That makes me think LLM impacts human researchers' rewards, but now I realized the result might actually go in the opposite direction according to Jevons paradox. People still need experienced and professional human security researchers after all.

- Independent security companies are scanning the packages (be careful if the project is depending on some no-so-popular packages)

- Maintainers react promptly (it would be nonsense if people need to cooldown for 21 days because people may have 21-day vacations)

Shall have thought about that... but I'm playing too many Unity games recently.

> But if it turns out they can’t serve as the cooldown vanguard, then we have great evidence that they shouldn’t be trusted at all.

If they cannot serve as the cooldown vanguard, we are indeed going to realize they are not trustable, but by the time the damage has already been done. Therefore, if companies want to prevent the damage as much as possible, I believe they should do the scan by themselves.

This post is based on an assumption from what I see (I would be very happy if it's wrong) that most companies do not event bother to do these scans. They are merely waiting for the free kindness.

There are COBOL users and CentOS 6 users. They aren't affected by this issue.

They might need to face another set of issues like vulnerability backporting and so on. People not worrying about cooldowns might still need to patch their log4j libraries, but that's another thing. This post is not for them.

> There are always early adopters and researchers looking at new, publicly available software.

I agree with that. These hacks are very unlikely to go unnoticed, especially for popular packages (although they do happen; `chalk` has 3M downloads per week when it was hacked).

> The observation that "if everyone in production has a cooldown, the benefit is gone" is an absolutist opinion.

Yes. However, I think this is eventually becoming some type of pointless arms race, as cooldown does not act actively towards reducing ecosystem attacks.

To add a somehow random example, pnpm's default cooldown time is 1 day. Yarn's 7 days. I'm not sure whether one day pnpm would also change it to 7 days because of people asking.

> Run LLM-assisted audit on vendored code.

Comments URL: https://news.ycombinator.com/item?id=48993885

Points: 44

# Comments: 75

Sir, what do you mean by "Sadly"? I know your write-ups are mostly for marketing, but please don't expose your malicious intent so early.

Shells are not needed once they are not in needed. Code does not: customer need is always there.

Before forgotting how to code, The West will first get round up by their own Monsanto, voluntarily.

These providers are the only ones that care about their reputation and thus may take some action. Investors? Nope.

Haven't seen a specific one but I guess the most relavant public discussion on root CA-led device bricking issues might have occurred around the time when DST Root CA X3 (naturally) expired - that's around September '24: https://letsencrypt.org/2023/07/10/cross-sign-expiration.htm...

I personally believe most issues blocking old device reuse can be solved by manufacturers returning the root permission back to users, so that users can install modded systems with up-to-date stuffs. However, it's a pity that manufacturers aren't willing to do it, as it hurts their interest on selling new devices. Will laws on "right to repair" work? Time will tell.

Comments URL: https://news.ycombinator.com/item?id=47024169

Points: 15

# Comments: 2