Hacker News Reader

I'd feel a lot better if I knew some red team security researchers were going hard trying to break into critical national infrastructure, just to ensure it's not too easy, but probably this isn't happening because it would be a felony to even try. The bad guys are free to try though.

All this will tend to get blamed on AI, but AI didn't put these vulnerabilities into place. AI is just a tool that can be used to discover vulnerabilities, and the only question we have to answer is whether or not that tool should be available to regular people.

Some will try to frame the question as being about whether we should allow AI aid in cyber-security, but that's not the question. This technology isn't going away. The bad guys will have it. Nations will have it. Again, the question is, can regular people also continue to have it?

As someone who has helped to secure critical national infrastructure several years ago, I can say that it was a mess to disclose the vulnerabilities I identified, and in some cases it took years to patch them. Some of these vulnerabilities were RCEs and mass PII leaks. It's simply not worth the risk for most people - who aren't in the USA - to bother doing this sort of security research. However, if you are in the USA, there are provisions in the CFAA that enable good-faith security research to take place (https://www.justice.gov/archives/opa/pr/department-justice-a...), so to the best of my understanding, you're able to do good-faith research without being charged or prosecuted, and you should take advantage of this if you have the skills or models to do so. I am not based in the USA, and there are no laws in my country that guarantee me zero jail time for simply trying to do the right thing, so I am not incentivized to continue finding vulnerabilities in my country's infrastructure.

Edit: If other countries don't catch up and include similar provisions in their laws, they'll simply fall behind and put their citizens at risk. I'm sure every country has individuals willing to help that currently feel unsafe - look at the large amount of bug bounty hunters worldwide who, I'm sure, wouldn't mind practicing their skills by securing their country's infrastructure.

There was a guy in Missouri who pressed F12 (view source) and saw that the state website contained the SSN of all teacher--just right there in plain text in the HTML.

He reported it responsibly and then the governor personally started attacking him and threatening him with a felony.

I checked your link and I see that is a 2022 DoJ policy. How much peace of mind do you think a DoJ policy (not a law) from 2022 gives me?

I read as far as the first sentence: "The policy for the first time directs that good-faith security research should not be charged."

Soooo... the underlying message here is that good-faith security research is technically against the law, but their policy is not to press charges. They clearly consider good-faith security research to be technically against the law, because it wouldn't make sense to say "for the first time, our policy is to NOT charge people who follow the law"--that makes no sense. What they're saying is "we could charge good-faith security researches, but let's not as a matter of policy".

Reading further you see the policy is about NOT prosecuting people who do something like use an alias as their account name. That same paragraph says their focus should be on people who access systems without permission.

And to be clear, I am advocating for red teams that operate without permission. The bad guys are attacking our systems without permission, and I think the good guys should be protected when they do the same for a good purpose.

IIRC they were part of a base64 encoded blob. IIRC base64 decoding was also referred to as an "advanced hacking technique". But your point very much stands.

> There was a guy in Missouri who pressed F12 (view source) and saw that the state website contained the SSN of all teacher--just right there in plain text in the HTML.

Here's more detail if anyone wants it: https://www.malwarebytes.com/blog/news/2022/02/journalist-wo...

> I'd feel a lot better if I knew some red team security researchers were going hard trying to break into critical national infrastructure

Decades ago, I met someone at a conference who was red-teaming a NATO country's infrastructure: power plants, water treatment etc.

Said that things had improved dramatically since 1990s nethack days.

But the team had a secret weapon: a young woman in a short skirt with a laptop computer, pretending to be a systems software vendor. The Weapon had been able to compromise every site, had never failed. Never.

> I'd feel a lot better if I knew some red team security researchers were going hard trying to break into critical national infrastructure

They are. Most critical infrastructure providers worldwide have in house or contract red teams. Every western government has an agency dedicated to cyber defense and they all have red team programs.

I can't remember if it was the FBI or NSA or the exact details, but in the beginning of this year, they did runs a bunch of commands against compromised routers to "secure" them, which effectively would count as "hacking routers" were they not whitehackers. I think there was some huge Russian MITM campaign they disrupted by effectively hacking people's routers.

It is absolutely happening, paid by your taxpayer dollars (if you’re American).

Most major countries have this kind of programs. Those could probably be bigger and they will always miss obvious stuff but they exist, at least for CNI.

I'm sure this is happening but I also wonder if ironically those systems are hardened by adversaries. I could imagine nation state actors, once they're in, hardening the systems themselves so they can keep their presence and exclude others.

Using that access is the kind of thing that is only done when there's a need and in the case of really critical stuff that can be years in the future - or never.

One could even imagine hyper-critical exploits being shared back to the host. For instance if Russian agents got access to critical nuclear systems (or vice versa), I could imagine leadership warning the other side and getting out of the system entirely in order to maintain the status quo at the expense of pretenders.

IMHO our best hope is some benevolent grey hat or government organization unleashes a well-aligned AI botnet to patch everything it can find before the black hats do.

imagine if we just turned off 90% of the non-critical internet for two weeks, hardened up in an absolute mad dash where everyone has access to top tier cyber models, and then afterwards we go back to business as usual. it’d be a disaster short-term but long-term would it be worse than the years of slow drip we’re about to go through? idk! I kinda think it’d be interesting to find out!

Imagine if everyone had just stayed at home for a week in 2020.

It'd take more than a week, but even now, if the whole world coordinated a simultaneous quarantine, we'd eliminate covid, the flu, the common cold, and a thousand nameless respiratory cruds.

No we wouldn't, most of those viruses infect other animals as well, and would just start reinfecting humans.

We just need the squirrels to coordinate as well!

Everyone would be very difficult. You'd still need some people to make sure essential services are still functioning, and that still involves quite a large number of people.

That was my first thought as well. With COVID, we recognised that WFH was viable for white collar work. Perhaps a global 2 week cleanse will allow everyone to re-evaluate life priorities outside of the internet.

I see hope in what happened during the blackout in Spain/Portugal.

what happened there ?

Sorry about that, you can see this for reference: https://www.bbc.com/news/articles/c70zg3e5ej2o

But essentially, with the power down, people came out as a community and life went on without technology. Granted, the power came back within a day, but I have confidence that they would have found a way.

Don't you think it is odd that the BBC led with this feature, for what would have been a critical failure of infrastructure for a Western nation?

Losing electricity causes significant disruption, emergency generators have to turn on for hospitals, the transport system stops.

The BBC is not what it once was, so assume it is no better than any other outlet in wanting to create a narrative.

The actual reality on the ground for many people would have been far from the whimsical event the BBC portrays.

I was not under the impression that it was a feature. I just googled the blackout and copied the first link to provide context. Could be a Spanish blog for all I care.

Emergency blackouts are a disruption for sure and I believe people were injured in that event, but the lesson I took from it is that nothing is more reliable than community. Technology comes and goes, but we will always have each other.

I know several people who were there at the time—both Spaniards and tourists—and I've only heard positive experiences.

> emergency generators have to turn on for hospitals

So, they still have power.

> the transport system stops.

And people have to accept being where they are or find other ways of getting around.

I think they are referring to the reports of people suddenly meeting on the streets and hanging out together back then.

Nothing, I guess, and that is a good thing, I guess: the world didn't even by a day (few days?) without electricity.

Regular people are often bad guys too, you know. If the reality was "bad guys will have it. Should regular people too?" The entire core dilemma would be entirely eliminated lol.

AI is actually a big reason why there are so many vulnerabilities over the past year and a half. People don't even know what their code bases look like anymore. It's really bad so sayeth my friends doing consulting.

A lot of companies cyber security posture is asking Claude to "find all security issues make no mistakes".

That's certainly one reason, but frontier LLMs are also really good at finding existing vulnerabilities in completely human-authored codebases.

That’s not backed by data at all. We’re discovering more existing vulnerabilities.

It's both.

I would expect code written by the latest frontier models with a "find all security issues make no mistakes" pass to be more secure than average human code written in the pre-AI era (not a high bar).

A lot of people expect that. Apparently it's not working out so well in reality. My buddy who is big in this said something to the effect of, when a human codebase has human understanding it may have issues but it's strengthened by ai. When an ai codebase has little human understanding it's not strengthened by people very much. So his take was the most secure code bases he is seeing right now are human ones which use ai tools to help read and review rather then write. My guess is that's also cultural and industry specific. He is niched into businesses that actually care and usually doesn't take work from cowboy outfits.

I would expect it depends on the language. Less unchecked memcpy, more forgetting to check the user is an admin.

> I would expect code written by the latest frontier models with a "find all security issues make no mistakes" pass to be more secure than average human code written in the pre-AI era (not a high bar).

"If you write code as cleverly as you can, you are, by definition, too stupid to debug it."

Do you disagree with this? Because if you don't, then the rate of bugs/RCEs in a completely AI-written-software world will be exactly the same as the rate of bugs in a completely human-written-software world.

A combination of human-authorship + AI-review, with absolutely no AI-written code is going to have the lowest rate of bugs, because there is always one entity who understands the code (because they wrote it) and one entity who is smarter than the author who can find bugs.

The AI-generated code I see from SOTA models is absolute spaghetti, and they start running into problems spotting bugs after even a small number of refinements/changes to the software (say, 50).

The problem with all this spaghetti is that they are quick to write something that even they can't easily read. Even mediocre but experienced humans are not so eager to write something that they can't easily debug.

IOW, for any non-trivial problem, with AI-generated code you are guaranteed to get spaghetti that it cannot understand. With humans, it's only a probability that that will happen.

Well the AI machines don't have to rely on cleverness to find vulnerabilities, so maybe they're not limited by Kernighan's Law. Does throwing virtually unlimited sufficiently clever monkeys at spaghetti code find these vulnerabilities better than humans? Can you prove they can't?

At the point you starts asking to prove a negative, like "Can you prove that there's no God?", you should have the self-awareness to realise that no argument will convince you, because you are proceeding on the power of belief and belief alone.

If you don't have the self-awareness to realise that you are asking the same question as "Can you prove there's no God?", then I'm afraid no proof will ever be sufficient for you.

We're not talking about God, we're talking about a machine, here on Earth, we can poke and prod and explore and test. It's perfectly within the realm of logic to prove it can't do things. Can you prove the AI machine cannot solve the halting problem for arbitrary programs? Yes, that's a negative you can prove, so your objection about proving negatives needs qualification.

Asking you to justify a limitation you asserted doesn't mean I cannot be convinced. You're asserting Kernighan's law holds for AI, I'm saying there are other ways to debug than applications of cleverness. Does throwing more attempts at that spaghetti find vulnerabilities even when the thing that wrote it can't easily understand it? I'm not saying AI must be able to do it because you can't prove it can't. I'm asking what supports your claim that it can't.

Don't worry - Siri is on it - that's actually why they've been so lacklustre. Just too busy hacking for the good guys

Isn't this that website that keeps coming up in my web search results, apparently having a pdf of the thing I searched, except it's actually a badly html-ed version of said pdf with no way to download the original one?

Yep, absolutely no feelings for that cancer of a website.

Can we, like, also have a pinterest breach plz?

Tumblr too?

And you have to subscribe to view it, download maybe is a paid feature

Seems Scribd made the news 13 years ago for the same issue[0] [1] and an archive.org link of the original-now-deleted announcement[2]!

0 https://news.ycombinator.com/item?id=5493280 Scribd hacked – emails and hashed passwords leaked (scribd.com) 106 points by joosters on April 4, 2013 | hide | past | favorite | 65 comments

1 https://thenextweb.com/news/scribd-reveals-it-was-hacked-thi...

2 https://web.archive.org/web/20130407114005/https://support.s...

Notable callouts from 2013: "Our investigation indicates that no content, payment and sales-related data, or other information were accessed or compromised. We believe the information accessed was limited to general user information, which includes usernames, emails, and encrypted passwords."

"We take our responsibility to protect our users' data extremely seriously and constantly improve our security infrastructure and policies. Following this incident, we have implemented numerous additional safeguards. Not only have we taken steps to address the specific issues that led to this incident, but we are also conducting a comprehensive security review and are implementing more general measures to proactively enhance security. We are also alerting relevant authorities to the matter and will co-operate with their investigation."

I only received this same email a few hours ago, Oct 30. Why not tell all customers at once, especially if payment information was involved?

And they posted about a security incident on their blog on Oct 1. https://support.scribd.com/hc/en-us/articles/53787421531284-...

The email received is a rehash of the linked article, nice find.

>Why not tell all customers at once, especially if payment information was involved?

Answered in the article!

“Q: Am I affected? How will I be notified?

A: We are sending notices to affected individuals in phases, so not everyone has received theirs yet“

And also..

"Q: Where can I find the latest updates?

A: The latest updates regarding the incident will be made available on this page.“

..."Updated October 01, 2026 19:29"

For a site where you find data, they are completely devoid of any useful data on their own incident and redirecting everyone to phone calls where data cannot easily be shared.

> Q: Am I affected? How will I be notified?

> A: We are sending notices to affected individuals in phases, so not everyone has received theirs yet

That doesn't answer why they are doing it in phases.

>That doesn't answer why they are doing it in phases.

Correct!

“they are completely devoid of any useful data on their own incident and redirecting everyone to phone calls where data cannot easily be shared“

Call them up!

So if someone's got into their systems can they put a dump of all the PDFs up somewhere?

> last 4 digits of your credit card and country, credit card issuer, credit card expiry date

This particular set of beached data could stop existing if, instead of reusing a set of fixed data for payments, your bank allowed you to generate a unique code that sent a one-time (or recurring, locked to a single vendor) payment to the recipient.

> This particular set of beached data could stop existing if, instead of reusing a set of fixed data for payments, your bank allowed you to generate a unique code that sent a one-time (or recurring, locked to a single vendor) payment to the recipient.

Also known as virtual cards, discussed here [0]. At the moment, the onus is up to the cardholder and availability of the service from banks. It should be requested if your bank doesn't provide it.

0 https://news.ycombinator.com/item?id=50313747

Mixed feelings. I feel sorry for the people whose info was taken but Scribd does not have my sympathy.

This. Scribd has absolutely no goodwill here. Can't say I feel sorry for them in the slightest.

The victims, absolutely. However; the organization not one damn iota. Perhaps if they sucked less, but they do not, so I do not.

Scribd is the most predatory site that steals people's content and then doesn't honor their promise (upload a PDF to download one..oops that one doesn't qualify, but we will keep your copy!). Fuck em, they built their entire model on predatory behaviour towards broke college students, hope they burn to the ground.

Whole business model is literally based off of reselling access to other people's content. No value add. Just grift.

> Not seeing anything posted about this anywhere

Because nobody uses this cancer scam website lol.

Nice, I've been trying to hack scribd to download a pdf all day

It looks like we all enjoyed "Security through obscurity", where obscurity was referring to existing vulnerabilities.

And also, that this is over.

What actually is Scribd?

They were always just that thing that showed up in Google searches cause they scraped presentations and stuff that was unknowingly public. But I didn’t quite know why anyone found them of value.

It's a pdf archive; their idea is to scrape pdf that are public, then charge you to download when they are no longer public.

Please forgive my stupidity, but is there any particular reason why companies never seem to disclose what "system" of theirs was breached? If this breach came about as a result of a security incident at a third-party, would it not benefit everyone minus the vendor to shift the blame? I understand that they say "our systems", but I've seen companies say this before when what they mean is "a system controlled by a vendor we contracted".

My understanding is that companies tend do disclose the bare minimum they are required by law, and keep everything else to themselves.

I run a few small scale SaaS products. This is a scary time.

Indeed. :(

You’re saying sribd has actually worked for people? I just ignore it in my searches and just find the pdf elsewhere.

Yeah, in my view this is one of those sites that add negative value to the internet, by putting a paywall in front of PDFs that would otherwise be freely available. I have seen tech-illiterate people upload material there (and to its sister site slideshare) just because they didn't know better (I suppose it's what they got by Googling "upload PDF to the interwebs" or similar), and it's a pity.

Uploaders don't even get paid at all for views, it's just taking free labor and paywalling access to it, very similar to the infamous paid academic journals. But journals survive because they are an entrenched system that lives on prestige and hard-to-change academic bureaucracy. I really don't understand how Scribd, being an obvious scam and without those legacy advantages, can survive. I suppose hosting PDFs costs so little that a 0.001% of victims paying is enough to support it, but still, I don't understand why a free competitor hasn't come up to outrank it in searches and send it to oblivion where it belongs.

> I just ignore it in my searches and just find the pdf elsewhere.

In retrospect, this was the correct way to proceed.

The docs I found were content, but nothing that could be used for its original purpose. Splurging a monthly subscription to find out sucked, but being breached and getting my info stolen is a kick in the ass.

So here we are. We’re in the new era of technology. Whoever has the best agents will win. As airport security, this is an asymmetrical war: the effort to protect your systems is going to be much higher than hacking them in the future. It’s just my opinion, but I foresee this happening given the strong capability the models are showing in reverse engineering.

i'm probably going to spend next or next next weekend having an ai agent go thorugh my old accounts in 1password and have them delete 75% of them. Any surface area on the internet is risk nowadays, and cleaning up after the fact is a bigger headache.

What's great about this is that the primary thing exposed (credit card info) is also one of the least worrying things to have exposed, as a user.

You can just get a replacement credit card.

No one is safe anymore.

No one has ever been safe. I would rephrase it as: "More and more people are becoming aware of their exposure".

"Your security is important to us.

Our saying so is in no way a pledge that we are good at security or diligent about anything but billing you."

Yes, but I think it also just shows the widespread ignorance and incompetence in many companies.

I'm not saying everything can be secured easily, but a lot of those leaks recently could have been prevented easily.

Hide yo apps, hide yo websites, hide yo hosts

How long until we all get cyber-war fatigue and this isn't even news anymore.

Man, people stopped caring about all the leaks and breaches and dark web data sales over 10 years ago

Is resignation because nothing was ever fixed or done about it because it wasn't "economically viable" considered not caring?

Until the people in power start going to jail or losing their jobs, instead of just paying fines as "the cost of doing business" from the company accounts, probably nothing will be fixed

A bit.

A friend asked me the opposite: would this be the moment things get serious?

As long as people are still using glass sliders and Schlage locks to protect their actual stuff, sec will continue to be looked at as black magic, like SEO, GEO, and unironically, CEO.

U WIN @ teh internetz comments 2 nite. congrats!

I don't see any email like this in my inbox. Perhaps they are only sending this email to those who have their payment information saved on Scribd?

> I don't see any email like this in my inbox.

They stated that they're doing a staggered rollout for email notifications which states at the beginning of October with other users reporting receiving the email yesterday[0].

0 https://news.ycombinator.com/item?id=50313006

https://news.ycombinator.com/item?id=50313197

> We detected that an unauthorized third party may have gained access to certain user data in one of our systems. After investigating this activity, we found that the third party may have accessed your email address and the following of your information: last 4 digits of your credit card and country, credit card issuer, credit card expiry date.

Not a security person, but are there standards for PII encrypted at rest?

Surely this is common? Surely?

This is a common sentiment, but the security story isn’t so clear cut as that. Encrypted at rest really just means that if you yank the disk out of the server, an adversary can’t read it. But if it’s a system that is online serving a database and you gain access to the application reading from the database, encryption at rest doesn’t save you. It’s obvious the application server must be able to read the decrypted data. If an adversary breaches the application, they get the data.

>It’s obvious the application server must be able to read the decrypted data

Interestingly, that's not true. Homomorphic encryption can let you perform the same operations on encrypted data as on the plaintext, with the same results once decrypted. But it's vastly slower and less efficient - I know there are libraries like Microsoft SEAL but I've never seen anything that uses it in practice.

Let's say the application is storing user's phone number so it can send SMS notifications to the user. Encrypt it all you want, but when it is time to send the SMS you will need the phone number in plaintext so you can pass it to the SMS gateway.

Since we know that essentially nobody is using homomorphic encryption, the original point stands.

How do we even know which credit card is affected by this if we want to cancel it?

>How do we even know which credit card is affected by this if we want to cancel it?

"If you have additional questions, contact the dedicated call center at +1-877-361-9887. Hours of operation are Monday-Friday, 11:00 a.m.-11:00 p.m. Central European Time."

It's so interesting seeing all of these breaches and then going back to the old threads on Mythos and seeing the widespread skepticism and denial on HN.

Did some exploit get disclosed? HN frontpage is spammed with breaches.

Maybe the Cursor IDE compromise? It might be what got Binance. And it made a lot devs machines backdoored between Wednesday 28th Oct and whenever people decide to remove the backdoor from their machines.

The exploit is called AI (or LLMs)

I guess this is the new normal.

I'm wonder how many users are exposed

@dang, always been curious about this: why are posts like this grey text vs dark test? It's difficult to read, being so low-contrast. I assume it's based on numbers, the poster, up/downvotes etc - but it seems a poor use of those systems given it sacrifices readability. Is it just a light mode thing? Is it just me?

As far as I know this is a relic from the PG days. It was done to keep the focus on URL based submissions, and avoid people using the platform as a text/blogging platform (at the time, Reddit was rising, and self posts there were already very common.) URLs were dark, text was meant to support the URL and was lighter.

I think the color actually got lightened a few times.

(@dang doesn't work - but someone emailed this to hn@ycombinator.com)

It's nothing so sophisticated - I've just been reluctant to change things for a bunch of reasons, some perhaps better than others.

I still have the idea of letting users upload their own preferred CSS to make HN look how they prefer. Perhaps little projects like this will become more feasible as AI tools are flattening the development curve. Is this something people would consider helpful?

It’s funny but after I said it was way too low contrast, checking back after https://news.ycombinator.com/item?id=50313284 had time to marinate, I thought “oh maybe ‘fixing’ this would have unintended consequences”.

CSS upload is interesting, with benefits over userscripts. Perhaps it’d avoid feature creep compared to adding the specific option to increase text post contrast (if there are other oft-requested changes). Folks would find ways to share their CSS whether or not the settings page aided in discoverability via gallery or a search link or whatnot.

Curious if new or logged out users browsing the default site face an accessibility issue with the text contrast: that would still support making the change for all with no opt-in required. (Then your custom CSS idea could be used to get back to the legacy gray text if anyone misses it.)

Was the text light grey before you clicked the comments? Typically the link turns from almost black to light grey after you visit the site, just like a normal link will turn from blue to purple after you click the link to indicate you have visited the site. In this post for example the link goes to the 'Tell HN:' so the link goes directly to the comments. Could it be you did not pay attention until you had visited the comments once already??

It's been 22 mins since I left my comment - the original post is still light grey (that doesn't mean much, but as this post accumulates upvotes, I don't yet see any change in test color).

It’s way, way too low contrast.

Edit: “@dang” apparently doesn’t ‘work’, but emailed this to hn@ycombinator.com

I always assumed it was the down arrow affecting it, but I have always giggled at the fact that people with sharp eyes have to endure the bad posts while others do not

I think that’s true for comments but not posts.

Tell HN: Scribd Breached