7 ms·
Drew Breunig published a very relevant piece yesterday that came to the opposite conclusion: https://www.dbreunig.com/2026/04/14/cybersecurity-is-proof-of-work-
by simonw 7mo ago
Drew Breunig published a very relevant piece yesterday that came to the opposite conclusion: https://www.dbreunig.com/2026/04/14/cybersecurity-is-proof-of-work-now.html https://www.dbreunig.com/2026/04/14/cybersecurity-is-proof-o...
Since security exploits can now be found by spending tokens, open source is MORE valuable because open source libraries can share that auditing budget while closed source software has to find all the exploits themselves in private.
> If Mythos continues to find exploits so long as you keep throwing money at it, security is reduced to a brutally simple equation: to harden a system you need to spend more tokens discovering exploits than attackers will spend exploiting them.
- not-chatgpt 7mo agoSecurity should be a non issue in the age of AI now that auditing is cheaper than ever. I'd give them more credits if they use the AI slop unmaintainability argument.
- habinero 7mo agoHa ha ha ha. I wish that were true. Getting people to patch existing, known vulns is hard enough.
- criddell 7mo agoHow may open source libraries have auditing budgets?
- Mordisquitos 7mo agoTheir commercial users have auditing budgets.
- dspillett 7mo agoDoes your ideal world have an easy path to citizenship? I might like to live there.
- raincole 7mo ago> SAN FRANCISCO – March 17, 2026 – The Linux Foundation, the nonprofit organization enabling mass innovation through open source, today announced $12.5 million in total grants from Anthropic, AWS, GitHub, Google, Google DeepMind, Microsoft, and OpenAI to strengthen the security of the open source software ecosystem. https://openssf.org/tag/google https://openssf.org/tag/google "But that's Linux, how small libraries get audit budget..." fortunately LLM has eliminated the need to have small libraires in your dependency chain.
- techpression 7mo agoIt’s almost cute how insignificantly small that amount is considering the companies named. Great for The Linux Foundation of course, but it still feels like they are being cheap as heck.
- dspillett 7mo ago> SAN FRANCISCO I take back the “I might like to live there” :)
- simonw 7mo agoI expect we're about to find that it's a lot easier to convince a company to spend money running an AI security scan of their dependencies and sharing the results with the maintainers than it is to have them give those maintainers money directly. (I just hope they can learn to verify the exploits are valid before sharing them!)
- pietz 7mo agoThis conclusion makes more sense to me, but maybe I'm too naive. The media momentum of this threat really came with Mythos, which was like 2 or 3 weeks ago? That seems like a fairly short time to pivot your core principles like that. It sounds to me like they wanted to do this for other business related reasons, but now found an excuse they can sell to the public. (I might be very wrong here)
- skybrian 7mo agoThis seems similar to the lesson learned for cryptographic libraries where open source libraries vetted by experts become the most trusted. Your average open source library isn’t going to get that scrutiny, though. It seems like it will result in consolidation around a few popular libraries in each category?
- layer8 7mo agoAn important difference between SaaS offerings and open source libraries is that the latter have not liability. They can much more easily afford exhibiting vulnerabilities until those are fixed.
- DrammBA 7mo agoI have a feeling the real reason is them trying to avoid someone using AI to copyright-wash their product, they're just using security as the excuse.
- OsrsNeedsf2P 7mo agoAn app like Cal.com can be vibe coded in a few evenings with a Chrome MCP server pointed to their website to figure out all the nooks and crannys. The moat of Cal.com is not the code, it's the users who don't want to migrate. The real answer is they are likely having a hard time converting people to paid plans
- notnullorvoid 7mo ago> The moat of Cal.com is not the code, it's the users who don't want to migrate. That's a very weak moat unless you have something else like the friction of network dependence similar to a social network.
- philipov 7mo agoSunk cost is sufficient friction for most people even without network dependence.
- shimman 7mo agoFor a meeting scheduler site? I feel like you're overestimating the capabilities of something that is akin to college graduate project. This company does not seem healthy at all: https://getlatka.com/companies/calcom https://getlatka.com/companies/calcom I agree with the other poster that mention this is likely a publicity stunt but all it's really showing is that VC is still incredibly stupid with their money. All the more reason to seize it from them then properly fund useful software and not subsidize vanity projects for stanford grads.
- cootsnuck 7mo ago
- deleted 7mo ago[deleted]
- deleted 7mo ago[deleted]
- mgdev 7mo agoThis is an economically sound conclusion. It also means that you need to extract enough value to cover the cost of said tokens, or reduce the economic benefit of finding exploits. Reducing economic benefit largely comes down to reducing distribution (breadth) and reducing system privilege (depth). One way to reduce distribution is to, raise the price. Another is to make a worse product. Naturally, less valuable software is not a desirable outcome. So either you reduce the cost of keeping open (by making closed), or increase the price to cover the cost of keeping open (which, again, also decreases distribution). The economics of software are going to massively reconfigure in the coming years, open source most of all. I suspect we'll see more 'open spec' software, with actual source generated on-demand (or near to it) by models. Then all the security and governance will happen at the model layer.
- cassianoleal 7mo ago> I suspect we'll see more 'open spec' software, with actual source generated on-demand (or near to it) by models. Then all the security and governance will happen at the model layer. So each time you roll the dice you gamble on getting a fresh set of 0-days? I don't get why anyone would want this.
- mgdev 7mo agoYou already do this with human-authored code, just slowly. Project model capabilities out a few years. Even if you only assume linear improvement at some point your risk-adjusted outcome lines cross each other and this becomes the preferred way of authoring code - code nobody but you ever sees. Most enterprises already HATE adopting open source. They only do it because the economic benefit of free reuse has traditionally outweighed the risks. If you need a parallel: we already do this today for JIT compilers. Everything is just getting pushed down a layer.
- jodrellblank 7mo agoNext, you double click the Excel icon on the desktop, and instead of having Excel installed or a spec of Excel, you have a cloud service with thirty years of Usenet, Quora, StackOverflow, Reddit, PHPBB comments and blog tutorials about how people use Excel, and you wait a few moments while approximately-Excel is rederived from these experiences. You’ll accept the delay because by then it happens faster than Microsoft can make a splashscreen and window open from a local nvme drive. And because you can customise Excel’s feature set by simply posting a Reddit comment where you hallucinate using a feature that Excel doesn’t have and waiting a couple of days. [although it can be difficult to find the real Reddit to post on as your web browser will tend to synthesise the experience of visiting any website using a cloud AI model of every website without connecting to the real one at all. This was widely loved as a security measure and since most websites are AI written content on AI written codebases, makes less difference than you’d first think]
- jstummbillig 7mo ago> to harden a system you need to spend more tokens discovering exploits than attackers will spend exploiting them. That can't be right, can it? Given stable software, the relative attack surface keeps shrinking. Mythos does not produce exploits. Should be defenders advantage, token wise, no?
- paisawalla 7mo agoSo long as that OSS keeps accumulating features, there isn't quite the equilibrium you're imagining. If you can pin to a stable version, which continues to audited, you're fine. But if the rest of the world moves on to newer versions of the software, you'll have to as well, unless you want to own the burden of hardening older versions.
- rhplus 7mo agoIt’s the classic asymmetric warfare problem: Defenders have to find all the holes in all their systems, while attackers just need to find one hole in one system.
- lexlambda 7mo agoA slight factor differentiating security systems here is involved to the advantage of defenders: Attackers have to find a whole exploit chain, while defenders only need to fix one part of it.
- jstummbillig 7mo agoThe point is that, as the defender, you only have to find each hole once, while the attacker can spend an infinite amount of tokens trying to find more holes, that are increasingly harder to find and might, eventually, not exist at all. The defender can do that too, of course, but being in the defense, there is value in not being able to uncover new holes (your system keeps working, ostensibly) while as the attacker that's simply how you fail.
- JoshTriplett 7mo ago> Mythos does not produce exploits. AI in general will, don't worry. "Move fast and break things" makes more exploits than "move steadily and fix things" does.
- dang 7mo agoThanks - I've re-upped* that one here: Cybersecurity looks like proof of work now - https://news.ycombinator.com/item?id=47769089 https://news.ycombinator.com/item?id=47769089 (no comments yet) * a la https://news.ycombinator.com/item?id=26998308 https://news.ycombinator.com/item?id=26998308
- flying_sheep 7mo ago> to harden a system you need to spend more tokens discovering exploits than attackers will spend exploiting them This is true until certain point, unless the requirement / contract itself has loophole which the attacker can exploit it without limit. But I don't think this is the case. Let's say, if someone found an loophole in sort() which can cause denial-of-service. The cause would be the implementation itself, not the contract of sorting. People + AI will figure it out and fix it eventually.
- tonymet 7mo agoThis may be true long term but not short term. It also assumes that white hats will be as motivated as black hats – not true. For projects with NO WARRANTY, the risk is minimal, so yes there are upsides. For a commercial project like cal.com, where a breach means massive liability, they don’t have the resources to risk breaches in the short term for potentially better software in the long term.
- deleted 7mo ago[deleted]
- pllbnk 7mo agoIt's been a common wisdom now for decades that open source is more secure. Security is just a scapegoat here.
- aleph_minus_one 7mo ago> It's been a common wisdom now for decades that open source is more secure. This is not true. The problem rather is that the managers of many companies don't allow their programmers to apply their knowledge about security - the programmers should rather weed out new features.
- MerrimanInd 7mo agoI wonder if we could find a way to donate unused tokens or even local compute resources to open-source projects we support. Especially for security auditing where it could probably be somewhat more asynchronous and disconnected than the open-source developers' personal tool choices.
- throwuxiytayq 7mo ago“Unused tokens” are a weird, fragile concept that I wouldn’t want to build upon. You can just donate money, you know. That’s what money’s for - it’s the universal exchange thingy.
- rswail 7mo agoMaybe if we reframed money as a "fungible token" people would start understanding its use again?
- jeroenhd 7mo ago"unused tokens" are the force driving token cost down. If everyone used all of the tokens they thought they were paying for, prices would explode. People with subscriptions that don't get out everything they can are subsidizing the system. There are ways to use LLM service providers that leave no tokens unused, by just billing per token. Unsurprisingly, this quickly becomes much more expensive than subscriptions.
- lrvick 7mo agoAnd that is why the only winning move is owning a GPU.
- Guillaume86 7mo agoI think sometimes about this, does it really make sense? Financially I mean. The is just my impressions and I'm glad to be corrected if someone has hard numbers and some experience going this route: At the moment LLMs vendors are in market grab mode and take a loss on big subscription users, they are starting to try to move to profit but they must move carefully to not let a competitor steal their users so we will still have "cheap" tokens for a while. Even if prices go up by a bit, they have the scale in their favor to optimize costs. If commercial model providers go into "not competitive" territory with their prices compared to open models, wouldn't it always be cheaper to use an open models inference provider? They can take advantage of scale as well, and with no model moat, competition should keep prices honest. And last ressort, renting GPU time in the cloud seem like a safer bet than buying a GPU to me?
- haritha-j 7mo agoI like that LLMs have basically switched to the weapons business model. Buy our LLM so that the bad guy we'll sell our LLM to doesnt destroy your code. As a bonus, we'll give you a little head start. And if you're a small company that can't afford our LLM, too bad.
- alienbaby 7mo agoThis feels like it misses the point. Tokens = money. The real differentiator is time and effort. Llm's will find your issues faster, but not necessarily more accurately than a domain expert. But experts cost money and effort takes longer to apply. Are llm's going to reduce everyone's wages because they are cheap labour?
- deleted 7mo ago[deleted]
- Gormo 7mo ago> > If Mythos continues to find exploits so long as you keep throwing money at it, security is reduced to a brutally simple equation: to harden a system you need to spend more tokens discovering exploits than attackers will spend exploiting them. But this has always been the reality of security: it's always been fundamentally an economic question about which party has stronger incentives and greater resources than the other. The increasing sophistication of AI is available to both parties equally, so I don't see how AI in itself fundamentally changes the equation.