Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cybersecurity looks like proof of work now

dbreunig.com

Post reply on HN
Print view View original

211–220 of 230 posts

Re: Cybersecurity looks like proof of work now

#211

Post by goodpoint »

xeyownt wrote: post #170
somesortofthing wrote: post #7

There's still the question of access to the codebase. By all accounts, the best LLM cyber scanning approaches are really primitive - it's just a bash script that goes through every single file in the codebase and, for each one and runs a "find the vulns here" prompt. The attacker usually has even less access than this - in the beginning, they have network tools, an undocumented API, and maybe some binaries. You can d…

One defender, many attackers, I don't see how the economy of scale can be positive for the defender. Assuming your code is inaccessible isn't good for security. All security reviews are done assuming code source is available. If you don't provide the source, you'll never score high in the review.

It's the opposite, the economy of scale favors defense.

Re: Cybersecurity looks like proof of work now

#214

Post by jdthedisciple »

H8crilA wrote: post #210
jdthedisciple wrote: post #199

Earlier quoted context omitted.

So you believe AI actually discovered novel ways to compromise computer software that had previously been unknown to the entirety of cyber security experts in the world? Big if true. Can you cite an example? I'm all ears.

No, and nothing I've written suggested that. If you're an AI bot then your alignment needs fixing.

No idea what you're trying to say then. All I demodulated from you thus far is some passive aggression. Perhaps I'm just not in tune with your frequencies rn.

Re: Cybersecurity looks like proof of work now

#215

Post by ang_cire »

> This chart suggests an interesting security economy: to harden a system we need to spend more tokens discovering exploits than attackers spend exploiting them.

What this fails to take into account is that unless the codebase is changed, there are a finite amount of actual (and even fewer actionable) bugs in a piece of code, but an infinite amount of potential attacker spend; nothing stops you running mythos against it, whether it finds anything or not, and because each run is atomic by nature, you just have to play the numbers out and see when the average vuln discovery rate is dropping. You could spend a billion dollars and not find anything, without the defender spending a cent.

Generally speaking, the advantage goes to whoever can spend more time or money on security research (this has always been true, which is why the NSA was able to find Windows exploits that M$ did not). But eventually the fount of bugs in a piece of software will dry up, and attackers have no way of knowing if that's the case or not before dumping money at it (especially since attackers do not generally coordinate unless they're just branches of the same 'entity', e.g. nation-state).

Re: Cybersecurity looks like proof of work now

#216

Post by DerSaidin »

drdrey wrote: post #39
DerSaidin wrote: post #18

> Cybersecurity looks like proof of work now Imo, cybersecurity looks like formally verified systems now. You can't spend more tokens to find vulnerabilities if there are no vulnerabilities.

good luck formally verifying everything

If the alternative is "burn more tokens on finding issues than the attackers do", formal verification starts to look comparatively feasible cost. Think of it as setting an upper bound on cost, vs just burning more and more tokens.

AI assistants would reduce effort of verification too.

Re: Cybersecurity looks like proof of work now

#217

Post by traderj0e »

mapontosevenths wrote: post #186
traderj0e wrote: post #22

Earlier quoted context omitted.

Well, the attacker has something to lose too. It's not like the defender has to be perfect or else attacks will just happen, it takes time/money to invest in attacking.

The cost to your average ransomware crew can be rounded down to zero, because it's pretty darn close. They use automated tools running on other peoples computers and utilizing other peoples connectivity. The tools themselves for most RaaS (ransomware as a service) affiliates are also close to zero cost, as they pay the operator a percentage of profits. The time is a cost, but at scale any individual target is a prett…

At the end of the day, that guy is spending all of his finite hacking time setting up and maintaining these exploits and stolen infra. His marginal cost of breaching you is 0 if you're already vulnerable to the exact same exploit he already set up, but that's a big if, and someone else spent their finite time making toolkits. Otherwise you'd expect everything on the Internet that has any kind of vuln to be breached already.

Anyway I'm curious about the 16yo. Is it that he has special skills, or is it just that minors will do that dirty work for cheaper, given lower consequences and fewer other opportunities?

Re: Cybersecurity looks like proof of work now

#218

Post by anitil »

jorvi wrote: post #168
anitil wrote: post #53

Earlier quoted context omitted.

On that latest episode of 'Security Cryptography Whatever' [0] they mention that the time spent on improving the harness (at the moment) end up being outperformed by the strategy of "wait for the next model". I doubt that will continue, but it broke my intuition about how to improve them [0] https://securitycryptographywhatever.com/2026/03/25/ai-bug-f...

That seems very unlikely. Chinese AI vendors specifically pointed out that even a few gens ago there was maybe 5-15% more capability to squeeze out via training, but that the cost for this is extremely prohibitive and only US vendors have the capex to have enough compute for both inference and that level of training. I'd take their word over someone that has a vested interested in pushing Anthropic's latest and great…

> The real improvements are going to be in tooling and harnessing

I don't have any special knowledge here, but the guy in the podcast (who worked/works with one of the big AI firms) is the one who made the claim. In the future when (if?) the speed of development slows I agree it would no longer be true

Re: Cybersecurity looks like proof of work now

#219

Post by tekacs »

balamatom wrote: post #201
PunchyHamster wrote: post #195

Earlier quoted context omitted.

I'd hazard a guess 90% of WP instances could be replaced by static site generator + some tiny app to handle forms, and the 9/10th of remaining ones with static gen + form + some external commenting system, whether in cloud or something like commento.

Correct. And yet, people are not doing it.

Right, but until now, and even today, in most people's early and primitive use of AI, it's been relatively difficult to make that change. To the extent that later this year and next year, people are able to point an agent at a WordPress instance, and iterate with it until it has a parity version of their surface in a custom form, things might start to change.

To be clear, I'm not one of the people who believes that software is going away or that UX is going away. I think those are both still very important. But I do think that a lot of legacy software can be replaced, and then we'll end up with a new level of software in the longer term.

Re: Cybersecurity looks like proof of work now

#220

Post by mapontosevenths »

traderj0e wrote: post #217
mapontosevenths wrote: post #186

Earlier quoted context omitted.

The cost to your average ransomware crew can be rounded down to zero, because it's pretty darn close. They use automated tools running on other peoples computers and utilizing other peoples connectivity. The tools themselves for most RaaS (ransomware as a service) affiliates are also close to zero cost, as they pay the operator a percentage of profits. The time is a cost, but at scale any individual target is a prett…

At the end of the day, that guy is spending all of his finite hacking time setting up and maintaining these exploits and stolen infra. His marginal cost of breaching you is 0 if you're already vulnerable to the exact same exploit he already set up, but that's a big if, and someone else spent their finite time making toolkits. Otherwise you'd expect everything on the Internet that has any kind of vuln to be breached a…

> m curious about the 16yo. Is it that he has special skills, or is it just that minors will do that dirty work for cheaper, given lower consequences and fewer other opportunities?

I was only able to keep him talking for about 20 minutes, so I can only speculate, but he was using off the shelf RaaS tools that he had modified to make more convincing. I actually got him talking by pointing out that a trick he'd done with the spoofed email headers from "coinbase" was clever, so he was definitely skilled for someone so young. He also had done his homework and knew a bit about me.

It's likely he was recruited just because he was too young for prison, but that he was relatively successful because he was clever.

Post reply on HN