Rendered at 15:36:20 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
wongarsu 3 hours ago [-]
Doesn't the Linux kernel encourage reporting on the public mailing list for kernel vulnerabilities that were found using AI? If I remember correctly they introduced that policy after the security mailing list got swamped with multiple reports for the same vulnerabilities
It is very interesting that they believe AI will find different bugs than people. That is, if you found a bug with AI the expectation is that others could find the same bug easily. But if you find it yourself, it is somehow more of a sensitive secret.
I do not imagine that things divide so clearly along these lines.
hannasanarion 37 minutes ago [-]
Probably not a clear divide, but it might be some kind of divide, and it might be the opposite of intuition.
The big advantage the LLMs have is their huge context windows, ability to parallelize and delegate, and no attention fatigue or need to sleep. They can think about random combinations of functions and modules all day long until they find a combination that's exploitable. That's hard for a person to do, and its the kind of exploit that probably would never be found otherwise except by another llm-powered thing. Not being a security expert myself, I gather that these AI vulns tend to be small needles in very large haystacks that normal people just would never have the patience to search.
But if you found something yourself, then it's something that's simple enough and involves a small enough number of moving parts that you can keep it in your head all at once and recognize the problem and correctly reason about its consequneces, which probably means it's easier to exploit, and therefore more dangerous if made public.
It feels a little backwards, and it might still be backwards, but if there's any benefit i think it's along those lines.
ReDress 3 hours ago [-]
I don't think AI is of much concern, if you actually have a valid security issue.
No-one, really will care if you discovered it via AI or otherwise. Because, the weight of the bug itself should outweight other concerns. This is how professional security works. There will always be one concern or the other about a bug but what carries more weight will determine the direction that the disclosure process takes.
A valid security bug, by itself should carry enough technical weight that concerns about whether it was discovered through AI or otherwise should become irrelevant.
Anyways, it mostly seems like people don't really care much about computer security at Linux. I would like to think they care more about infrastructure and related security issues because, well, if my computer is an open book, then why would security issues around it be a concern?
Anyways...
Enough said here - lol
john_strinlai 2 hours ago [-]
>A valid security bug, by itself should carry enough technical weight that concerns about whether it was discovered through AI or otherwise should become irrelevant.
that's not really what the policy is about.
the thinking behind the policy is that if you found it via AI, other people can trivially find it via AI. that is why AI-found bugs are treated as public from the start.
pelotron 41 minutes ago [-]
My sinister side wonders if part of it could be that if you found it via AI but it turns out to be a hallucination, then you must accept the public ridicule for not thoroughly vetting the AI output.
ReDress 2 hours ago [-]
As much as I am concerned. Security is not a concern in most open source projects.
But, for one reason the other, they might give credit to a vulnerability they find interesting.
rwmj 2 hours ago [-]
As it should. If an LLM discovered them you should assume that another LLM, or another person running the same LLM, could find them. They are effectively public already.
wilkystyle 2 hours ago [-]
No. I have an LLM and didn't discover it. Folks in HR have LLMs but can't produce the same software you can. Just because an LLM could discover it does not mean that it has been discovered yet. Responsible disclosure is still a valuable thing.
john_strinlai 2 hours ago [-]
>I have an LLM and didn't discover it.
are you actively pointing your LLM at the kernel to identify security bugs?
the policy wasn't made on a whim. to quote the linux security team: "bugs discovered this way [via ai] systematically surface simultaneously across multiple researchers, often on the same day."
>Responsible disclosure
the term responsible disclosure is a silly thing made up by vendors.
wilkystyle 12 minutes ago [-]
> are you actively pointing your LLM at the kernel to identify security bugs?
I am not actively pointing my LLM at the kernel in the specific way that would uncover these bugs, and just because it's possible to do so doesn't mean that it has happened already.
> the policy wasn't made on a whim. to quote the linux security team [...]
Great, so let the ones that arise simultaneously do so. What does that have to do with immediately publicizing a vulnerability, regardless of severity, just because an LLM was involved in its discovery?
> the term responsible disclosure is a silly thing made up by vendors
That's certainly an opinion you're welcome to have, but unless you are proposing that responsibility and disclosure are two orthogonal concepts I don't see what that opinion has to do with anything I've said.
yreg 1 hours ago [-]
You could say that there is no reason to report them at all, because the maintainers can point llms to the kernel themselves.
lynndotpy 3 hours ago [-]
Still bleary eyed, but: Most severe ones are in SMB and KSMBD, which apparently have implementations in kernel space. I think this doesn't impact anyone not using KMB.
Others are LPEs, but two have been deleted by now, so can't be sure of the details.
TrendMicro's site opens up with a big big "Advancing AI-Native Security with Anthropic". Which checks out I guess.
dayofthedaleks 4 hours ago [-]
The headline should include Trend Micro's name for shaming purposes. Amatuerish.
59percentmore 12 minutes ago [-]
Someone said that "they" are setting up the narrative for a global tech crash/internet blackout, and it's becoming easier and easier to believe it.
totetsu 10 minutes ago [-]
So get local backups of all my cloud drive before Nov 3, gotcha.
jeanpah 56 minutes ago [-]
Do You guys think that with ai we Will achieve something like a bug free os distro or programming language? Like some sort of perfection?
pixl97 53 minutes ago [-]
From just writing code, no.
Now, the question is can we make some kind of formal verification language that forces checks everything and doesn't allow bugs? Maybe?
But that's assuming the underlying hardware and firmware doesn't have flaws that can break those assumptions too.
wongarsu 43 minutes ago [-]
That just shifts bugs up one layer, into the specification that you then verify
dwohnitmok 1 minutes ago [-]
Yes but that is significantly less surface area (indeed asymptotically less in the general case if you believe P != NP).
Joel_Mckay 5 minutes ago [-]
No, but languages like Elixir/Erlang/OTP are designed to fail gracefully while continuing to run.
With complex systems there are too many failure modes, and with "vibe coding" institutional negligence it is simply degenerative.
There are theoretical workarounds to LLM brute force scans, but they are not free to build. =3
pelotron 39 minutes ago [-]
Not as long as new features are being written.
regenschutz 52 minutes ago [-]
Everything is bug-free until someone finds a bug in it.
assbuttbuttass 55 minutes ago [-]
lmao
extraextra 4 hours ago [-]
What an entertaining season in the simulation
ActionHank 2 hours ago [-]
Every episode is a cliff hanger.
ReDress 4 hours ago [-]
I'm not surprised because the disclosure process of https://hackerone.com is completely and openly public.
But they have also disabled Linux as one of the products that they work with.
ivanmontillam 4 hours ago [-]
It's being a great season, techsecurity-wise.
Avicebron 4 hours ago [-]
On HN everyone is a security engineer.
renehsz 2 hours ago [-]
There are only two types of people: Those who are security engineers, and those who pretend to be.
gilrain 4 hours ago [-]
They wanted "full stack", so they found hires with 1/10th of an education in each of 10 different fields.
The boss class are rich because they're smart. /s
greenavocado 3 hours ago [-]
> 1/10th of an education in each of 10 different fields combined FTFY
0c3ca83 3 hours ago [-]
But they're cheap 10x engineers.
jumperabg 3 hours ago [-]
Finally the last vulnerabilities of the year.
cookiengineer 3 hours ago [-]
> Finally the last vulnerabilities of the year ... until today
Fixed that for you
ototot 4 hours ago [-]
are those posted by AI?
NooneAtAll3 4 hours ago [-]
"accidentally"
I feel paranoid enough now to blame ai companies to try to induce panic and proclaim "buy our product to save yourself"
pixl97 46 minutes ago [-]
My goodness you don't like AI very much at all do you.
Does the security flaw exist or not?
I've always been one for immediate release of any security flaw the second it is found.
"But, people will get hurt or lose money that way"
Correct, they will understand the risk of using computer systems. Because we've hidden all the flaws under a mask of responsible disclosure people really don't understand the dangers we've subjected ourselves to by writing a bunch of bug filled bullshit code and instead we pretend like we have a handle on the situation.
WE DO NOT. If AI has proven anything it's how all of our code is a giant stack of cards waiting till collapse. And it proves humans will never learn, we'll just use the AI to pump out more shitty bug filled code.
It's all fun and games until someone crashes the electrical grid via bugs, or a major incident on the banking system. Human love to write regulations in blood because we're incapable of doing anything correctly before a bunch of people die.
trollbridge 45 minutes ago [-]
Use open weight models on your own hardware.
pelagicAustral 4 hours ago [-]
Agree, wild stretch to accidentally send this loot to a mailing list.
ReDress 3 hours ago [-]
To be honest and fair, in this situation I don't believe this is something accidental.
It probably just happens that the security concerns at ZDI don't match the security concerns at Linux(the vendor).
So, it turns out that this vendor is difficult to work with ....
I mean - heh
fguerraz 3 hours ago [-]
Can we kick SMB implementations out of the kernel please? If not, can we please get PHP mainlined in the kernel?
ReDress 3 hours ago [-]
SMB was "imported" into the kernel as an optimization for the user-space version - heh
kjs3 2 hours ago [-]
Like when graphics stack and drivers were "imported" into the WinNT kernel as an optimization for the user-space version. And thus began 30 years of "another week, another graphics subsystem crash/vuln".
jacquesm 26 minutes ago [-]
Indeed. These are gigantic mistakes. The quest for performance is diametrically opposed to having a secure system. There will always be a price, sometimes a big one for having a system that enforces proper boundaries. In my opinion: if something can be a process then it should be a process.
> If you resorted to AI assistance to identify a bug, you must treat it as public. https://github.com/torvalds/linux/blob/master/Documentation/...
I do not imagine that things divide so clearly along these lines.
The big advantage the LLMs have is their huge context windows, ability to parallelize and delegate, and no attention fatigue or need to sleep. They can think about random combinations of functions and modules all day long until they find a combination that's exploitable. That's hard for a person to do, and its the kind of exploit that probably would never be found otherwise except by another llm-powered thing. Not being a security expert myself, I gather that these AI vulns tend to be small needles in very large haystacks that normal people just would never have the patience to search.
But if you found something yourself, then it's something that's simple enough and involves a small enough number of moving parts that you can keep it in your head all at once and recognize the problem and correctly reason about its consequneces, which probably means it's easier to exploit, and therefore more dangerous if made public.
It feels a little backwards, and it might still be backwards, but if there's any benefit i think it's along those lines.
No-one, really will care if you discovered it via AI or otherwise. Because, the weight of the bug itself should outweight other concerns. This is how professional security works. There will always be one concern or the other about a bug but what carries more weight will determine the direction that the disclosure process takes.
A valid security bug, by itself should carry enough technical weight that concerns about whether it was discovered through AI or otherwise should become irrelevant.
Anyways, it mostly seems like people don't really care much about computer security at Linux. I would like to think they care more about infrastructure and related security issues because, well, if my computer is an open book, then why would security issues around it be a concern?
Anyways...
Enough said here - lol
that's not really what the policy is about.
the thinking behind the policy is that if you found it via AI, other people can trivially find it via AI. that is why AI-found bugs are treated as public from the start.
But, for one reason the other, they might give credit to a vulnerability they find interesting.
are you actively pointing your LLM at the kernel to identify security bugs?
the policy wasn't made on a whim. to quote the linux security team: "bugs discovered this way [via ai] systematically surface simultaneously across multiple researchers, often on the same day."
>Responsible disclosure
the term responsible disclosure is a silly thing made up by vendors.
I am not actively pointing my LLM at the kernel in the specific way that would uncover these bugs, and just because it's possible to do so doesn't mean that it has happened already.
> the policy wasn't made on a whim. to quote the linux security team [...]
Great, so let the ones that arise simultaneously do so. What does that have to do with immediately publicizing a vulnerability, regardless of severity, just because an LLM was involved in its discovery?
> the term responsible disclosure is a silly thing made up by vendors
That's certainly an opinion you're welcome to have, but unless you are proposing that responsibility and disclosure are two orthogonal concepts I don't see what that opinion has to do with anything I've said.
Others are LPEs, but two have been deleted by now, so can't be sure of the details.
TrendMicro's site opens up with a big big "Advancing AI-Native Security with Anthropic". Which checks out I guess.
Now, the question is can we make some kind of formal verification language that forces checks everything and doesn't allow bugs? Maybe?
But that's assuming the underlying hardware and firmware doesn't have flaws that can break those assumptions too.
With complex systems there are too many failure modes, and with "vibe coding" institutional negligence it is simply degenerative.
There are theoretical workarounds to LLM brute force scans, but they are not free to build. =3
But they have also disabled Linux as one of the products that they work with.
The boss class are rich because they're smart. /s
Fixed that for you
I feel paranoid enough now to blame ai companies to try to induce panic and proclaim "buy our product to save yourself"
Does the security flaw exist or not?
I've always been one for immediate release of any security flaw the second it is found.
"But, people will get hurt or lose money that way"
Correct, they will understand the risk of using computer systems. Because we've hidden all the flaws under a mask of responsible disclosure people really don't understand the dangers we've subjected ourselves to by writing a bunch of bug filled bullshit code and instead we pretend like we have a handle on the situation.
WE DO NOT. If AI has proven anything it's how all of our code is a giant stack of cards waiting till collapse. And it proves humans will never learn, we'll just use the AI to pump out more shitty bug filled code.
It's all fun and games until someone crashes the electrical grid via bugs, or a major incident on the banking system. Human love to write regulations in blood because we're incapable of doing anything correctly before a bunch of people die.
It probably just happens that the security concerns at ZDI don't match the security concerns at Linux(the vendor).
So, it turns out that this vendor is difficult to work with ....
I mean - heh
This is like saying "Linux source code leaked"