Hacker News Reader

Comment by Guillaume86 | Hacker News Reader

I would like to agree too but there's a genuine new debate here, with LLMs/agents, the storm of CVEs, supply chain attacks, AI assisted social engineering, etc, some custom code doing the minimal required task might be a better security posture than picking a popular library.

I don't know were it will leave us in the long term and I don't think I'll like the answer.

View on HN

Public software is going to be attacked by many more dollars of AI time than internal stuff. In a year the library code will definitely be more secure against the next X dollars spent on cracking it.

> ...some custom code doing the minimal required task might be a better security posture than picking a popular library.

Only where the AI solution is verifiable by the dev doing the promoting and review. Cryptography is probably better served by libraries vetted by experts.

Cryptography is certainly a valid exception. But for how long? Two years? Three? At some point even that will fall.

If a human cannot verify it then why should it get the highest possible level of trust?

That would be like investing in things one doesn't understand for themselves.

An ironic analogy, because most people do exactly that, most of the time. How many people with money directly or indirectly invested in Alphabet or Ford actually understand those companies' financial positions? And I don't mean "has read the filings". I mean understand them to the same depth that a professional security researcher understands a cryptographic implementation.

We routinely place trust in things we cannot personally verify.

Ultimately the guarantor of cryptography code won't be humans, it will be councils and red teams comprised of other LLMs.

And that's a problem when a 2007 situation happens.

Reply on news.ycombinator.com