Hacker News Reader

Comment by richardw | Hacker News Reader

That’s like blaming white hat security researchers that want to be paid for finding vulnerabilities, for all the bugs that have been found. Before professional security researchers existed, far fewer vulns were found.

The vulnerabilities exist and many have for decades. Find them or leave them for someone more dangerous, just don’t shoot the messengers.

Personally I’d rather we went through a short and sharp improvement and embedded a faster response cycle, than wish it away. It’s the reality of the situation; so adapt.

View on HN

I’d like to dialogue/debate you on a video call if you’re interested. I don’t think I agree with you but you’re thoughtful and I may have something to learn. Let me know if you’re interested

As a person I’d definitely be keen to chat and debate, to tease out the right answer. Right now work life is insane and there’s no time :) I like your attitude and we’d probably be friends somewhere.

If I see a gap I’ll shout. Timezone? I’m in Sydney, Australia.

If we could see where each HN user is from I think Australia would be highest on kindness :) I am not Aussie myself but I adopted Australia as my second home (want to move back but not possible right now).

Not sure what is there to debate about. The vulns were there, that is a fact. There’s nonzero chance NSA, Mossad, FSB, PLA, MSS, RGB, MI6 etc. knew about some of them and used them for more or less nefarious things which you don’t want to be on the other side of. Normal criminals stealing stuff for money as a matter of course is not great obviously, but IMHO much better than the alternative.

Then don’t debate. I feel openAI is behaving unreasonably and communicating dishonestly: they create a problem by flooding the world with ai agents that can automate exploit discovery with less safety mechanisms than are available and likely reasonable given the potential harms. If the lab leaders were personally liable for harm they would probably consider restricting tool calls to validated users, log tool calls and access so user activity could be attributed, limit tool calls to whitelisted services, require consent before accessing services, offer liability protection to customers or third parties harmed by their tools. Before anyone says they are too restrictive the fact that options exist and the labs themselves are saying the risk is up to and includes billions of damages and human extinction maybe the responsible action would be start with more restrictions and slowly expand as safety is demonstrated.

> That’s like blaming white hat security researchers that want to be paid for finding vulnerabilities, for all the bugs that have been found.

Last I checked, white hat security researchers weren't making their livings selling superhuman hacking tools to unknown entities as part of ~$1T businesses desperate to offload their shares onto the public before a potential bubble pop.

If you want to argue what they're doing is fine regardless, be my guest, but using this comparison as the justification is a little ridiculous.

You’re missing the point. The white hat researchers in your example would need to also be the black hat hackers selling the tools to do the exploit in the first place. There is a conflict of interest when you create the problem and then solve it. I don’t think anyone would tolerate a white hat security team releasing the exploit publicly so they could sell more services rather than taking it to the affected company to patch.

re: missing the point

AI did not inject the bugs into PHP as far as i know?

No. But that’s not the issue, the existence of exploits is distinct from making it easier to find them. And that’s what the labs have done. They have made finding the exploits exponentially easier and available to billions of people now and released the tools in a flippant manner. So for them to then present themselves as the solution to the problem they introduced it is at best tone deaf marketing posturing and possibly equivalent to mafia protection racket tactics: nice store you have it would be a shame if something were to happen to it pay me and I’ll protect it (from my own actions).

Reply on news.ycombinator.com