Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vulnerability reports are not special anymore

words.filippo.io

Post reply on HN
Print view View original

231–240 of 249 posts

Re: Vulnerability reports are not special anymore

#231

Post by NichoPaolucci »

mackenney wrote: post #45
socalgal2 wrote: post #34

I feel like the current situation is temporary. LLMs are finding all the bugs. LLMs are also help fixing most of the bugs. Once most of the bugs are fixed, LLMs should be good at finding bugs before shipping them, the stream of bug reports will die down, and we'll be back to vulnerabiltiy reports being special. Further, the fact that bugs are so easy to find by LLMs means there is strong incentives to find ways to mi…

That supposes that LLMs can write secure software. Also, if we assume that finding bugs is easier that not creating them (reasonable I would say), the supply of bugs will never be exhausted.

I think I’m on this side. I find it exceedingly unlikely that we just start producing “perfect” software all the time for everything, and at the same time start generating an order of magnitude MORE software.

Re: Vulnerability reports are not special anymore

#232

Post by sureglymop »

jeremyjh wrote: post #66
mackenney wrote: post #45

Earlier quoted context omitted.

That supposes that LLMs can write secure software. Also, if we assume that finding bugs is easier that not creating them (reasonable I would say), the supply of bugs will never be exhausted.

How can it be easier to find them than to not create them? Whatever you do to find them, you could do before you release.

Because the behaviour of software changes over the time of development and that's how many bugs happen in the first place.

Especially if you use AI, let's say you have it implement a feature and then change your mind. In my experience AI makes as many if not more bugs than a human.

Re: Vulnerability reports are not special anymore

#233

Post by calvinmorrison »

inigyou wrote: post #60
calvinmorrison wrote: post #11

Earlier quoted context omitted.

Will xorg backport patches from Xlibre?

No, because xorg is a dead project that doesn't take any patches from anywhere and xlibre has shit code quality and is probably vibecoded now

really? From what I have seen so far most of the contributions to xlibre have been cleaning up stuff thats been obviously wrong in xorg, and using tools - including AI and more bog standard tooling to find issues, add safety checks, and a whole lot more. They're merging in a namespace extension which solves many of the purported 'security' issues in X11 today.

Re: Vulnerability reports are not special anymore

#234

Post by matthewdgreen »

FiloSottile wrote: post #208
matthewdgreen wrote: post #203

Earlier quoted context omitted.

Vulnerability reports are a voluntary service to help a vendor or software project. It’s often an annoyance for the security researcher. I understand people are getting slammed and it sucks, but the main result of rejecting them is going to be an increase in full disclosure. As a note: if you have a bug (that isn’t devastating but you’d like to talk about) having an LLM write up the disclosure is a great way to check…

> I understand people are getting slammed and it sucks, but the main result of rejecting them is going to be an increase in full disclosure. Right, what I'm saying is that letting those bugs go to full disclosure (aka being filed as public issues, like every other bug) would have been a significant damage to user safety a year ago, and it's not anymore.

I think that’s an assumption. Just because an LLM might be able to find some bugs does not mean every attacker has a packaged attack, or the right prompting. The easiest way to find a vuln is just to Google for it.

Re: Vulnerability reports are not special anymore

#235

Post by ActorNightly »

pixl97 wrote: post #201
ActorNightly wrote: post #72

Earlier quoted context omitted.

Its been like that for half a decade across all software. People act like finding a linux kernel bug is a big deal, completely ignoring the fact that in order to exploit that bug, the attacker has to be able to run code on your computer in the first place, which is extremely hard to do these days remotely. Also people ironically just DGAF that much. The last actual bad exploit was log4shell in java, which given how i…

Ah yes, just move away from all apache libraries, should only take a day or two.

No I agree, its a pain, but its necessary if you care about security and don't want to audit every single release for potential vulnerabilities. People don't do this, so they really don't care that much.

Re: Vulnerability reports are not special anymore

#236

Post by ActorNightly »

Tepix wrote: post #75
ActorNightly wrote: post #72

Earlier quoted context omitted.

Its been like that for half a decade across all software. People act like finding a linux kernel bug is a big deal, completely ignoring the fact that in order to exploit that bug, the attacker has to be able to run code on your computer in the first place, which is extremely hard to do these days remotely. Also people ironically just DGAF that much. The last actual bad exploit was log4shell in java, which given how i…

These bugs are indeed important, you need them once you‘ve found a bug in an application.

If someone manages to get remote code execution at user space on a machine, the amount of damage that they can do with just that versus having a kernel level exploit is about the same.

Re: Vulnerability reports are not special anymore

#237

Post by LtWorf »

lixtra wrote: post #182
sam_lowry_ wrote: post #161

Earlier quoted context omitted.

> First, this is great reply with lots of real world experience to share. I know how they came about with this setup, but I think that's the wrong way of approaching the problem. Their problem is legacy and trickle-in features in an otherwise unmaintainable code. With AI, they can rewrite their software to minimize dependencies and in general reduce the attack surface by allowing the business to automate more on thei…

Of course, all the generated code has to reviewed and vetted for by a senior developer. Of course, this has to be re-done every now and then when new classes of vulnerabilities appear that the previous generation didn’t have in mind. Or do you just trust the AI that was trained on a lot of bogus code?

The latter, of course.

Re: Vulnerability reports are not special anymore

#238

Post by LtWorf »

varjag wrote: post #135
jamesfinlayson wrote: post #87

Earlier quoted context omitted.

Yeah I completely understand their intent, but I might get 30 vulnerabilities across a multiple repos flagged in a week. It is already tedious to check them all and assess if they're worth worrying about let alone having to update them. These are 99% Javascript though - I suspect other ecosystems are much more manageable.

I unironically think the solution is vibecoding your own Javascript blobs that use no frameworks and have no (or minimal) external dependencies. At this point it is entirely feasible for many kinds of projects.

Sure, so you'll be vulnerable to all sort of things because vibe code is really insecure (as I've personally seen).

Re: Vulnerability reports are not special anymore

#239

Post by jamesfinlayson »

StrauXX wrote: post #148
jamesfinlayson wrote: post #62

Earlier quoted context omitted.

Yep, I've updated dependencies with an RCE that can't be exploited in my codebase just to keep my security team happy. Not worth the multiple arguments about it not actually being an issue.

You can never guarantee that the codepath of a dependency that is vulnerable can not be reached or used as a gadget in an exploit chain. Patching dependencies, even when no direct vulnerability arises is an essential part of defense in depth and sevurity hygene.

I don't disagree, though I should have been more specific - I updated dependencies at extremely short notice because that's what security wanted. I would have updated the dependencies sooner or later anyway because I know that periodically updating dependencies is generally a good thing to do.

Re: Vulnerability reports are not special anymore

#240

Post by ivlad »

iepathos wrote: post #146

"LLMs are as good as almost any security researcher" Oh really? If LLMs were as good as almost any security researcher then you wouldn't be getting flooded by bullshit reports from them. You'd be receiving legitimate reports instead.

Really. Back in the days, the majority of “researchers” sent scan results. The term “beg bounty” didn’t come about for nothing.
Post reply on HN