3 ms·

This feels more like an old problem getting reframed as an AI problem. people were already diffing kernel commits and figuring out which ones were security fix

This feels more like an old problem getting reframed as an AI problem. people were already diffing kernel commits and figuring out which ones were security fixes long before llms. if a patch lands publicly, the race has basically already started. also not sure shorter embargoes really help. the orgs that can patch in hours are already fine. everyone else still takes days or weeks. if anything, cheaper exploit generation probably makes coordinated disclosure more important, not less.

JumpCrisscross 5mo ago
> people were already diffing kernel commits and figuring out which ones were security fixes With skill, and usually not consistently and systematically. With AI, anyone can do this to any software. > not sure shorter embargoes really help Why 90 days versus 2 years? The author is arguing the factors that set that balance have shifted, given the frequency of simultaneous discovery. The embargo window isn’t an actual window, just an illusion, if the exploit is going to be found by several people outside the embargo anyway. > cheaper exploit generation probably makes coordinated disclosure more important I agree. But it also makes it less viable. If script kiddies can find and exploit zero days, the capacity to co-ordinate breaks down. There was always a guild ethic that drove white-hate (EDIT: hat) culture. If the guild is broken, the ethic has nothing to stand on.
- gritspants 5mo ago
  I'm here for white-hate culture. You should, you should know better.
- Hizonner 5mo ago
  > With skill, and usually not consistently and systematically. How do you know? If the people who like to crow about vulnerabilities aren't doing it, it doesn't mean that the people who are actually in a position to exploit them systematically and effectively aren't doing it. Those embargoes have always been dangerous, because they create a false sense of security. But, as you point out... > With AI, anyone can do this to any software. Yep. Even if it hadn't been true before, it's clear that now you just have to assume that everybody relevant will immediately recognize the security impact of any patch that gets published. That includes both bugs fixed and bugs introduced. ... and as the AI gets better, you're going to have to assume that you don't even have to publish a patch. Or source code. Within way less time than it's going to take people to admit it and adjust, any vulnerability in any software available for inspection is going to be instant public knowledge. Or at least public among anybody who matters.
  - ragall 5mo ago
    > How do you know? We know because we could see the effects of the average rate of vulnerabilities discovery and exploitation, and it's definitely going up very fast. Until recently, vulnerabilities were relatively hard to find, and finding them was done by a very restricted group of people world-wide, which made them quite valuable. Not any more.
    - awesome_dude 5mo ago
      That's correlation, not causation. It could equally be argued that the AI slop that's being produced makes for a lot more vulnerabilities being shipped. The bigger target makes for the easier discovery.
      - ragall 5mo ago
        > That's correlation, not causation. Pragmatically, correlation *is* evidence of causation in favour of the best explanation, until somebody finds a better explanation. > It could equally be argued that the AI slop that's being produced makes for a lot more vulnerabilities being shipped. This is also true, and does not exclude the other, because for the moment the vast majority of production software in the world (and therefore the bulk of enticing targets) was written before AI. If LLM software will become prevalent in commercial setups, then LLM-generated code will eventually become the majority of targets.
        awesome_dude 5mo ago
        > Pragmatically, correlation is evidence of causation in favour of the best explanation, until somebody finds a better explanation. Uh, no. Correlation is only ever one thing - cause for investigation. Everything based on correlation alone is speculation. You can speculate all you like, I have zero issue with that, but that's best prefaced with "I guess" edit: Science captures this perfectly, and people misunderstand this so fundamentally that there is a massive debate where people who think they are "pro science" argue this so badly with theists that they completely hoist themselves with their own petard. Science uses the term "theory" because all of our understanding is based on "available data" - and science biggest contribution to humanity is that it accepts that the current/leading THEORY can and will be retracted if there is compelling data discovered that demonstrates a falsehood. So - because I know this is coming - yes science is willing to accept some correlation - BUT it's labelled "theory" or "statistically significant" because science is clear that if other data arises then that idea will need to be revisited.
- awesome_dude 5mo ago
  > people were already diffing kernel commits and figuring out which ones were security fixes With skill, and usually not consistently and systematically. With AI, anyone can do this to any software. I would like to see actual evidence of this, not.. vibes I mean, this reeks of "Anyone is a Principal developer now" when the truth is there is still work to do.
- totetsu 5mo ago
  “White-Hat”
alecco 5mo ago
> Torvalds said that disclosing the bug itself was enough, without the pursuant circus that followed when a major problem has been discovered. [1] So it's not surprising Dirtyfrag was disclosed by a fix in the Linux kernel. [2] [1] https://www.zdnet.com/article/torvalds-criticises-the-security-circus/ https://www.zdnet.com/article/torvalds-criticises-the-securi... [2] https://afflicted.sh/blog/posts/copy-fail-2.html https://afflicted.sh/blog/posts/copy-fail-2.html
santoshalper 5mo ago
I'd say it's an old problem be exacerbated by AI.
lynndotpy 5mo ago
I haven't been keeping tabs for the entirety of Linux development, but has it ever happened before that someone dropped a working exploit from the mailing list before the patch even hit the kernel? I haven't seen this kind of thing and I get the impression, despite all the hype, that this will be a frequent phenomenon now thanks to LLMs.
Forgeties79 5mo ago
I find i’m writing variations of the same comment every week so I’m just going to share a previous version I wrote if you’ll permit the laziness: https://news.ycombinator.com/item?id=47921829 https://news.ycombinator.com/item?id=47921829
fragmede 5mo ago
Reminder: the Ksplice patent expires October 1, 2028.
- whattheheckheck 5mo ago
  What's the implications to that
  - fragmede 5mo ago
    Means you wouldn't have to reboot to patch for security updates to the Linux kernel. Assuming someone does something with that.
- manquer 5mo ago
  I don't think hot patching holds the same relevance it did in 2010. Much of today's workloads are containerized and run on roughly ephemeral nodes that can be switched out easily- K8s version upgrades force this more or less. We tent to run more and more of-the shelf hardware and worry less about individual node failures now. In-memory updates also not magic , and can be limited as they requires data structure semantics to not really change and can create its own class of issues/bugs including security ones. While am sure there are still use cases which dictate this type of update, the need is lot less than 15 years ago that the patent expiry will do much to the ecosystem.
  - dawnerd 5mo ago
    That’s still a minor part of the overall Internet. Small orgs are still using traditional hosting which who knows how often are updated. I’ve seen clients sites running on managed servers that are a few major versions behind.
    - manquer 5mo ago
      The small orgs using traditional hosting are not the workloads which would consider in-memory update paths ? Typically when shops like this do scheduled updates they will happily announce downtime, it just not business critical to have zero planned downtime and also lack the skill / budget to evaluate if a given patch can be applied in-memory or not. The overlap between those using simper setups you say and those who need in-memory updates doesn't exist?
cush 5mo ago
> This feels more like an old problem getting reframed as an AI problem. Sure the mechanics haven't changed, but the scale and risk has. The number of attackers capable of taking advantage of the vulnerability has dramatically increased.

JumpCrisscross 5mo ago

> people were already diffing kernel commits and figuring out which ones were security fixes With skill, and usually not consistently and systematically. With AI, anyone can do this to any software. > not sure shorter embargoes really help Why 90 days versus 2 years? The author is arguing the factors that set that balance have shifted, given the frequency of simultaneous discovery. The embargo window isn’t an actual window, just an illusion, if the exploit is going to be found by several people outside the embargo anyway. > cheaper exploit generation probably makes coordinated disclosure more important I agree. But it also makes it less viable. If script kiddies can find and exploit zero days, the capacity to co-ordinate breaks down. There was always a guild ethic that drove white-hate (EDIT: hat) culture. If the guild is broken, the ethic has nothing to stand on.

gritspants 5mo ago
I'm here for white-hate culture. You should, you should know better.
Hizonner 5mo ago
> With skill, and usually not consistently and systematically. How do you know? If the people who like to crow about vulnerabilities aren't doing it, it doesn't mean that the people who are actually in a position to exploit them systematically and effectively aren't doing it. Those embargoes have always been dangerous, because they create a false sense of security. But, as you point out... > With AI, anyone can do this to any software. Yep. Even if it hadn't been true before, it's clear that now you just have to assume that everybody relevant will immediately recognize the security impact of any patch that gets published. That includes both bugs fixed and bugs introduced. ... and as the AI gets better, you're going to have to assume that you don't even have to publish a patch. Or source code. Within way less time than it's going to take people to admit it and adjust, any vulnerability in any software available for inspection is going to be instant public knowledge. Or at least public among anybody who matters.
- ragall 5mo ago
  > How do you know? We know because we could see the effects of the average rate of vulnerabilities discovery and exploitation, and it's definitely going up very fast. Until recently, vulnerabilities were relatively hard to find, and finding them was done by a very restricted group of people world-wide, which made them quite valuable. Not any more.
  - awesome_dude 5mo ago
    That's correlation, not causation. It could equally be argued that the AI slop that's being produced makes for a lot more vulnerabilities being shipped. The bigger target makes for the easier discovery.
    - ragall 5mo ago
      > That's correlation, not causation. Pragmatically, correlation *is* evidence of causation in favour of the best explanation, until somebody finds a better explanation. > It could equally be argued that the AI slop that's being produced makes for a lot more vulnerabilities being shipped. This is also true, and does not exclude the other, because for the moment the vast majority of production software in the world (and therefore the bulk of enticing targets) was written before AI. If LLM software will become prevalent in commercial setups, then LLM-generated code will eventually become the majority of targets.
      - awesome_dude 5mo ago
        > Pragmatically, correlation is evidence of causation in favour of the best explanation, until somebody finds a better explanation. Uh, no. Correlation is only ever one thing - cause for investigation. Everything based on correlation alone is speculation. You can speculate all you like, I have zero issue with that, but that's best prefaced with "I guess" edit: Science captures this perfectly, and people misunderstand this so fundamentally that there is a massive debate where people who think they are "pro science" argue this so badly with theists that they completely hoist themselves with their own petard. Science uses the term "theory" because all of our understanding is based on "available data" - and science biggest contribution to humanity is that it accepts that the current/leading THEORY can and will be retracted if there is compelling data discovered that demonstrates a falsehood. So - because I know this is coming - yes science is willing to accept some correlation - BUT it's labelled "theory" or "statistically significant" because science is clear that if other data arises then that idea will need to be revisited.
awesome_dude 5mo ago
> people were already diffing kernel commits and figuring out which ones were security fixes With skill, and usually not consistently and systematically. With AI, anyone can do this to any software. I would like to see actual evidence of this, not.. vibes I mean, this reeks of "Anyone is a Principal developer now" when the truth is there is still work to do.
totetsu 5mo ago
“White-Hat”

alecco 5mo ago

> Torvalds said that disclosing the bug itself was enough, without the pursuant circus that followed when a major problem has been discovered. [1] So it's not surprising Dirtyfrag was disclosed by a fix in the Linux kernel. [2] [1] https://www.zdnet.com/article/torvalds-criticises-the-security-circus/ https://www.zdnet.com/article/torvalds-criticises-the-securi... [2] https://afflicted.sh/blog/posts/copy-fail-2.html https://afflicted.sh/blog/posts/copy-fail-2.html

santoshalper 5mo ago

I'd say it's an old problem be exacerbated by AI.

lynndotpy 5mo ago

I haven't been keeping tabs for the entirety of Linux development, but has it ever happened before that someone dropped a working exploit from the mailing list before the patch even hit the kernel? I haven't seen this kind of thing and I get the impression, despite all the hype, that this will be a frequent phenomenon now thanks to LLMs.

Forgeties79 5mo ago

I find i’m writing variations of the same comment every week so I’m just going to share a previous version I wrote if you’ll permit the laziness: https://news.ycombinator.com/item?id=47921829 https://news.ycombinator.com/item?id=47921829

fragmede 5mo ago

Reminder: the Ksplice patent expires October 1, 2028.

whattheheckheck 5mo ago
What's the implications to that
- fragmede 5mo ago
  Means you wouldn't have to reboot to patch for security updates to the Linux kernel. Assuming someone does something with that.
manquer 5mo ago
I don't think hot patching holds the same relevance it did in 2010. Much of today's workloads are containerized and run on roughly ephemeral nodes that can be switched out easily- K8s version upgrades force this more or less. We tent to run more and more of-the shelf hardware and worry less about individual node failures now. In-memory updates also not magic , and can be limited as they requires data structure semantics to not really change and can create its own class of issues/bugs including security ones. While am sure there are still use cases which dictate this type of update, the need is lot less than 15 years ago that the patent expiry will do much to the ecosystem.
- dawnerd 5mo ago
  That’s still a minor part of the overall Internet. Small orgs are still using traditional hosting which who knows how often are updated. I’ve seen clients sites running on managed servers that are a few major versions behind.
  - manquer 5mo ago
    The small orgs using traditional hosting are not the workloads which would consider in-memory update paths ? Typically when shops like this do scheduled updates they will happily announce downtime, it just not business critical to have zero planned downtime and also lack the skill / budget to evaluate if a given patch can be applied in-memory or not. The overlap between those using simper setups you say and those who need in-memory updates doesn't exist?

cush 5mo ago

> This feels more like an old problem getting reframed as an AI problem. Sure the mechanics haven't changed, but the scale and risk has. The number of attackers capable of taking advantage of the vulnerability has dramatically increased.