3 ms·

I'm sending all my condolences out to everyone who is in a corporate environment using tools like Veracode or Snyk to automatically assess for CVEs and block me

I'm sending all my condolences out to everyone who is in a corporate environment using tools like Veracode or Snyk to automatically assess for CVEs and block merges or deployments based on "findings". My experience in such environments leads me to believe this is going to be a rough ride for those heavily locked-down enterprises, because depending on the environment, an exception of "this CVE was hallucinated by AI" is probably going to be difficult to get accepted, and when it does, starts to become its own avenue for exploitation and adds even more noise and confusion to the mix.

javcasas 2mo ago
Snyk routinely tells us that we need to upgrade urgently because they found a vulnerability in the Windows version of a package. We run everything in Linux.
MattPalmer1086 2mo ago
In our organisation, my security team spend the majority of our effort weeding out unexploitable CVEs - which are the majority of them. But the volume is growing year on year - I don't know how sustainable it's going to be.
- rowls66 2mo ago
  Sounds like a good job for AI. I do fear that the future will involve deploying AI do deal with the mountain of slop produced by other AI's.
  - Versipelle 2mo ago
    I agree, this is a trend I'm seeing all over the place with generative AI: first, break a functioning, human-based workflow by flooding it with AI generated content. Blame the persons maintaining the workflow for being the bottleneck and hindering innovation. Then, implement generative AI in the workflow review or approval process to keep up the pace, irrespective of how valuable the extra generated stuff has been.
everforward 2mo ago
They’re not bad if you give up on being able to reproduce arcane bugs. Don’t pin versions, pull everything from latest, CVEs are just a rebuild. Certainly not an amazing idea, but it solves the problem of the day. The funnier, Kafakaesque problem of the day is interactions with mandatory cooldown periods on new versions because of supply chain risks. I’ve had a couple tickets get stuck because the CVE scanner says I have to update, but the cooldown enforcer says the version hasn’t been out long enough.
- pixl97 2mo ago
  >Don’t pin versions In enterprise software..... I only dream of work where some ancient version isn't pinned because 200 person hours are need to adapt the code to newer versions. And the update versus cooldown are fun. Can't win either way you go.
- inigyou 2mo ago
  > Don't pin versions, pull everything from latest Rebuild broke half your tests. People are exploiting the CVE against your system right now. Good luck!
  - pas 2mo ago
    oh, it could be worse! spending time on fake CVEs while people are exploiting real 0days against your system.
  - everforward 2mo ago
    You can’t fail unit tests you don’t have because your agent “fixed” them by deleting them. You have to go full galaxy brain for it to work lol
renezander030 2mo ago
[dead]

javcasas 2mo ago

Snyk routinely tells us that we need to upgrade urgently because they found a vulnerability in the Windows version of a package. We run everything in Linux.

MattPalmer1086 2mo ago

In our organisation, my security team spend the majority of our effort weeding out unexploitable CVEs - which are the majority of them. But the volume is growing year on year - I don't know how sustainable it's going to be.

rowls66 2mo ago
Sounds like a good job for AI. I do fear that the future will involve deploying AI do deal with the mountain of slop produced by other AI's.
- Versipelle 2mo ago
  I agree, this is a trend I'm seeing all over the place with generative AI: first, break a functioning, human-based workflow by flooding it with AI generated content. Blame the persons maintaining the workflow for being the bottleneck and hindering innovation. Then, implement generative AI in the workflow review or approval process to keep up the pace, irrespective of how valuable the extra generated stuff has been.

everforward 2mo ago

They’re not bad if you give up on being able to reproduce arcane bugs. Don’t pin versions, pull everything from latest, CVEs are just a rebuild. Certainly not an amazing idea, but it solves the problem of the day. The funnier, Kafakaesque problem of the day is interactions with mandatory cooldown periods on new versions because of supply chain risks. I’ve had a couple tickets get stuck because the CVE scanner says I have to update, but the cooldown enforcer says the version hasn’t been out long enough.

pixl97 2mo ago
>Don’t pin versions In enterprise software..... I only dream of work where some ancient version isn't pinned because 200 person hours are need to adapt the code to newer versions. And the update versus cooldown are fun. Can't win either way you go.
inigyou 2mo ago
> Don't pin versions, pull everything from latest Rebuild broke half your tests. People are exploiting the CVE against your system right now. Good luck!
- pas 2mo ago
  oh, it could be worse! spending time on fake CVEs while people are exploiting real 0days against your system.
- everforward 2mo ago
  You can’t fail unit tests you don’t have because your agent “fixed” them by deleting them. You have to go full galaxy brain for it to work lol

renezander030 2mo ago

[dead]