Welcome to the Strip Mining Era of OSS Security • Hacker News Board

Re: Welcome to the Strip Mining Era of OSS Security

#91

Post by roenxi » Sun, May 17, 2026, 12:00 AM UTC

edrobap wrote: post #83

roenxi wrote: post #37

Earlier quoted context omitted.

I expect Java would be easy-mode for the AI, they already do quite well reconstructing C++ from ghidra output in my experience from when I wanted to know what damage formula some game was using. As a reminder; your account has been shadow-banned, it looks like you got a little unlucky in 2016.

> I expect Java would be easy-mode That makes sense. Java leaves metadata in compiled code to reconstruct better. > your account has been shadow-banned, it looks like you got a little unlucky in 2016 I see. I wasn't aware. Thanks. I thought the two comments per day limit is for users with low karma. Anyway, I'm using that limit to push myself in being picky about posts to comment on and to improve the quality of comm…

Shadowbans are actually a bit more than that - your comments are invisible unless someone with a high karma threshold puts a little effort in to mark them as reasonable. People can't actually see most of your comments.

I'd recommend creating a new account. Or you could email the mods (I forget the email but it is publicly available somewhere) if the user name has sentimental value. In your case it is clear that a shadowban is inappropriate.

Re: Welcome to the Strip Mining Era of OSS Security

#92

Post by toofy » Sun, May 17, 2026, 2:31 AM UTC

ajross wrote: post #70

ahlCVA wrote: post #38

Whenever one of these vulnerability apocalypse posts comes along I cannot help but think of the Litany of Gendlin: What is true is already so. Owning up to it doesn't make it worse. Not being open about it doesn't make it go away. And because it's true, it is what is there to be interacted with. Anything untrue isn't there to be lived. People can stand what is true, for they are already enduring it. I cannot wrap my…

> The code already was broken before somebody published the vulnerability. The difference now only is that you know about this. The philosophy in this subthread may be too deep for me. Me and the Jedi at the ends of the bell curve are just thinking "It's bad when your attackers know your code is vulnerable"

as a jedi you’re surely wise enough to understand that closed source has just as many vulnerabilities if not more.

open source will get fixed while closed will not.

Re: Welcome to the Strip Mining Era of OSS Security

#93

Post by edrobap » Mon, May 18, 2026, 11:10 AM UTC

roenxi wrote: post #91

edrobap wrote: post #83

Earlier quoted context omitted.

> I expect Java would be easy-mode That makes sense. Java leaves metadata in compiled code to reconstruct better. > your account has been shadow-banned, it looks like you got a little unlucky in 2016 I see. I wasn't aware. Thanks. I thought the two comments per day limit is for users with low karma. Anyway, I'm using that limit to push myself in being picky about posts to comment on and to improve the quality of comm…

Shadowbans are actually a bit more than that - your comments are invisible unless someone with a high karma threshold puts a little effort in to mark them as reasonable. People can't actually see most of your comments. I'd recommend creating a new account. Or you could email the mods (I forget the email but it is publicly available somewhere) if the user name has sentimental value. In your case it is clear that a sha…

[dead]

Re: Welcome to the Strip Mining Era of OSS Security

#94

Post by yencabulator » Wed, May 27, 2026, 5:57 PM UTC

salsakran wrote: post #26

_alternator_ wrote: post #22

The article focuses on OSS, but closed-source software is at major risk too. Perhaps more. It's gotten much easier to reverse engineer binaries in general, and security patches in particular. Basically, an LLM can turn binaries into 'readable' code, and then reason about said code.

Perhaps -- but I think for most people, the vast majority of proprietary software they consume is over the network. But yeah, if you're distributing binaries publicly, then you're going to have very similar problems.

The LLM is also good at exploring the private API your web server exposes to the web UI.