According to our software (which is, of course, imperfect), your account has repeatedly been posting AI-generated and/or AI-edited comments. If so, can you please stop? It's not allowed here, and will eventually get your account banned.
>What if finding every vulnerability in a piece of software were just as fast and easy as finding a few of them, thanks to automation?
This presumes there is such a thing as "every" vulnerability. It is possible that ever more sophisticated, complicated, and abstract attacks become possible/discoverable as one applies more intelligence to the problem.
IF it is indeed possible to make a piece of software completely secure, then yes, more intelligent systems make the situation better, because it will always be possible to audit a system before it is ever released and make it completely safe.
That is a very big if and, as far as I am aware, remains to be seen if it's the case
-edit- They mention this possibility themselves further down, so the authors know this is a completely speculative point/article. They don't even try to make an argument about why one possibility might be more likely than the other. This article is useless.
Why are we worried about vulnerabilities in code when AI powered social engineering will make it fast, easy, and even fun to find vulnerabilities through human interaction, faster and more deeply than ever?
Mythos is good for cybersecurity simply because now executives can’t just tell people that only superhackers can break their stuff, as people wouldn’t believe them now anyways.
Infosec for decades has been 99% “hey I found some low-hanging fruit” only to get treated like a liability by the company you report it to, if you got acknowledgment at all. Because of Mythos though, now Artificial Superhumans can find these same vulns, and anyone could be running such an intelligence! Even better, the rich untouchable people operating this particular Artificial Superhuman can’t just be suppressed or ignored by the other set of rich untouchable people that have routinely not cared in the past. So long as it makes anthropic money, maybe we’ll actually see actual improvements in security!
There will probably be congressional hearings when it turns out Lazarus Group had access, and then the USG will use it as an excuse to lock AI behind harsh KYC.
Mythos has been a boon for "look busy" work. My global corp org has been on a bender upgrading everything, patching everything. There is a giant dashboard that shows green/red for everything we have.
I think it's a total overreaction. But the edict was passed down, and here we are go.
I think Genode is the best news in a decade, the widespread use of containers as ersatz course grained capabilities is second.
Mythos lays bare the folly of allowing procurement to drive technical decisions instead of IT back in the 1980s. We had KeyKOS and then EROS, but settled for ambient authority based junk because it seemed cheaper.
Well... Yes and no. We've had automated vuln scanning tools for at least 20 years and software developers really don't like using them.
A. Individual developers get sorta cheesed when an automated tool implies they wrote code with a TOCTOU or off-by-one error. They look for reasons to diminish anything a tool might say
B. Most of these tools do a very bad job of identifying architectural flaws. I spent a year trying to explain the Confused Deputy problem to my coworkers and why I wanted to use capability based security. They ripped it all out when I moved on to another team. Their product continues to have security problems because they forced the association of credentials between domains and didn't do a great job of it.
This is largely on me. I should have spent more time socializing the solution.
C. Management never wants to pay for tools they view as "vitamins" (as opposed to "pain killers.") This is mostly changing as ransomware attacks are on the rise.
But... Long story short... Yes... This will hopefully cause people to use scanning tools. But in a year they'll slack off and complain it's too expensive.
18 comments
[ 3.4 ms ] story [ 56.8 ms ] thread(See https://news.ycombinator.com/newsguidelines.html#generated and https://news.ycombinator.com/item?id=47340079.)
This presumes there is such a thing as "every" vulnerability. It is possible that ever more sophisticated, complicated, and abstract attacks become possible/discoverable as one applies more intelligence to the problem.
IF it is indeed possible to make a piece of software completely secure, then yes, more intelligent systems make the situation better, because it will always be possible to audit a system before it is ever released and make it completely safe.
That is a very big if and, as far as I am aware, remains to be seen if it's the case
-edit- They mention this possibility themselves further down, so the authors know this is a completely speculative point/article. They don't even try to make an argument about why one possibility might be more likely than the other. This article is useless.
Infosec for decades has been 99% “hey I found some low-hanging fruit” only to get treated like a liability by the company you report it to, if you got acknowledgment at all. Because of Mythos though, now Artificial Superhumans can find these same vulns, and anyone could be running such an intelligence! Even better, the rich untouchable people operating this particular Artificial Superhuman can’t just be suppressed or ignored by the other set of rich untouchable people that have routinely not cared in the past. So long as it makes anthropic money, maybe we’ll actually see actual improvements in security!
Granted, given that most cybersecurity news over the past decade has been grim, both could be true...
https://x.com/kevinakwok/status/2049984076141281482
I think it's a total overreaction. But the edict was passed down, and here we are go.
Mythos lays bare the folly of allowing procurement to drive technical decisions instead of IT back in the 1980s. We had KeyKOS and then EROS, but settled for ambient authority based junk because it seemed cheaper.
I'll believe it when I see it, but it's almost certainly just marketing drivel.
A. Individual developers get sorta cheesed when an automated tool implies they wrote code with a TOCTOU or off-by-one error. They look for reasons to diminish anything a tool might say
B. Most of these tools do a very bad job of identifying architectural flaws. I spent a year trying to explain the Confused Deputy problem to my coworkers and why I wanted to use capability based security. They ripped it all out when I moved on to another team. Their product continues to have security problems because they forced the association of credentials between domains and didn't do a great job of it.
This is largely on me. I should have spent more time socializing the solution.
C. Management never wants to pay for tools they view as "vitamins" (as opposed to "pain killers.") This is mostly changing as ransomware attacks are on the rise.
But... Long story short... Yes... This will hopefully cause people to use scanning tools. But in a year they'll slack off and complain it's too expensive.