Hacker News Reader

Comment by xscott | Hacker News Reader

You could have a new web server and database too. Maybe a new one every other day created from a cronjob so you aren't a stationary target.

View on HN

I assume that was sarcastic but I think it would actually work fairly well? At least if the ends could justify paying for that many tokens.

No, I sincerely try to avoid sarcasm, and I try to remember to down vote it when I see it. It's tough to get tone across in a text forum though, so I understand the confusion.

Big picture, I think we should explore what's possible when software is disposable.

I didn't think it was sarcastic, but it's far enough outside the Overton window that I could see why someone would.

I was saying that you could just not have exploitable bugs, at least of the memory-safety variety that was on display in PHP2hell, not that you could mitigate the exploitability of the exploitable bugs you will inevitably have.

Which, probably, you will also have to do.

I suspect that a more effective mitigation to having exploitable bugs would be to have an LLM read all your HTTP requests and the actions the web server proposes to take in response and give a Jev-like approve/disapprove decision.

All good, but I suspect we're thinking about different aspects. If I understand correctly, you're pointing out that nobody is tied to legacy software any more - they can spend 37 minutes to re-implement from scratch in a safe(r) language.

My point is that everyone doing their own thing their own way means an attacker doesn't get the next thousand sites for free after finding a vulnerability in one site.

Having an LLM as sentry is a fun idea too.

Right, I agree.

Reply on news.ycombinator.com