Hacker News Reader

Comment by justicz | Hacker News Reader

I found this! I posted a semi-click-bait-ey tweet about it here [0], I think it’s important for people know how easy these bugs are to find now. It’s becoming borderline irresponsible not to audit your internet-facing code with modern AI tools.

[0] https://x.com/just1cz/status/2118009777922228361

View on HN

Looks like you also found a similarly critical apt bug in 2019: https://lists.debian.org/debian-security-announce/2019/msg00...

Do you think there might be even more still lurking out there?

And what is your take on HTTPS for apt? I assume the MitM scenario for this and the previous bug could have been avoided by the use of HTTPS by default?

I do. I think that security-critical but overly complex software like this should be rewritten and certain aspects of it formally verified, since such things are now practical.

HTTPS would have mitigated this particular bug but it feels like rearranging deck chairs on the titanic to fight over that right now. We need to audit everything with powerful AI like, yesterday.

I'm sure Debian was invited to take part in Project Glasswing back at the beginning of this year.

I wonder if all the people who laughed off Anthropic's sensationalistic claims about Mythos as marketing fluff have recanted, or if they're too busy patching, or maybe they're stochastically parroting Ed Zitron's latest blather.

Nice work! A similar vulnerability in 2019 also found by you included the recommendation to update with:

  apt -o Acquire::http::AllowRedirect=false update
  apt -o Acquire::http::AllowRedirect=false upgrade

Since this also involves redirects, would that protect users while updating apt for this one also?

That sounds right to me, but FYI the APT maintainers themselves are recommending Acquire::Retries=0 as the mitigation since some mirrors might actually have redirects.

I saw the ubuntu announcement also defers to the `apt upgrade -o Acquire::Retries=0` recommendation

https://ubuntu.com/blog/apt-vulnerability-fixes-available

https://xnotme.com/just1cz/status/2118009777922228361

This is also a reason why I'm trusting less and less the companies that strongly push against AI. Especially for SaaS type of businesses, AI red teaming is now a critical part of development process.

Speaking of which… if any of y’all work on security at OpenAI I have some questions for you about Daybreak! Please email me

Every security engineer with access to Daybreak (Red or Blue) has a direct communication channel to OpenAI through an assigned Account Executive, or at least your employer does. If you are independent and authorized to use the model, your best option is to email/chat via the support page. The two Account Executives assigned to us are good people but not very technical, so I hope you have better luck with yours.

Reply on news.ycombinator.com