I will say, we’ve been deployed on Ubuntu 18.04 for 8 years now and tracking the CVEs against our configuration watching for potential exploits that could really matter to our systems, and it wasn’t until the past few months that those exploits actually started to get meaningful ability to compromise us.
What that says to me is: the LLMs are finding meaningful vulnerabilities that “the best minds” missed for years and years. And they’re also generating functional patches for these vulnerabilities far faster and more easily than the patches came out in the past.
I’m not loving the changed landscape, but I have to acknowledge that LLMs are making a significant difference.
It isn’t even the LLM. Its the data scraped from the internet wholesale and users contributing to corps by use. Not to mention the staggering amount of engineers turning that raw data into better output. The LLM just spits those billions of dollars of effort back out. I only pick this nit because too many people see local LLM and think that’s where the magic happens. It is just a flash in the pan. you need an internal combustion engine, transmission, wheels, chassis, cabin, and probably some seats if you want to get anywhere with it.
That said, it is the concentration of effort. Individuals can’t really rival that. I wonder if there are any initiatives in the open source community with this mindset…
" I don’t think that we’re any safer than before. That’s because finding vulnerabilities has never been the bottleneck in information security. The bottleneck isn’t even verifying a vulnerability report and validating its severity, as time consuming as that is. The bottleneck isn’t determining the fix, creating the patch, or publishing a new release. The bottleneck is still, as ever before, getting the goddamn packages updated. "
Dude thinks security through obscurity is valid and thinks running
That’s not the hard part to do, it’s the hard part to get other people to do, particularly those who can’t just run the package manager or let in-doze play patch roulette every Tuesday.
Security through obscurity isn’t going to cut it in the future, much less than it already didn’t in the past.
Security through air-gapping is still pretty good.
I will say, we’ve been deployed on Ubuntu 18.04 for 8 years now and tracking the CVEs against our configuration watching for potential exploits that could really matter to our systems, and it wasn’t until the past few months that those exploits actually started to get meaningful ability to compromise us.
What that says to me is: the LLMs are finding meaningful vulnerabilities that “the best minds” missed for years and years. And they’re also generating functional patches for these vulnerabilities far faster and more easily than the patches came out in the past.
I’m not loving the changed landscape, but I have to acknowledge that LLMs are making a significant difference.
It isn’t even the LLM. Its the data scraped from the internet wholesale and users contributing to corps by use. Not to mention the staggering amount of engineers turning that raw data into better output. The LLM just spits those billions of dollars of effort back out. I only pick this nit because too many people see local LLM and think that’s where the magic happens. It is just a flash in the pan. you need an internal combustion engine, transmission, wheels, chassis, cabin, and probably some seats if you want to get anywhere with it. That said, it is the concentration of effort. Individuals can’t really rival that. I wonder if there are any initiatives in the open source community with this mindset…
Yeah I got to this in the blog and stopped:
" I don’t think that we’re any safer than before. That’s because finding vulnerabilities has never been the bottleneck in information security. The bottleneck isn’t even verifying a vulnerability report and validating its severity, as time consuming as that is. The bottleneck isn’t determining the fix, creating the patch, or publishing a new release. The bottleneck is still, as ever before, getting the goddamn packages updated. "
Dude thinks security through obscurity is valid and thinks running
sudo apt update && sudo apt upgrade -y
Is the really hard part.
That’s not the hard part to do, it’s the hard part to get other people to do, particularly those who can’t just run the package manager or let in-doze play patch roulette every Tuesday.
Security through obscurity isn’t going to cut it in the future, much less than it already didn’t in the past.
Security through air-gapping is still pretty good.