Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AI is breaking two vulnerability cultures

jefftk.com

Post reply on HN
Print view View original

31–40 of 188 posts

Re: AI is breaking two vulnerability cultures

#31

Post by y3ahd0g »

Analemma_ wrote: post #2

I'd argue it's actually breaking three vulnerability cultures. In addition to the two Jeff mentions, I think the culture of delaying upgrades and staying on stable versions for as long as possible is going to become increasingly untenable, if everything that's not latest can be trivially scanned and exploited. In the extreme I think there's a decent chance projects like Debian might have to radically overhaul or just…

Yep. This is why I am using local AI to edit and build my own copies of Linux kernel, Wayland... everything a distribution would ship really.

Not so daunting for me having come of age when compiling a kernel specific to a hardware platform was essential.

Custom software that does not fit the usual patterns is not fool proof but it won't be obvious.

Monocultures with all their eggs in one basket are even less secure than truly diverse ecosystems though.

Re: AI is breaking two vulnerability cultures

#32

Post by tempestn »

awesome_dude wrote: post #24
ragall wrote: post #21

Earlier quoted context omitted.

> How do you know? We know because we could see the effects of the average rate of vulnerabilities discovery and exploitation, and it's definitely going up very fast. Until recently, vulnerabilities were relatively hard to find, and finding them was done by a very restricted group of people world-wide, which made them quite valuable. Not any more.

That's correlation, not causation. It could equally be argued that the AI slop that's being produced makes for a lot more vulnerabilities being shipped. The bigger target makes for the easier discovery.

But don't we know that some of the vulnerabilities being discovered predate ai coding?

Re: AI is breaking two vulnerability cultures

#33

Post by woah »

miki123211 wrote: post #28

AI will shorten update windows dramatically. 2026 is the worst year to be thinking about dependency cooldowns, we need to think about dependency warmups instead. Soon, there will be no such thing as a safe way to disclose a vulnerability in an open source project. Centralized SaaS will have a major security advantage here.

You could have a web of trust where Linux-using organizations each spend $x continuously scanning and patching their own dependencies with AI, and sending each other patches and scans.

Re: AI is breaking two vulnerability cultures

#34

Post by santoshalper »

rikafurude21 wrote: post #3

This feels more like an old problem getting reframed as an AI problem. people were already diffing kernel commits and figuring out which ones were security fixes long before llms. if a patch lands publicly, the race has basically already started. also not sure shorter embargoes really help. the orgs that can patch in hours are already fine. everyone else still takes days or weeks. if anything, cheaper exploit generat…

I'd say it's an old problem be exacerbated by AI.

Re: AI is breaking two vulnerability cultures

#37

Post by awesome_dude »

ragall wrote: post #30
awesome_dude wrote: post #24

Earlier quoted context omitted.

That's correlation, not causation. It could equally be argued that the AI slop that's being produced makes for a lot more vulnerabilities being shipped. The bigger target makes for the easier discovery.

> That's correlation, not causation. Pragmatically, correlation *is* evidence of causation in favour of the best explanation, until somebody finds a better explanation. > It could equally be argued that the AI slop that's being produced makes for a lot more vulnerabilities being shipped. This is also true, and does not exclude the other, because for the moment the vast majority of production software in the world (an…

> Pragmatically, correlation is evidence of causation in favour of the best explanation, until somebody finds a better explanation.

Uh, no.

Correlation is only ever one thing - cause for investigation.

Everything based on correlation alone is speculation.

You can speculate all you like, I have zero issue with that, but that's best prefaced with "I guess"

edit: Science captures this perfectly, and people misunderstand this so fundamentally that there is a massive debate where people who think they are "pro science" argue this so badly with theists that they completely hoist themselves with their own petard.

Science uses the term "theory" because all of our understanding is based on "available data" - and science biggest contribution to humanity is that it accepts that the current/leading THEORY can and will be retracted if there is compelling data discovered that demonstrates a falsehood.

So - because I know this is coming - yes science is willing to accept some correlation - BUT it's labelled "theory" or "statistically significant" because science is clear that if other data arises then that idea will need to be revisited.

Re: AI is breaking two vulnerability cultures

#38

Post by ragall »

awesome_dude wrote: post #37
ragall wrote: post #30

Earlier quoted context omitted.

> That's correlation, not causation. Pragmatically, correlation *is* evidence of causation in favour of the best explanation, until somebody finds a better explanation. > It could equally be argued that the AI slop that's being produced makes for a lot more vulnerabilities being shipped. This is also true, and does not exclude the other, because for the moment the vast majority of production software in the world (an…

> Pragmatically, correlation is evidence of causation in favour of the best explanation, until somebody finds a better explanation. Uh, no. Correlation is only ever one thing - cause for investigation. Everything based on correlation alone is speculation. You can speculate all you like, I have zero issue with that, but that's best prefaced with "I guess" edit: Science captures this perfectly, and people misunderstand…

Very often you only have limited time for investigation and you have to act now. Action is almost always based on educated guesses.

Re: AI is breaking two vulnerability cultures

#39

Post by proteal »

It sounds to me like the safe assumption with software is that no matter how solid your stack is, there are vulnerabilities, potentially catastrophic. A question to folks more experienced than me - if my business depends on software, and I know that my software is almost certainly exploitable, how do I posture my business in such a way as to minimize the impacts of exploits like these?

Re: AI is breaking two vulnerability cultures

#40

Post by totetsu »

JumpCrisscross wrote: post #8
rikafurude21 wrote: post #3

This feels more like an old problem getting reframed as an AI problem. people were already diffing kernel commits and figuring out which ones were security fixes long before llms. if a patch lands publicly, the race has basically already started. also not sure shorter embargoes really help. the orgs that can patch in hours are already fine. everyone else still takes days or weeks. if anything, cheaper exploit generat…

> people were already diffing kernel commits and figuring out which ones were security fixes With skill, and usually not consistently and systematically. With AI, anyone can do this to any software. > not sure shorter embargoes really help Why 90 days versus 2 years? The author is arguing the factors that set that balance have shifted, given the frequency of simultaneous discovery. The embargo window isn’t an actual…

“White-Hat”
Post reply on HN