221–230 of 230 posts
we're going to have to get a lot better at building test suites. for example every js exploit found in browsers should also be added to https://github.com/tc39/test262 .
Earlier quoted context omitted.
I think this is so relevant, and thank you for posting this. Of course it's trivially NOT true that you can defend against all exploits by making your system sufficiently compact and clean, but you can certainly have a big impact on the exploitable surface area. I think it's a bit bizarre that it's implicitly assumed that all codebases are broken enough, that if you were to attack them sufficiently, you'll eventually…
Problem is, the way economic activity is organised in general, there is no transition path from complex bloated systems to well designed completely human auditable systems. For example given the inherent (and proven) security risks of the Wordpress ecosystem, nobody should run WP anymore.
Usually the way this happens in practice is that you take what has been learned about the market and the requirements from older, bloated, not-working-anymore products, and then start a new company and a new product that is simpler and hits 80% of the use cases with 20% of the complexity. There's even a name for this in business: "Disruptive Innovation". The simple product will eventually become bloated and complex and fail once it gets popular and lots of people start working on it, but then you start the cycle anew.
The economy is actually very well structured to accommodate this. One of the great parts of capitalism and market economies is that it tolerates partial failures extremely well: you just buy from a different supplier. This is in contrast to other systems like fascism, communism, socialism, bureaucracy, and state capitalism where the failure of the system usually means the failure of the state as well, because there is no way to replace parts of the system without a revolution.
There is arguably a problem with the current U.S. economy where the government has become overly involved in certain "too big to fail" industries, thus creating a system much closer to state capitalism that can no longer tolerate partial failures and so is condemned to one huge failure. This is unfortunate, but the eventual resolution is the same: throw it out and start again.
Earlier quoted context omitted.
Has anyone used an LLM to deobfuscate compiled Javascript?
yes, but it requires some nudging if you don't want to waste tokens. it will happily grep and sed through massive javascript bundles but if you tell it to first create tooling like babel scripts to format, it will be much quicker.
Can you expand on this? Is that existing tooling for deminification?
Earlier quoted context omitted.
Does this have anything to do with the other 'dark forest'? https://en.wikipedia.org/wiki/Dark_forest_hypothesis I don't see the connection.
I guess the connection would be human history, a dark forest is a scene of lawlessness and violence and danger in much of that history - at least where stories are concerned. In the use of the phrase Dark Forest to explain the Fermi paradox it suggests that alien civilizations have kept themselves dark out of fear that the rest of the forest is actually lawless and violent. In this case though we are entering a dark…
It's more complicated.
For the Fermi paradox version of the 'Dark Forest' to work, you need civilisations to actively go out and destroy any other form of life they find announcing themselves:
> The "dark forest" hypothesis presumes that any space-faring civilization would view any other intelligent life such as theirs as an inevitable threat and thus destroy any nascent life that makes itself known. As a result, the electromagnetic radiation surveys would not find evidence of intelligent alien life.
Wikipedia has a section on game theory etc.
Without this additional element (basically the version you describe), the dark forest theory doesn't explain the Fermi Paradox: it's just another filter that might perhaps exclude 90% of civilisations, but many civilisations would still be dumb enough to announce themselves. Humans certainly did and keep doing so: it only needs a some people to send a message, and near unanimity to not send anything.
(And that's completely ignoring that our very atmosphere with its chemical imbalance has been sending a strong message of "there's probably life here" for billions of years now. Even our own technology, still in its infancy, is increasingly able to pick up clues about the chemical composition of the atmosphere of exoplanets ever further away from us. And we are still getting better quickly.)
If you add the element that other civilisation are hiding, but come out of hiding just to strike, that breaks down as soon as you have more than two players. Or even just the faint possibility of more than two players.
When you know there are only at most exactly to players, and you are the lurker and find someone else being 'noisy': yes, you have an incentive to strike. When there might be other third parties lurking, you better stay quiet, lest you invite a strike by a third party against you.
Earlier quoted context omitted.
Compare and contrast https://en.wikipedia.org/wiki/Kerckhoffs%27s_principle
My point is that the cost for the attacker is higher than the cost for the defender, if the attacker has to spend tokens probing for vulnerabilities against a system which has little know about it, while the defender spends tokens on a system they have the full source to. That is not at all relevant to "security via obscurity" or similar arguments: having the source in the open may (eventually) be more secure, but it…
Earlier quoted context omitted.
My point is that the cost for the attacker is higher than the cost for the defender, if the attacker has to spend tokens probing for vulnerabilities against a system which has little know about it, while the defender spends tokens on a system they have the full source to. That is not at all relevant to "security via obscurity" or similar arguments: having the source in the open may (eventually) be more secure, but it…
The attacker can get access to the sources via eg industrial espionage.
Isn't that an extra cost above and beyond what the defender has?
Earlier quoted context omitted.
The question is what "complex" means. Complex for us doesn't mean it's complex for LLM. And vice-versa. So I wouldn't value this approach at all.
I disagree. Much of what makes software complex for us, makes it complex for LLM just as well. E.g: - a very large codebase - a codebase which is not modularized into cohesive parts - niche languages or frameworks - overly 'clever' code
You need to check out how Claude uses Ghidra MCP or even tell it to use radare2 to disassemble even proprietary hardware ROMs.
We don't even come close to what LLM can understand in just a few minutes.
I regularly run it on large codebases because I'm not able to grasp it in any reasonable timeline.
Earlier quoted context omitted.
Correct. And yet, people are not doing it.
Right, but until now, and even today, in most people's early and primitive use of AI, it's been relatively difficult to make that change. To the extent that later this year and next year, people are able to point an agent at a WordPress instance, and iterate with it until it has a parity version of their surface in a custom form, things might start to change. To be clear, I'm not one of the people who believes that s…
Then the social proof moved to proprietary darknets, e.g. Facebook pages, which is easier - you don't have to learn anything.
I've seen no local small business care about its webpage, but I've seen a lot of them painfully struggle with crappy LOB smartphone apps.
I expect software and UX to only decline in quality.
> to harden a system you need to spend more tokens discovering exploits than attackers will spend exploiting them. I, for the NFL front offices, created a script that exposed an API to fully automate Ticketmaster through the front end so that the NFL could post tickets on all secondary markets and dynamic price the tickets so if rain on a Sunday was expected they could charge less. Ticketmaster was slow to develop an…
Earlier quoted context omitted.
yes, but it requires some nudging if you don't want to waste tokens. it will happily grep and sed through massive javascript bundles but if you tell it to first create tooling like babel scripts to format, it will be much quicker.
> but if you tell it to first create tooling like babel scripts to format, it will be much quicker. Can you expand on this? Is that existing tooling for deminification?