel ways to compromise computer software that had previously been unknown to the entirety of cyber security experts in the world? Big if true. Can you cite an example? I'm all ears.

No, and nothing I've written suggested that. If you're an AI bot then your alignment needs fixing.
Post reply on HN