|
| ▲ | juliusjh an hour ago | parent | next [-] |
| > I'm much less likely to get hacked in this new era of AI assistance, as I'm only a few days behind, rathe than a few months or years behind. Yes, but also, attackers are much faster now and complex chains of vulnerabilities became much easier to carry out. In the past, you might have just been "secure" because nobody cared to put in the time to target you unless you were unlucky. Now, many people have the capability and can completely automatize it. We essentially had security through obscurity for a long time. It was always dangerous. It's good that it ends. But the transition might be rough. |
| |
| ▲ | dubeye an hour ago | parent [-] | | That's an interesting theory I wonder if there is much evidence to back it up. I'm not seeing reports of dramatic increase in hacks. It will be interesting test case today, will we see huge amounts of hacks or not. | | |
| ▲ | juliusjh an hour ago | parent [-] | | True, it's a theory; basically a hypothesis derived from my experience with LLMs and their performance in CTFs/finding and exploiting vulnerabilities. Plausible, I believe, but I don't have any hard evidence of it happening. Maybe the effort and required hardware of running an LLM locally have so far prevented widespread exploitation? Maybe open-weight LLMs are too far behind at the moment? Maybe it's happening but we didn't notice it for some reason? I would strongly assume that it will happen at some point if it isn't already. | | |
| ▲ | dubeye an hour ago | parent [-] | | if is happening already, there would be stats to back it up. My brief 5 minutes of research suggests it is not. in my experience AI is helping me defend against potential vulnerabilities, and so the net impact of these threats is net zero or less, even if I'm quite slow in patching stuff |
|
|
|
|
| ▲ | 00deadbeef an hour ago | parent | prev | next [-] |
| PHP core developers themselves are telling people the safest option is to take their site offline. Security researchers expect mass attacks within 15 minutes of disclosure. |
| |
| ▲ | dubeye an hour ago | parent [-] | | safest option no doubt, let's see what percentage of unpatched websites are hacked today. |
|
|
| ▲ | joshuat 42 minutes ago | parent | prev | next [-] |
| The biggest question is how is your application accessible? Expect the entire ipv4 space to be crawled for this with common paths being attempted. |
|
| ▲ | nkozyra an hour ago | parent | prev | next [-] |
| You should definitely heed their advice in this case. The AI assistance you need is "rewrite this in something else" |
|
| ▲ | basilikum an hour ago | parent | prev [-] |
| It's guaranteed to happen. |
