Thread

Several vulnerabilities have been discovered in the Linux kernel

576 points · 408 comments · luispa

Fordec · 1790904069 · focus · HN ↗
This is great, more access did provide more eyes on these problems.
But, does that all of these being found now call into question, not the open source model logic itself, but the ability of human eyes to find security issues? These vulnerabilities have been sitting here for however long, but how many thousands of humans did not find them before AI?
1. SchemaLoad · 1790904218 · focus · HN ↗
  Even before AI we have known that no one is smart enough to write bug free C. And with every bug being a launch platform for a full exploit it's become a big deal.
  1. 1over137 · 1790904271 · focus · HN ↗
    No one is smart enough to write bug free in any language.
    SchemaLoad · 1790904374 · focus · HN ↗
    That's why we designed better languages that can block the compilation if memory hasn't been handled properly.
    zakisaad · 1790904655 · focus · HN ↗
    This is the reason why performant and "safe" systems languages are on the rise and being accepted into foundational areas of our operating systems (such as the kernel). When the attack defense surface is tighter (language, tooling, compiler instead of the actual code itself), the smart folks can stay at that layer, while the masses can write more code at a level of abstraction that nullifies many of these vulnerabilities by default.
    catlifeonmars · 1790905834 · focus · HN ↗
    Clearly it’s because people never got the memo: <a href="https://www.rfc-editor.org/rfc/rfc9225.html" rel="nofollow">https://www.rfc-editor.org/rfc/rfc9225.html
    wat10000 · 1790906500 · focus · HN ↗
    The difference is that C casually makes common everyday bugs into security vulnerabilities.
    marcus_holmes · 1790911333 · focus · HN ↗
    I can't find it now, but I heard that NASA developed processes to produce completely error-free code (for the moon landings iirc). The problem is that it's incredibly time consuming and expensive to do.
    Like everything in CS, apparently this is a trade-off, not an absolute. You can get bug-free code, but it's not commercially viable and is extremely tedious to do.
    kccqzy · 1790912140 · focus · HN ↗
    It’s probably about how they write the space shuttle software, and it’s quite a famous article. The original is now paywalled but there are many copies.
    <a href="https://www.eng.auburn.edu/~kchang/comp6710/readings/They%20Write%20the%20Right%20Stuff.pdf" rel="nofollow">https://www.eng.auburn.edu/~kchang/comp6710/readings/They%20...
    anal_reactor · 1790922745 · focus · HN ↗
    This is example of what I call "the tipping paradox", and I'm almost sure that this phenomenon has its own proper scientific name.
    When asked, people prefer €15 burger no tip, but when actually making a choice, they prefer €10 burger with €5 tip. Similarly, companies state "bug-free code" as a goal or requirement, but then they prioritize other goals over code correctness. My workplace is in the process of completely removing code reviews. And actually, I don't disagree with the decision - my career is short, but I have never seen reviews fulfill any purpose other than to share the blame in case of an incident.
    cindyllm · 1790923130 · focus · HN ↗
    [dead]
    brabel · 1790940119 · focus · HN ↗
    They are removing reviews or just human reviews? It’s interesting and I kind of agree to a certain point that human review is not the best way to find and fix bugs. We’ve had so many bugs in code that was fully reviewed by at least 2 humans. Ai review is clearly superior. Human reviews main purpose to me right now is to spread know of what is being worked on.
  2. 0c3ca83 · 1790906617 · focus · HN ↗
    AI makes language choice a lot less important here; it's incredibly good at finding the bugs.
    It's incredibly problematic for many reasons, but it finds bugs in C really well.
2. spoaceman7777 · 1790905183 · focus · HN ↗
  The threshold for Microsoft and Apple to actually report vulnerabilities is MUCH MUCH higher than for Linux, and open source as a whole. They generally only disclose issues in Windows and macOS that are quite serious and impactful.
  For Linux, the threshold is nearer to the point of it being questionable whether a bug is even exploitable on a real production distro, compiled and run with any sort of sane configuration.
  1. hn_submit · 1790930715 · focus · HN ↗
    Microsoft only fixes vulnerabilities which are actually being abused or remotely exploitable. Otherwise they'd never get any work done.
3. NoPicklez · 1790915967 · focus · HN ↗
  Some vulnerabilities are incredibly complex and are identified not through the code itself but through various attack chains being strung together.
  Also there are likely a lot of vulnerabilities identified but the work required to fix them vs the complexity to exploit them means they don't get fixed.
  I'd wager we don't have an issue with identifying vulnerabilities but the ability to fix them.
  I work in security consulting and identifying vulnerabilities isn't the difficult part its actually fixing them and fixing the ones that have valid exploitable attack chains that matter

Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.