I genuinely would like to know your opinion on what the next steps would be then? If every single exploit was available tomorrow accompanied by a working exploit to operationalize it, or combine it in a chain to compromise any software that has such a vulnerability, would you post it on the internet?

▲

tptacek 2 hours ago | parent | next [-]

You're asking if I support full open disclosure? I spent most of my career as a vulnerability researcher. I believe in disclosure.

▲

wand3r 41 minutes ago | parent [-]

I know you a bit by reputation so that was my assumption. I assume you mean responsible disclosure? I thought your statement was implying otherwise, maybe the unsaid implication was against the "extortion" argument?

In any case, what I want to say is this: All technology has tradeoffs but this has shown we are locked in a game theory mechanic not dissimilar to extortion AND the security implications are part of that.

- We have to build AI or someone else will.

- You need our tools to protect yourself from our tools or similar ones

- You need to use AI or someone using AI will take your job.

Many examples but it is very "i created the disease to sell you the cure". If this were any other technology, we would expect more reasonable mitigations, extraneous factors like software bugs existing aside. It speaks to a fundamental lack of control on the part of the labs that we take for granted: they simply don't have control of the PRODUCT, much less how it is even used.

▲

tptacek 38 minutes ago | parent [-]

Absolutely not. "Responsible disclosure" is a coercive Orwellian term coined by vendors, most importantly Microsoft, in the early aughts in order to set a norm that vulnerability researchers should work on vendor timelines and with vendor disclosure constraints.

Finding vulnerabilities that already exist in code can't be "creating the disease", for obvious reasons.

	▲	wand3r 17 minutes ago \| parent [-]
		Ok. I was sympathetic to that historically for all the reasons you stated. If you put the effort in, why are you constrained. I think we are in a different world now. So what would you do in my thought experiment? You are the QA head and the new model could literally find and exploit ANY bug? Would you release the model? Genuinely curious. Its not totally science fiction. I think there is a difference in a couple smart people punishing 1 sloppy company that underinvested in security. The internet is a stack of protocols, hardware, infrastructure, applications etc. It could be the case that almost everyone has capabilities on par with yours. Great you say, security will improve! However, there will be a meltdown in the middle where potentially digital currency is exploited, exchanges, banks, utilities. It isn't just a team working for 3 months, finding some issues in a company. Or is this way overblown?

▲

ericst an hour ago | parent | prev [-]

I cannot help to think that the idea of go fast and break things had something to do with the current state of affairs. I would say that the next step should be slow and consolidate, but it seems like we are not heading in that direction.

At this point I don't know what will be worse for the global economy the AI Bubble bursting, or the gigantic crash all this vulns might bring if they force the stop because we went too far and everything came crumbling down...