Comment by RagingCactus | Hacker News Reader

Comment by RagingCactus | Hacker News Reader

Parent Full thread

Thank you for consistently being a source of reason in these types of posts. I come here often to look how the wider software community feels about security, and to see if people understand how dire the entire software security situation is.

And I'm usually unpleasantly surprised, but I can deal with it, I know most developers don't have the knowledge to deeply understand if something is really really bad or just a small problem. But now I'm finally at a point where I wonder if people will ever understand. We have critical vulnerabilities in widely used software coming out every other day, we get exploits for (on a technical level) very hard to exploit vulnerabilities in record speed, and yet non-security people still spout "full weaponized PoC or it isn't real" like it's 1999 (not that I was old enough to know that was happening at the time).

I don't understand why nobody believes that security people might know a thing or two. Is it just that it's so much more convenient to close your eyes and pretend that nothing is wrong? I wonder what needs to happen to allow us all to finally have a conversation about how we can make sure that the software that runs all aspects of our life gets more secure.

It feels like the problem in this specific case is that the security people have a link to OpenAI, who have a financial interest in this being as big as possible.

PHP were right to make the warning so strict, and people were right to take sites down in precaution. It certainly could have been horrific.

However, OpenAI makes it a boy who cried wolf situation and I've no idea if "we expect to see exploits 15 minutes after the patch is launched" was a genuine concern that thankfully doesn't seem to have happened or them trying to over-state the ability of their models.

Your point is valid about how we need to be more concerned about this stuff, but I just wish it wasn't being played for bragging rights by AI guys. I mean, they had an official php2shell website ready-to-go for the patch launch party, which doesn't help it not look like a PR exercise.

Dan Guido was on HN just last night talking about their full-exploit POC. Dan Guido has nothing, so far as I understand, to do with OpenAI. He's not going to share his POC with you, and everybody in this field who matters agrees his team doesn't make stuff like this up.

I didn't say it was made up (hence my comment that the reaction to it's potential was right), I said that OpenAI have used it as a marketing opportunity and muddied the waters in doing so, due to being a historically untrustworthy company who use scaremongering as a marketing technique.

There is a wolf in the boy who cried wolf.

How is this helpful? What matters is whether or not there's a wolf.

The post I was replying to was questioning why people are showing doubt here and I was offering up a theory in this specific case. It's not supposed to be helpful or combative, just a thought. I agree with most of what that post is saying tbh.

Mixing security with PR just does not seem a good idea, and a worrying precedent.

PHP handled it correctly, and I trust them. I don't feel the same about OpenAI.

You can have more than one conversation in a thread, and not everything has to be black-or-white!

The company Dan Guido owns (Trail of Bits) actually partnered with OpenAI for Patch the Planet and dedicated their "entire security research organization " towards the initiative, they are also in talks with OpenAI for an acquisition:

https://openai.com/index/patch-the-planet/ https://www.theinformation.com/articles/openai-early-talks-b...

First of all, thank you for carefully making your point and not conflating your criticism on the communication with questioning the seriousness of the technical issue.

I personally also found the level of marketing noise on some of the websites distasteful for an extremely serious vulnerability of this caliber. I agree that probably didn't help with credibility for readers without any security knowledge.

That being said, the writeups and demos published on these sites made it very clear to anyone with basic knowledge about how things like UAFs get exploited (and I mean basic, I couldn't write a working exploit for something like this myself!) that this is a very serious issue. The presented facts lined up with the claimed impact, unlike the many hallucinated slop repos that appeared before the public disclosure. My issue is that for some reason non-security people often don't believe the security people in cases like these, and I don't quite understand why that is such a consistent issue. And besides, as you already mentioned, it wasn't just OpenAI, Wiz, Calif saying that this was bad, the PHP people said the same. They certainly had no interest in blowing this out of proportion.

I also personally think the concerns about 15 minute exploits were genuine and warranted. Maybe the chance for that wasn't overwhelming, but I believe it was there. The bigger issue, however, comes from the ability of adapting an exploit to other builds once one exists. Another comment on this post asserts this vulnerability "will never be a one-size-fits-all-PWN-button". And historically this has been somewhat true for binary exploitation (depending on your threat model). But the problem is, even if public LLMs can't quite consistently one-shot a full pwn exploit in 15 minutes, they absolutely can very easily adapt an existing exploit to other target versions and builds.

This isn't about anyone saying it's not a security issue and it shouldn't be patched, but do you honestly believe that the amount of danger so great that it caused government websites to pre-emptively shut down in anticipation of the patch was worth it?

Because that is the criticism here.

And so far, even after the patch is out, it has been impossible for the public to confirm what sort of configurations actually would have been and would not have been vulnerable.

IMHO that is fair criticism.

Reply on news.ycombinator.com