Remix.run Logo
▲ Arbortheus 2 hours ago

I hope some of these backdoors and/or 0-days being kept under wraps by nation states or corporate espionage companies (Pegasus et al) are being found incidentally through all this.

It’s frustrating to have all these 0days and CVEs to patch for now, but in the long run perhaps we’ll leave with more robust software.

▲syshyk 2 hours ago | parent | next [-]

Hopefully we'll also see us back to KISS principles too. But who am I kidding

▲Ekaros an hour ago | parent | next [-]

What I have heard from AI it is anything but KISS... More features and more code as fast as machinelly possible.

▲aruametello 18 minutes ago | parent | next [-]

> ... More features and more code as fast as machinelly possible.

i am going to quote that a lot...

▲Imustaskforhelp 44 minutes ago | parent | prev [-]

Depends on your incentives, most people and companies are measuring Lines of codes and features as the metric so ofc it will increase it, but AI can create small KISS applications. It might have a little difficulties in doing so sometimes because it sometimes likes to overengineer things but I have to wonder how much of it is because it is RLHF'd to solve questions at any costs in terms of lines of code rather than training it in solving it in KISS principles. Also I wonder how AI will perform if we explicitly treat KISS as the only principle and have checks running on it and have it discard all the code which wouldn't follow KISS principle if it doesn't follow the principle.

▲sam_lowry_ 33 minutes ago | parent [-]

Dunno about your company, mine measures in lines of code removed.

▲stingraycharles 37 minutes ago | parent | prev | next [-]

I may be ignorant, but what do you mean with this and why is it upvoted so much?

To me KISS is basically about how you’d write the code, the architecture, which is something that - at least currently - humans need to oversee when writing new code with LLMs.

But what does it have to do with AI discovering a ton of bugs in a lot of (open-source) software?

▲boomlinde 24 minutes ago | parent | next [-]

Software that does less is easier to understand and reason about, and typically requires less code. Less opportunity for bugs to appear.

Maybe, when they build a pomodoro timer, people will consider the possibility that the entirety of a browser engine as well as 30 000 javascript dependencies from random unvetted sources introduces unnecessary complexity and a practically infinitely fractal attack surface.

▲sznio 31 minutes ago | parent | prev | next [-]

that people will finally start solving issues by simplifying the software rather than generating even more edge cases.

▲Tuna-Fish 32 minutes ago | parent | prev [-]

A lot of these bugs are in rarely exercised code paths that probably shouldn't have been written into the software in the first place.

▲isoprophlex an hour ago | parent | prev | next [-]

[dead]

▲throw938990 an hour ago | parent | prev | next [-]

Plain http 1.0 is KISS. Does not really work that well.

▲mhluongo 43 minutes ago | parent [-]

Systems should be made as simple as possible, and no simpler.

That doesn't mean every simple system solves the problems we intend for it to solve. It means that all else being equal, we should prefer parsimony.

▲bunderbunder an hour ago | parent | prev [-]

Could the global economy survive what that would do to the B2B SaaS industry?

▲hnedeotes 29 minutes ago | parent | prev | next [-]

It's interesting that no-one talks about writing new systems and base languages that don't inherit anything from the current toolchain. That's the first step, then new architectures / fully open auditable hardware basis. With html you don't need any of this dependency chain. As long as you can write a browser you can be running on anything underneath.

▲ben_w 23 minutes ago | parent [-]

At this point, a browser is a significant part of the way to being an OS virtualised inside the OS it's really running on. Complete with occasional leaks through the virtualisation to the real host OS/machine.

▲InsidiousWombat 28 minutes ago | parent | prev | next [-]

I'm more annoyed by the fact the fixes and exploits themselves are being artificially delayed in misguided attempts to coordinate disclosure, in world where anyone can just point AI at vague direction of the bug and just find it

▲nullsanity an hour ago | parent | prev | next [-]

[dead]

▲octoberfranklin an hour ago | parent | prev [-]

This is the real reason for the vulnpocalypse, not "technical debt".

NSA spent 20 years stockpiling vulns and pushing the industry towards half-assed solutions like address sanitization and pointer tagging when they could have put the industry on memory-safe languages instead.

They managed to get the IME/PSP/TrustZone into 99% of the CPUs out there by mandating it for government purchases; they could have done the same thing with memory-safe languages. But instead they chose to stockpile vulns. Hope they burn in hell for this.

▲FartyMcFarter an hour ago | parent | next [-]

Why do you think the NSA could have put the industry on memory-safe languages?

Even if they wanted to, I highly doubt they could push the industry to do that. The industry does what it wants to do, and rewriting tons of software was far from its priorities. There were no LLMs back then to help with such a massive migration.

There's also the fact that rewriting software tends to introduce a lot of new bugs.

▲lambdaone an hour ago | parent [-]

The U.S. government could have required all new software for any government-procured system to be written memory-safe languages, thus making it ubiquitous. This could have been phased in slowly with a few years of on-ramp time to allow for industry to acquire the relevant skills.

▲elcritch an hour ago | parent | next [-]

The DoD tried that with Ada and largely failed. That was with defense contractors whose primary customer mandated it. That was despite Ada being proven to work in its first projects.

▲terminalcommand an hour ago | parent | prev | next [-]

But even in memory-safe languages, compiler bugs are still an issue. The theory is perfect but the implementation is flawed. In such case once the compiler bugs are found, the software would have to be rewritten to compile. For example an 11 year old memory bug was discovered recently in the rust compiler: https://www.penligent.ai/hackinglabs/rust-borrow-checker-bug....

Memory safe languages are not a silver bullet either.

▲GTP an hour ago | parent [-]

Definitely not a silver bullet (consider also that memory management isn'the only source for vulns), but still much better than C/C++.

▲bluGill an hour ago | parent | prev | next [-]

The U.S. government had pushed Ada for years and it never worked out. The government was forced to accept C++ because industry was rebelling against ADA, even though ADA was memory safe. Well, Ada did have the ability to be memory unsafe. It was much better by default.

▲elzbardico 34 minutes ago | parent | prev [-]

The DoD have even created their own language: ADA. Massive contracts power, but different markets to incentivize.

The distance between the usual consumer/b2b tech startup and the kind of company that sells software to the air force is even bigger than the distance between Google and the kind of company who hires Accenture.

▲aa-jv an hour ago | parent | prev [-]

>IME/PSP/TrustZone into 99% of the CPUs

Yeah, about that. Its the biggest vulnerability in the industry. Nobody wants to confront this fact, though.

Too much profit to be made in subversion and human rights abuses.