Hacker News Reader

Comment by sjducb | Hacker News Reader

Agreed. It’s the modern security through obscurity.

Security through obscurity protects you from low effort vulnerability scanners.

It makes you more vulnerable to a sophisticated targeted attack. A competent hacker or AI will quickly find vulnerabilities in your custom libraries.

View on HN

I would like to agree too but there's a genuine new debate here, with LLMs/agents, the storm of CVEs, supply chain attacks, AI assisted social engineering, etc, some custom code doing the minimal required task might be a better security posture than picking a popular library.

I don't know were it will leave us in the long term and I don't think I'll like the answer.

> ...some custom code doing the minimal required task might be a better security posture than picking a popular library.

Only where the AI solution is verifiable by the dev doing the promoting and review. Cryptography is probably better served by libraries vetted by experts.

Cryptography is certainly a valid exception. But for how long? Two years? Three? At some point even that will fall.

If a human cannot verify it then why should it get the highest possible level of trust?

That would be like investing in things one doesn't understand for themselves.

An ironic analogy, because most people do exactly that, most of the time. How many people with money directly or indirectly invested in Alphabet or Ford actually understand those companies' financial positions? And I don't mean "has read the filings". I mean understand them to the same depth that a professional security researcher understands a cryptographic implementation.

We routinely place trust in things we cannot personally verify.

Ultimately the guarantor of cryptography code won't be humans, it will be councils and red teams comprised of other LLMs.

And that's a problem when a 2007 situation happens.

Public software is going to be attacked by many more dollars of AI time than internal stuff. In a year the library code will definitely be more secure against the next X dollars spent on cracking it.

> A competent hacker or AI will quickly find vulnerabilities in your custom libraries.

So why wouldn’t a competent AI find those vulnerabilities during development? I don’t think the proposal is to have human devs hand write the custom libraries and yolo into prod.

> So why wouldn’t a competent AI find those vulnerabilities during development?

It probably would. Except it’s internal, and not a reportable CVE, so the fix will be deferred.

Swords and shields. The advantage of the defender is that they have access to the code (usually not available to attackers). The advantage of the attacker is that they have skill and nowadays the most up-to-date models and SOPs for finding attack vectors.

Also the defender has to be right every time, the attacker just has to be right once.

(Defence in depth does mitigate this somewhat. The attacker has to be right two or three times)

You don’t think models have leveled the playing field? I do. They haven’t eliminated the attacker’s advantage, but they’ve armed non-security-experts with tools closer to what attacking security experts have.

in theory, a company running custom software should be able to invest many more hours into running those same AI with "white-box" pen-testing (assuming hyperscalers actually start allowing this). An attacker would have to be willing to outspend the company (or get very lucky). If an attacker is resourced well enough to put that investment into owning a single company, you probably don't stand much chance reguardless.

Also, the attacker would have to run black box against the live environment which is much more difficult and likely to be noticed than offline white box.

Reply on news.ycombinator.com