It's going to be a rough decade.

I really don't know how we are going to deal with accelerated exploit generation via LLMs — it blows up the disclosure processes we've evolved.

The only thing I can think of is hunkering down with static HTML to reduce attack surface, but that's laughably incompatible with many many business requirements.

▲

faizshah 34 minutes ago | parent | next [-]

In new software I write these days I limit the number of external dependencies and mostly vibe code anything I need besides the most critical foundational libraries (increasingly I am replacing these as well).

I think this, the supply chain attacks and binary reverse engineering will cause us to go back to thin clients, html over the wire and vibe coded libs instead of external open source deps.

	▲	rectang 5 minutes ago \| parent \| next [-]
		Vibe coding deps is security through obscurity, with all of its weaknesses (and strengths). It's not that such deps have fewer security bugs than the open source reference implementations from which they are derived, it's just that those bugs are currently less discoverable. In the near to medium term, the current open source regime has issues because bugs have become extremely discoverable and easy to exploit. But I am skeptical that obscurity will provide vibe coded deps sufficient protection over the long term. As soon as the source code for those vibe-coded deps leaks, you are screwed.
	▲	jacquesm 9 minutes ago \| parent \| prev [-]
		Limiting the number of dependencies is always good, within reason. Especially with eco-systems that want to pull in everything and the kitchen sink. That's just asking for a supply chain attack. I try to limit myself to what well reputed distros provide and what I can review. That's still no guarantee but it cuts down the risk substantially.

▲

jacquesm 2 hours ago | parent | prev | next [-]

I think it will kill open source to some degree. I found it already very hard to imagine how the endless queues of issues were being dealt with so diligently, but at least there was a human on the other side. The torrent that is unleashed now is not manageable on a human scale. It's a highly automated arms race with a bunch of good-willing humans caught in the crossfire between large companies and criminals duking it out.

▲

rectang 2 hours ago | parent [-]

Could open source activity transition towards provably correct software, with far more modest feature sets?

I don't have experience with proof based tools, so I'm not sure what's feasible.

▲

jacquesm an hour ago | parent [-]

A lot of people in the open source world actually enjoy the act of programming. Not all of them will enjoy prompting to the same degree, but to keep pace with the bad guys you will have to either join or find something else to do. That's going to be a big loss.

▲

rectang an hour ago | parent [-]

It's funny, that's true although I personally can't relate — I enjoy having built something robust, but the act of building isn't something I love.

I can imagine prompting an LLM to build provably correct software. Aren't we already doing something similar already when we remind it to write unit tests and account for all edge cases?

Actually writing provably correct software from scratch sounds terribly tedious, which is why I've never explored it. But maybe an LLM could make that task more approachable.

▲

jacquesm an hour ago | parent [-]

I switch between the two modes. I love algorithmic stuff and I really don't like working on boilerplate and plumbing. So I use AI for the second and read every line and all the other stuff I roll by hand. The speedup isn't super like that but the amount of control is pretty good.

▲

rectang 16 minutes ago | parent [-]

I just gave this prompt to duck.ai (5.6 Terra under the hood): "How would one go about writing a provably correct algorithm to count UTF-8 code points?"

It gave me something which looked pretty legit. Of course, the generated output very likely to be subtly wrong, but as starting input to a formal checked specification/proof process it seemed like a good start.

I wrote some UTF-8 based string handling software back in the day. It doesn't seem unreasonable to write up a set of requirements and edge cases and then have a formal mechanism prove correctness for common UTF-8 string manipulation operations.

[PEAK HN ON] Now if we could just write provably correct exception handling, we could solve one of the two PHP vulns from today. [PEAK HN OFF]

	▲	jacquesm 11 minutes ago \| parent [-]
		UTF8 is one nasty little standard. So many edge cases. I should check it against my email address validator that would be a nice benchmark. It's interesting that there are people that are using email addresses that are not actually valid according to the standard.

▲

aaron_m04 2 hours ago | parent | prev [-]

Business requirements will have to change. All your competitors are under the same pressure with the same shitty set of options, after all.

	▲	jacquesm an hour ago \| parent [-]
		That would have to start with businesses shelling out more funds for the packages that their businesses depend on.

▲

kilroy123 an hour ago | parent | prev | next [-]

It already _is_ a rough decade. I have hated the 20s so damn much.

▲

cortesoft 2 hours ago | parent | prev | next [-]

It feels like the only solution is going to be proactively running your own AI agents looking for patches and applying them.

▲

rectang 2 hours ago | parent | next [-]

The issue is where to direct the LLM's attention.

Prompting the LLM to "look for vulnerabilities in PHP's multipart upload handling code" is going to find stuff that "look for vulnerabilities in PHP" won't.

	▲	cortesoft 24 minutes ago \| parent [-]
		I was more talking about staying up on security issues with your stack after they are patched. We will need to check for security updates constantly, or risk being exploited in the gap between a security release and you finding out that you need to update your software.

▲

cyberpunk 2 hours ago | parent | prev | next [-]

Or, you know, use client certificates so the bots can’t hit you.

Those can leak / be stolen of course, but a bunch of my clients php apis survived as without a cert they’re told to fuck right off.

It does make their client onboarding a bit harder but it’s a trade off which seems to have been the right one.

	▲	cortesoft 23 minutes ago \| parent [-]
		This doesn’t help you if you need to run a public website.

▲

jacquesm 2 hours ago | parent | prev [-]

Yes, so who will pay for that? Open source so far meant you would use your brains and your creativity, now you need to use your money too if you want to keep pace. From a 'guts, credits & glory' proposition to 'slop processor if you can afford it' is not really an upgrade.

▲

throwaway613746 2 hours ago | parent | prev [-]

[dead]