Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Just the rumour of a bug is enough to find an exploit these days

anil.recoil.org

Post reply on HN
Print view View original

61–70 of 141 posts

Re: Just the rumour of a bug is enough to find an exploit these days

#61

Post by godelski »

pixl97 wrote: post #56
elmer2 wrote: post #50

Earlier quoted context omitted.

Something that might come out of all of this is that companies that previously slow rolled security fixes will now be forced to fix them quickly, because the speed of AI and the liability of being insecure.

Yea, when their cyber insurance policies start biting them because AI found a bug months ago and it was never fixed I figure we'll start seeing a change. With that said there are numerous companies that are very concerned about the situation. They know AI is finding bugs in their software at an accelerated rate, one they are having difficult times keeping up with because they want human understanding and review of th…

Did CrowdStrike actually suffer? That was a huge outage and their stock is today at an all time high. Seems like no one actually cares. Neither the companies providing the software, the companies purchasing the software, nor the markets.

To me, this is the craziest part about all of it. Why doesn't anyone seem to care?

Re: Just the rumour of a bug is enough to find an exploit these days

#62

Post by Groxx »

nickcw wrote: post #3

This describes my life as an open source maintainer at the moment! In the first 10 years of the rclone project we received about 20 security disclosures through GitHub. We had to deal with over 40 in the last month! That has taken a huge amount of my time, even using AI tools to triage and come up with fixes for review. The hit rate for those security disclosures is pretty good - about 75% of them have a nugget of so…

You can add CVE info later in a git note, if you want something git-managed to point to it. Might take some habit-tweaking to include notes in log output though, to see them later.

Re: Just the rumour of a bug is enough to find an exploit these days

#63

Post by jamilton »

xbar wrote: post #35

Hm. I wonder if you can force an exploit into existence with a false rumor of a bug?

One way you could do it would be to find something that 1. would sound like a bug to a human and an LLM, 2. would be "confirmed" as a bug by a LLM, and 3. would be consistently solved in the same exploitable but reasonable way by an LLM. That's assuming a codebase that's largely AI-written with human review that you're able to open an issue for (possibly indirectly).

Another way is maybe something like saying there's a bug at some endpoint and thus manipulating a bunch of bots to DDOS that endpoint without having to pay for it?

Re: Just the rumour of a bug is enough to find an exploit these days

#64

Post by rndhouse »

I built a tool that monitors commits and tries to detect silent bug fixes. With GPT-5.5-class models, it can identify fixes hidden within otherwise routine commits quite reliably. Obfuscating the code changes enough to avoid detection is difficult.

I have heard of at least one project (c-lightning?) temporarily releasing a closed-source binary as a workaround until users could update safely.

Re: Just the rumour of a bug is enough to find an exploit these days

#65

Post by talon8635 »

supriyo-biswas wrote: post #23
vasco wrote: post #13

Earlier quoted context omitted.

If your boss asks for X feature and you split it into 4 PRs, 3 that implement X and a 4th that fixes a security bug, how would they know? Someone that uses those 30mins like that isn't reviewing your PRs themselves. Just fix it and be done with it. You only needed to argue with the boss when you needed to make time for it which would delay something else. If it just appears done they'll just react with clap emoji lat…

You haven't worked at conservative software shops I guess. The last place I worked at had this huge song and dance with you trying to raise a PR that looked irrelevant to the task at hand would lead to meeting with your lead dev, your manager and your skip level as you tried to explain why the bug needs fixing... The worst one was where I fixed a datetime bug and although it had been sending out false alerts, I was a…

But, isn’t it our job to impress upon the managers the importance, in a certain regard?

Alternatively, what about just doing the right thing? Either you convince them to take this stuff seriously or you find alternate employment. How can you subject yourself to the moral degradation and conflict of principles? I could understand for someone with no other financial options, or in some sort of oppressive culture/economy. But most in our field probably don’t fall into those

Re: Just the rumour of a bug is enough to find an exploit these days

#66

Post by talon8635 »

stephbook wrote: post #32

I think roll-out and deployment are even bigger issues. Who updates their software stack within 10 minutes? Most CI runs take longer to verify the business logic is still working. Add to that the danger of supply-chain attacks where you don't even want automatic updates.

Your last point is the conundrum I keep running up against

It’s a trap regardless:

A) run a known vuln B) accept and run any and all updates immediately… which could be compromised

Maybe A is worse because it’s a known vuln?

Re: Just the rumour of a bug is enough to find an exploit these days

#67

Post by lbreakjai »

godelski wrote: post #61
pixl97 wrote: post #56

Earlier quoted context omitted.

Yea, when their cyber insurance policies start biting them because AI found a bug months ago and it was never fixed I figure we'll start seeing a change. With that said there are numerous companies that are very concerned about the situation. They know AI is finding bugs in their software at an accelerated rate, one they are having difficult times keeping up with because they want human understanding and review of th…

Did CrowdStrike actually suffer? That was a huge outage and their stock is today at an all time high. Seems like no one actually cares. Neither the companies providing the software, the companies purchasing the software, nor the markets. To me, this is the craziest part about all of it. Why doesn't anyone seem to care?

Why would they suffer? They showcased that they were big enough to disrupt the global economy. Why _wouldn't_ you invest in something so big and powerful?

This is the same as when junkies specifically seek batches of drugs on which others overdosed.

Re: Just the rumour of a bug is enough to find an exploit these days

#68

Post by xboxnolifes »

talon8635 wrote: post #66
stephbook wrote: post #32

I think roll-out and deployment are even bigger issues. Who updates their software stack within 10 minutes? Most CI runs take longer to verify the business logic is still working. Add to that the danger of supply-chain attacks where you don't even want automatic updates.

Your last point is the conundrum I keep running up against It’s a trap regardless: A) run a known vuln B) accept and run any and all updates immediately… which could be compromised Maybe A is worse because it’s a known vuln?

I prefer the devil I know over the one I dont. At least I can make judgement calls with vulnerabilities im aware of. Automatic updates have unbounded risk.

Re: Just the rumour of a bug is enough to find an exploit these days

#69

Post by 9cb14c1ec0 »

godelski wrote: post #6

It's easier to find bugs, fix them, yet there's less will than ever. My bosses just want speed and will give me a 30 minute lecture on why I don't need to solve a bug that Claude solved in 5 minutes, I've verified, and it's already in an open PR. All the while we're pushing out bugs faster and faster. No matter how good AI gets at fixing bugs we'll never fix them when there's no will to fix things. Software will neve…

I guess I often don't know how good I have it as the owner of my own tech company. We've been busy fixing bugs and tackling tech debt, and I couldn't be happier.

Re: Just the rumour of a bug is enough to find an exploit these days

#70

Post by lazyasciiart »

novia wrote: post #27
godelski wrote: post #6

It's easier to find bugs, fix them, yet there's less will than ever. My bosses just want speed and will give me a 30 minute lecture on why I don't need to solve a bug that Claude solved in 5 minutes, I've verified, and it's already in an open PR. All the while we're pushing out bugs faster and faster. No matter how good AI gets at fixing bugs we'll never fix them when there's no will to fix things. Software will neve…

!!! You described my experience in the workforce to a t! So frustrating that tech managers look at tech debt as a thing to be maintained at a certain level instead of allowing us to achieve perfection

Well, that goes with the metaphor. Debt is not an intrinsically bad thing, and most people agree on that: countries run deficits, people get mortgages and millionaires trade on leverage.
Post reply on HN