Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Open Source Isn't Dead

strix.ai

Post reply on HN
Print view View original

81–90 of 200 posts

Re: Open Source Isn't Dead

#81

Post by the_af »

I'm pro FOSS, militantly so. FSF-style.

But... playing devil's advocate, if AI makes it very easy to find exploits without the source code, wouldn't it be doubly effective finding them with the source code as well? And why is the dichotomy posed by this blog post "open source with AI reviews by everyone" vs "closed source but only the bad guys use AI"? What if the scenario was: closed source and the authors/security team use every AI tool at their disposal to find bugs? What do the community's eyeballs add to this equation, assuming (big if) AI review of exploits is such a force multiplier?

Before any knee-jerk reactions: big fan of open source, I'm not arguing this will kill it, I don't have the faintest idea what Cal.com is and I think a world without FOSS would be a tragedy, I run linux and most of my software on my personal PC (other than games) is FOSS.

Re: Open Source Isn't Dead

#82

Post by pixl97 »

jongjong wrote: post #41

I decided to not open source my latest project but it has nothing to do with security concerns. My code is perfectly secure and bug-free. My concern is mostly financial. Most people would be in a better position to monetize my software than I am... Using AI to obfuscate the origin while appropriating all the key innovations. I wouldn't get any credit. Also, I'm not really interested in humans anymore. I have human fa…

>My concern is mostly financial.

Then AI will eat your lunch anyway if the financial part has anything at all to do with the code.

AI can decompile code very well.

Re: Open Source Isn't Dead

#83

Post by yibers »

mikeryan wrote: post #57
CodesInChaos wrote: post #2

> The reasoning provided by their CEO, Bailey Pumfleet, is that AI has automated vulnerability discovery at scale, That sounds like an excuse. The real reason is probably that it's hard to make a viable business out of developing open source.

It’s also now ridiculously easy to simply cherry pick from open source without actually “using” it. “I need to do foo in my app. Libraries bar and baz do these bits well. Pick the best from each and let’s implement them here” I’d not be surprised if npmjs.com and its ilk turn into more a reference site than a package manager backend soon.

Ironically, given the recent supply chain attacks, that may be also more secure.

Re: Open Source Isn't Dead

#84

Post by pixl97 »

misiti3780 wrote: post #25

I have a large open source project and noticed the number of LLM generate PR is making it unmanageable. Every two weeks, I go in, kill all of them and when someone complains or asks why, I realize it was a real person and then I merge it. is anyone else seeing this / fixed this problem ?

> kill all of them and when someone complains or asks why, I realize it was a real person and then I merge it.

I mean an AI skill is perfectly capable of doing this exact same thing.

Re: Open Source Isn't Dead

#85

Post by pixel_popping »

wilj wrote: post #80
mikeryan wrote: post #57

Earlier quoted context omitted.

It’s also now ridiculously easy to simply cherry pick from open source without actually “using” it. “I need to do foo in my app. Libraries bar and baz do these bits well. Pick the best from each and let’s implement them here” I’d not be surprised if npmjs.com and its ilk turn into more a reference site than a package manager backend soon.

I literally have a Claude Code skill called "/delib" that takes takes in any nodejs project/library and converts it to a dependency-less project only using the standard library. It started as a what-if joke, but it's turned out to be amazing. So yeah, npmjs.com is just reference site for me now, and node_modules stays tiny. And the output is honestly superior. I end up with smaller projects, clean code, and a huge su…

It's that easy yes, and someday, we will literally be able to prompt "Redo the Linux kernel entirely in Zig" and it will practically make a 1:1 copy.

Re: Open Source Isn't Dead

#86

Post by geoffschmidt »

cm2187 wrote: post #76
tananaev wrote: post #3

I have an open source project and started receiving a lot of security vulnerability reports in the last few months. A lot of them are extremely corner cases, but there were some legit ones. They're all fixed now. Closed source software won't receive any reports, but it will be exploited with AI. So I definitely agree with the message of this article.

> Closed source software won't receive any reports, but it will be exploited with AI How so? AI won't have access to the source code. In some cases AI may have access to deployed binaries (if your business deploys binaries) but I am not aware that it has the same capabilities against compiled code than source code. But in a SAAS world, all AI has access to is your API. It might be still be up to no good but surely yo…

Claude is already shockingly good at reverse engineering. Try it – it's really a step change. It has infinite patience which was always the limited resource in decompiling/deobfuscating most software.

Re: Open Source Isn't Dead

#87

Post by dgb23 »

rd wrote: post #60
tananaev wrote: post #3

I have an open source project and started receiving a lot of security vulnerability reports in the last few months. A lot of them are extremely corner cases, but there were some legit ones. They're all fixed now. Closed source software won't receive any reports, but it will be exploited with AI. So I definitely agree with the message of this article.

I don't follow. It seems obvious that there's more to gain for attackers using AI agents to exploit open source repositories, than there is for good samaritan defenders. In this new closed-source world (for Cal.com), there's nothing stopping them from running their own internal security agent audits, all whilst at least blocking the easiest method of finding zero-days - that is, being open source. This really just se…

Isn’t that security by obscurity?

Re: Open Source Isn't Dead

#88

Post by pixl97 »

reenorap wrote: post #19

All content is going to go behind paywalls. There is zero incentive or reason for content creators to let AI slurp their content for free and distribute it and get all the money from it. Everything new will be licensed and if AI companies want access to it, they will need to pay for it, just like we will.

Of course this neglects why mostly free things that were posted on the internet generally won. Take Microsoft for example. All their money makers are licensed, yet at the same time you can download almost every single one for free and install it.

The people that go behind paywalls don't realize how much they'll have to spend on marketing to catch up to those that are open.

And that's only frames the current state, where models are very expensive to train. Once model training is close to the point where a group of individuals can afford it, it's pretty much game over for our current paradigm. The software police will be running around trying to play whack-a-mole on open weight models with people all over the world.

Re: Open Source Isn't Dead

#89

Post by pixl97 »

shevy-java wrote: post #65

"Open Source Isn't Dead." Well ... Open Source as such will never "die", but we only need to look at what happened in, say, the last 5 or 10 years. Private entities with a commercial interest, have been flexing their muscles. Microsoft - also known as Microslop these days - with Github is probably the most famous example still, but you can see other examples. One that annoys me personally is Shopify's recent influenc…

There are no answers, only compromises.

Corporations are about money.

Individuals need to eat.

Governments love to concentrate power.

Re: Open Source Isn't Dead

#90

Post by NaritaAtrox »

rd wrote: post #60
tananaev wrote: post #3

I have an open source project and started receiving a lot of security vulnerability reports in the last few months. A lot of them are extremely corner cases, but there were some legit ones. They're all fixed now. Closed source software won't receive any reports, but it will be exploited with AI. So I definitely agree with the message of this article.

I don't follow. It seems obvious that there's more to gain for attackers using AI agents to exploit open source repositories, than there is for good samaritan defenders. In this new closed-source world (for Cal.com), there's nothing stopping them from running their own internal security agent audits, all whilst at least blocking the easiest method of finding zero-days - that is, being open source. This really just se…

Some users might be tech sensitive and have the capacity to check the codebase If a company want to use your platform, it can run an audit with its own staff These are people really concerned about the code, not "good samaritans"
Post reply on HN