undefined | Better HN

0 pointsmdeeks1mo ago0 comments

Two years? That exists right now. You only have to point Codex Security at an open source repo. There are a lot of tools and companies that are spinning up today that do autonomous pentesting.

I'm not even sure a specialized model is needed here. It probably just needs the right harness around existing ones.

I expect the next two years to be absolutely brutal for hacks. Attackers have supercharged tools in their hands right now. Defenders are only getting started and will have to plow through a massive backlog of newly uncovered vulns.

The major short term downside is that open source or personal projects won't be able to afford things like Codex Security.

0 comments

6 comments · 1 top-level

nullbio1mo ago· 5 in thread

> The major short term downside is that open source or personal projects won't be able to afford things like Codex Security.

Realistically, all open-source projects should be forced to have automated scans of this nature before their releases can be shipped. This is something the package managers and github need to figure out. It'd stop the supply chain attacks too.

qerahb1mo ago

So first they steal all code and launder it without attribution. Then they release a tool that doesn't find anything in hardened projects and is marketed through secrecy and modern equivalents of Netcraft like this British AI institute.

Then open source projects need a McKinsey-like stamp of approval to even be released.

Sounds like there are many parasites in this process.

You know that open source users are free to scan everything if they want to?

nullbio1mo ago

I don't like it either. But what alternative is there when a spaghetti graph of open-source dependencies serves as the backbone for the entire worlds software? I haven't seen or heard of any novel solutions to this problem yet.

051mo ago

> It'd stop the supply chain attacks too.

Yeah it’s hard to write a loop that makes an adversary agent write and mask malware then runs a scanning agent and if the malware is detected gives the detection details to the adversary agent with instructions to hide it better..

As usual, the attacker only needs to get lucky once.

junon1mo ago

> all open-source projects should be forced

That's a great way to kill OSS. This is only bootlicking the idea of corporations profiting off of unpaid labor.

nullbio1mo ago

Well something needs to be done urgently, before hospitals and critical infrastructure start getting ransomware infected on a daily basis. This isn't an unlikely scenario either, all it will take is one well resourced attacker to spin up thousands of decensored agents and have them pumping out attacks 24/7. I'm actually kind of surprised it hasn't already happened. TeamPCP is just the beginning. We're lucky they're not using ransomware, otherwise the carnage would be 100-fold.

1 more reply

j / k navigate · click thread line to collapse

0 comments