Hacker News Reader

Comment by hashstring | Hacker News Reader

Except you didn’t say that. You said:

> “[…] even if nobody leaked anything, and the only thing publicly known was the existence of the bugs, people would anyway have been able to find them independently.”

I never said it’s impossible for LLMs to assist or drive VR and exploit development. It’s just utter nonsense that “knowing that a bug exists” does anything meaningful for finding it independently, unless that bug contains signal.

Which it only does if an embargo is broken, which was the case here.

View on HN

You don't see any difference between the maintainers of PHP telling the whole world, "try to find a bug in PHP in 24h", and one random guy on the internet telling another random guy on the internet to try to find a bug in Nginx, Apache or IIS? Surely making all interested security researchers with time on their hands focus on one thing with a specific deadline has no effect on the probability of finding a bug in that thing?

No, I clearly see the difference.

Yes, saying there’s a big bug increases exposure, but also makes people prepared to patch. So it’s a trade-off.

No, when there’s no info provided regarding what the bug is, then it doesn’t make finding the bug more likely for any independent researcher.

Yes, increased exposure does increase the overall likelihood. Duh.

However, all this was not the case, the point here is: someone broke the embargo, and that messed the disclosure up, and that caused this mess.

Go find another straw man to practice mental gymnastics on. I’m not your guy.

> then it doesn’t make finding the bug more likely for any independent researcher

See, I think the issue is that you misread my original comment, because this is an entirely wrong interpretation of it. Obviously I'm not saying that for any one given researcher who's already chosen to focus on PHP, that changes anything.

I suppose all your whining about strawmen and mental gymnastics is just you being unwilling to accept that (a) you misread my comment and (b) your reasoning in your reply was entirely illogical.

You know you can just stop replying if you want right? No need to tell me about it.

Hows your workout going?

Pretty good. I'm not ashamed to say that I argue because it's fun, and because I'm right (unlike you). I'm also not so desperate to have the last word that I'll post a comment entirely without substance (like you did, and probably will do again in reply to this).

Reply on news.ycombinator.com