Welcome to the Strip Mining Era of OSS Security

Post by chadgpt3 » Sat, May 16, 2026, 6:06 AM UTC

Arainach wrote: post #69

tptacek wrote: post #59

Earlier quoted context omitted.

That can't possibly be an argument for forbearing security vulnerabilities in software. It's an argument for prioritizing hypothetical flaws over real ones.

If these flaws are so important, users of open source (business or individual) need to pay up - literally. Pay the maintainers enough to justify spending the time on these things, including the opportunity cost of not working at other software jobs during that time. Pay each maintainer an absolute minimum of $200K a year or shut up and do the work yourself - in a fork if necessary.

Post by edrobap » Sat, May 16, 2026, 7:09 AM UTC

roenxi wrote: post #37

edrobap wrote: post #32

Earlier quoted context omitted.

I had done a fair bit of reverse-engineering-jar-files in the pre-LLM era for various reasons. The biggest problem with decompiled java files was naming. The original variable names, class names etc were not retained and the decompiler would use some alphanumeric series. That'd make reading code very hard. Curious how the current LLMs are able to address this. Maybe it's able to figure out how the class, variable etc…

I expect Java would be easy-mode for the AI, they already do quite well reconstructing C++ from ghidra output in my experience from when I wanted to know what damage formula some game was using. As a reminder; your account has been shadow-banned, it looks like you got a little unlucky in 2016.

Post by dynawicki » Sat, May 16, 2026, 3:26 PM UTC

likesHumidity wrote: post #72

dynawicki wrote: post #35

Earlier quoted context omitted.

This is now the open source problem. And why my personal opus of work has been removed from online repositories. Who gave them "the right to scan"? You did by hosting your open source in public. But scanning a public service prior to AI was still covered by "Unauthorized System Access". But what if they are wrong, and given the self-serving nature of these scans, now your repo is just OJ Simpson? And your software is…

The open source problem argues for a modification of licenses to exclude certain uncompensated use in training commercial LLMs (which may arguably already be a violation). With careful prompting, LLMs will give up some of their sources and methods. Claude describes the legally and ethically suspect methods Anthropic used acquiring training materials for its models. The IP law and courts are starting to catch up (re:…

Post by 48terry » Sat, May 16, 2026, 4:39 PM UTC

tptacek wrote: post #57

salsakran wrote: post #50

Earlier quoted context omitted.

In theory, the vulnerability was always there, and it's better to find out than not find out. In practice, how much effort it is to find vulnerabilities matters a lot. We're in a time where things that used to be quite hard are now easy and the rate of discovery will change. This rate of discovery matters a lot -- for OSS maintainer burnout if nothing else.

It matters in a positive sense; it's a thing that enables you to make some predictions about the state of the world tomorrow. It does not matter in a normative sense; OSS maintainer burnout is strictly a less important concern than software security, which is an externality of software development.

Post by 48terry » Sat, May 16, 2026, 5:52 PM UTC

tptacek wrote: post #88

48terry wrote: post #87

Earlier quoted context omitted.

If the maintainers burn out, nobody's going to be making your software secure.

Then people will stop using that software.