4 ms·
> Open source creates a useful urgency: when your code is public, you assume it will be examined closely, so you invest earlier and more aggressively in findin
by dhruv3006 6mo ago
> Open source creates a useful urgency: when your code is public, you assume it will be examined closely, so you invest earlier and more aggressively in finding and fixing issues before attackers do.
This should be the mentality of every company doing open source.Great points made.
- necovek 6mo agoThis should be a mentality of every company building products :)
- dhruv3006 6mo agoI guess open source makes you more accountable.
- graemep 6mo agoI sometimes explain open source to people as auditable software.
- tech_hutch 6mo agoThat's a good way to explain it.
- somewhatgoated 6mo agoAlso makes it harder to build a business around it. With that combination no wonder most successful companies are closed source.
- TeMPOraL 6mo agoIndeed. All software products you can get your hands on are open source - compiled code is only little more difficult to read than source code, but not that much if you learn how. Which is why ~all companies switches to offering software as a service, so this mindset doesn't apply :).
- roenxi 6mo ago> but not that much if you learn how. Yesterday I threw some ghidra output into an LLM with very little context and got what seemed to be a reasonable run down of the original back. We're probably knocking on the door of being able to throw a binary into an LLM and getting the original program back unless there is active obfuscation done. It is a very exciting time for anyone who likes playing old, abandoned and buggy games :').
- finghin 6mo agoAs long as obfuscated code is isomorphic to its raw form, it’s sure to be decompilable. As for how much divergence is possible (in obfuscation), my intuition that it is very finite by definition.
- necovek 6mo agoI haven't played much with LLMs for decompilation, but I wonder how viable is using LLMs on binaries to port software to a different language (in combination with source code when available, but binaries might need fewer tokens).
- finghin 6mo agoGhidra+LLMs really does make this a matter of time if we’re not already there yet.
- Serhii-Set 6mo ago[dead]