4 ms·

I built a tool that monitors commits and tries to detect silent bug fixes. With GPT-5.5-class models, it can identify fixes hidden within otherwise routine comm

I built a tool that monitors commits and tries to detect silent bug fixes. With GPT-5.5-class models, it can identify fixes hidden within otherwise routine commits quite reliably. Obfuscating the code changes enough to avoid detection is difficult. I have heard of at least one project (c-lightning?) temporarily releasing a closed-source binary as a workaround until users could update safely.

lazyasciiart 1mo ago
People are trying to secretly fix bugs?
- stavros 1mo ago
  Yes, they don't want the vulnerabilities exposed so they ship the fix in secret, contained in unrelated features.
  - lazyasciiart 1mo ago
    Ah, I guess that would advertise that users of the old version are vulnerable. I was imagining some altruistic contributor trying to sneak in a bug fix past the maintainer.
    - stavros 1mo ago
      Yep, this is for maintainers releasing fixes to secretly-reported 0days without tipping off attackers who are looking to exploit a (sometimes very large) install base.
- dspillett 1mo ago
  Yes. The problem with openly releasing a fix for a security bug is that people are not always quick to update their instances. It only takes one black-hat monitoring your releases by some means to dissect the changes, find the hole, and make an exploit that can be immediately used against unpatched systems, and the sudden availability of better automated tools for that makes it a much bigger problem than it was a year or more ago. Information about the problem then gets released later, once everyone has had appropriate time to get up-to-date. Or not, and we are non the wiser.
9cb14c1ec0 1mo ago
Have you heard of these things called LLMs are that are quite good at reversing changes in closed source binaries?
- teravor 1mo ago
  you can diff binaries in a disassembler, the technique has been used for a long time to discover patched Microsoft vulnerabilities, create exploits and then race the world. now you can instruct an LLM to do this with MCP...
  - rndhouse 1mo ago
    There are many techniques for making a closed-source binary harder to reverse engineer: polymorphism, symbol stripping, code encryption, packing, and so on. Closed-source binaries at least stand a chance of being effectively obfuscated, unlike open-source code.
    - teravor 1mo ago
      and those measures have always been merely annoyances. except for the VM methods which impact performance significantly. now none of those methods matter as you can just instruct an LLM to bang its head against the wall until the wall breaks.
      - rndhouse 1mo ago
        They still matter in the sense that they impose a cost. In other words, they buy time, which is all the users need before updating. I'm not sure if the cat and mouse game resolves clearly one way or another. Since the obfuscation can be hardened against LLMs during development.

lazyasciiart 1mo ago

People are trying to secretly fix bugs?

stavros 1mo ago
Yes, they don't want the vulnerabilities exposed so they ship the fix in secret, contained in unrelated features.
- lazyasciiart 1mo ago
  Ah, I guess that would advertise that users of the old version are vulnerable. I was imagining some altruistic contributor trying to sneak in a bug fix past the maintainer.
  - stavros 1mo ago
    Yep, this is for maintainers releasing fixes to secretly-reported 0days without tipping off attackers who are looking to exploit a (sometimes very large) install base.
dspillett 1mo ago
Yes. The problem with openly releasing a fix for a security bug is that people are not always quick to update their instances. It only takes one black-hat monitoring your releases by some means to dissect the changes, find the hole, and make an exploit that can be immediately used against unpatched systems, and the sudden availability of better automated tools for that makes it a much bigger problem than it was a year or more ago. Information about the problem then gets released later, once everyone has had appropriate time to get up-to-date. Or not, and we are non the wiser.

9cb14c1ec0 1mo ago

Have you heard of these things called LLMs are that are quite good at reversing changes in closed source binaries?

teravor 1mo ago
you can diff binaries in a disassembler, the technique has been used for a long time to discover patched Microsoft vulnerabilities, create exploits and then race the world. now you can instruct an LLM to do this with MCP...
- rndhouse 1mo ago
  There are many techniques for making a closed-source binary harder to reverse engineer: polymorphism, symbol stripping, code encryption, packing, and so on. Closed-source binaries at least stand a chance of being effectively obfuscated, unlike open-source code.
  - teravor 1mo ago
    and those measures have always been merely annoyances. except for the VM methods which impact performance significantly. now none of those methods matter as you can just instruct an LLM to bang its head against the wall until the wall breaks.
    - rndhouse 1mo ago
      They still matter in the sense that they impose a cost. In other words, they buy time, which is all the users need before updating. I'm not sure if the cat and mouse game resolves clearly one way or another. Since the obfuscation can be hardened against LLMs during development.