3 ms·

There is a finite number of rces that LLMs can find. We‘re in for a rough couple of years but on the other side of the transition we‘ll have more secure softwar

• dtech 17d ago
  only if unreviewed LLM code - as is becoming increasingly the standard - isn't introducing new RCEs constantly
• e28eta 17d ago
  What makes you think RCEs are being found & fixed at a rate that’s faster than they’re being introduced? I could see it going either way.
  • user43928 17d ago
    Why would the model not find the vulnerability during implementation or testing before release? If it requires a lot of compute and trying, this is something that could be provided for common software.
    • xboxnolifes 17d ago
      Because it's far cheaper to to not spend the tokens finding the vulnerabilities, and software is now being created and released magnitudes faster than ever before. I could see the huge software companies maybe having fewer vulnerabilities, but I expect to see so much more in the smaller side of things.
    • wood_spirit 17d ago
      Sad that this could well be that the path to OpenAI and Anthropic profitability of this arms race between defending LLM white hatting a company’s website and the black hat LLMs attacking it? So the whole thing is forcing the good guys to outspend on tokens to preemptively defend against the risk of the bad guys outspending them on tokens, rather than buying tokens to actually add features to the product etc. So are they creating a market for the solution by helping create the problem? A kind of rent-seeking AI security-industrial complex!!
      • agileAlligator 17d ago
        The only thing AI has changed is that it has dropped both: the cost of attack and the cost of defense. Nothing in the game has materially changed; the game has just sped up.
        • wood_spirit 17d ago
          Who gets rent has changed. It puts me in mind of cloudfare et al
          • agileAlligator 17d ago
            Not really. Actually, for the purposes of cybersecurity, local models are far superior. Both offense and defense.
        • emzo 17d ago
          The game has increased in scope.
          • agileAlligator 17d ago
            That is the direct effect of reduced cost. Jevon's paradox type effect: cost goes down demand goes up. You can AI-check so many more things that would be very time consuming earlier.
        • red-iron-pine 16d ago
          plenty more has changed. for example the barrier to being a skiddie is basically gone, and low-skill would be hackers can hit very hard. to develop a CVE into a KEV in 2017 might take 2-3 months with a skilled team of serious security engineers; now my intern can get into police radios without knowing anything about the underlaying technology, essentially on a whim. any random tier 1 IT drone who can define a VLAN can potentially hit as hard as that team of security engineers now
          • agileAlligator 16d ago
    • techpression 17d ago
      Because people need to spend time and money on that, which they won’t. The implementation is cheap, the review and follow-up is not (speaking from a pure LLM only workflow). My ratio is around 1:2 currently, so twice as much time spent fixing vs building.
    • philbo 17d ago
      > it requires a lot of compute This is one reason > and trying and this is the other.
    • imhoguy 17d ago
      The surface of potential issues is growing with complexity of all connected parts of the system. That applies to not only software. To prevent issues you either spend proportional amount (dollars, tokens, hours) on testing or reduce complexity of the system.
  • nmlt 17d ago
    Those companies that produce more RCEs than they close will sink and those that don’t won’t.
    • bigfatkitten 17d ago
      If customers actually cared about this, Microsoft would’ve gone bust 20 years ago.
      • embedding-shape 17d ago
        People didn't store their entire life in the cloud and had every service connected with each other 20 years ago. People pay more attention today, and companies pay a lot more attention today. Of course, depends heavily on what country you live in.
        • bigfatkitten 16d ago
          Can you point to a single vendor where this has actually occurred? Customers say these things in response to a breach, but in practice they don’t lift a finger to actually change anything. Entra ID is full of design-level bugs that allow full tenant takeover, but nobody is abandoning M365 in droves. Windows has been a piece of shit for decades, and it’s still the default and dominant desktop platform. Equifax lost personal data for almost 150 million people in 2017, and they’re financially stronger than ever. Okta got thoroughly compromised two years in a row (2022 and 2023), and they’re still the global market leader in their space.
  • TacticalCoder 17d ago
    > What makes you think RCEs are being found & fixed at a rate that’s faster than they’re being introduced? It could go either way but we're already at a point where successful exploits in some software (like Chrome) require an absurd amount of exploits to be chained to lead to an actual RCE. We've seen chains requiring more than ten exploits: not kidding. We'll learn to put more and more sandboxes / guards / checks / defensive techniques everywhere and then all that's going to be needed is for AI looking for security issues to find something ridiculous like 10% of all the actual issues to stop RCEs dead in their tracks. Also arguably the current SNAFU was expected: we fully knew hardly anyone was taking security seriously. Now: not so much. Many projects had tens and even hundreds of issues pointed to them. I think we'll see several things: projects beginning to take security seriously, defense in depth getting generalized and hence RCEs requiring ever more bugs/exploits to be chained to achieve anything, low-hanging fruits getting patched at an insane pace, new code being immediately checked, by LLMs, for not just low-hanging fruits but also more advanced security weaknesses, etc. We may also see things like the lost art of configuring firewalls making a comeback, the generalization of hardware security modules (where applicable), and even things offering physical guarantees, like time-bounded retrieval protocols, beginning to get used seriously. If I had to bet I'd say it shall go both ways: some projects are going to extremely sloppy and full of holes but others are going to get so secure nobody shall ever break them.
  • brookst 17d ago
    I'd love to see data, but my intuition is that the average developer has access to dramatically better security reviews and far lower cost than ever. There's more software being written than ever so maybe raw numbers of RCE's could be up, but as a percentage, I'd really expect them to be down. Especially among any fairly common software, as all it takes is anyone working on it to get the idea to test.
    • d4mi3n 17d ago
      What I’m seeing is more developers pushing more code of dubious quality without the ability to respond to feedback on said code. You can have the best security review in the world, but if the author of the code is not equipped to understand the feedback it ends up being a moot point. The challenge to me seems less technical and more cultural: how do we keep ourselves intellectually honest and engaged when we now spend the majority of our time orchestrating agents and outsourcing the design and thought processes?
      • fc417fc802 17d ago
        Hey claude, compare this security review to the current codebase and patch up anything that needs it.
    • tyre 17d ago
      One issue for developers is that the most powerful models refuse to do comprehensive reviews. You can’t ask Fable 5.1 to find every exploit in your codebase, because that’s indistinguishable from what a bad actor would do.
    • Timwi 16d ago
      > I'd love to see data, but my intuition is that the average developer has access to dramatically better security reviews and far lower cost than ever. Where? If I ask Claude to do a “security review” of my software, it gets blocked as a possible hacking attempt.
• maaaaattttt 17d ago
  This assumes we don't create other bugs/vulnerabilities while fixing the existing ones.
• csomar 17d ago
  We’ll have the same level of security as before; it’s just that, without LLM help, hackers won’t be as effective as before. So the bar is raised.
• jibal 17d ago
  No one with a shred of intellectual integrity uses a "There is a finite number" strawman. As a matter of basic logic, there will never be a time when it will be known that there are no bugs.
• pizza234 17d ago
  > There is a finite number of rces that LLMs can find. This is a factor in favor of stability/security of software, but there are many others against: - software (code) changes all the time, so there are windows of opportunity during which a bug is exploitable; in addition to that, a bug may take a relatively long time to be fixed - a model used for attack may be stronger than the model used for defense, both in terms of model quality and compute allocated - with software complexity increasing (and team/companies behind projects getting bigger), the margin for mistakes grows thinner, and introducing misconfigurations or weaknesses becomes exponentially easier (with "exponentially", I mean literally, because the interdependence of the components, both technical and human) And last but not least: in general, attackers are more skilled than defenders; in best case, defenders are well-trained. And the idea of having the population of potential skilled attackers growing is very unsettling.
  • red-iron-pine 16d ago
    im not sure i'd say the attackers are more skilled -- you can get pretty far with the right attitude and a VM running kali linux. i know several red teamers and they often describe how painfully basic and routine a lot of pentests can be. spend a week using the best hacking practices of 2018, etc. the difference is the attackers now often need no skills since the burning tokens do it all for them. tier 1 helpdesk types who can't even spell RDP can still hit as hard, or reasonably hard, as their tier 3 expert sysadmins. college seniors with strong dev skills now can pace or exceed secrious app-sec engineers.
• joshspankit 17d ago
  There was a time I would have agreed with this statement, but now that I’ve “seen how the sausage is made”, I believe it’s a fantasy. Look at rowhammer: a completely novel exploit that was off the collective radar And then, look at the software industry as a whole: an industry that works towards refined and perfectly secure code is also working towards boring and restrictive, essentially the opposite of it’s trend so far