Thread

1. ItsMattyG · 1791054287 · focus · HN ↗

   I don't see how this will survive the attacker/defender gap as ls get increasingly good at cyber security and finding 0 days... but maybe it's an obscure enough is it doesn't matter?

   1. PorciiVorbesc · 1791054482 · focus · HN ↗

      Probably because pop_os and Cosmic are so niche and their market share so insignificant, that they're irrelevant to attackers and bad actors, when those now have much bigger fish to fry to make their time and effort worth it. See the Arch AUR attacks, for perspective.

      I think even amongst the HN and Linux userbase, pop_os is still niche, let alone amongst normies who never heard about Linux. So they can afford take the high road and treat it like their personal sandbox, accepting only human written code.

      But larger and more important projects like Fedora and Debian are more pragmatic with the fact that they'll have to accept AI written(but human reviewed) code, if they wish to keep up with the real world development and threats, as expressed by Linus Torvalds himself.

      The thing is, the cat's out of the bag on this one now, especially in the field of pen-testing and reverse-engineering. AI can brute-force its way into projects in ways that beat even experienced researchers, so your only choice to keep up is to accept the use of AI generated fixes as a counter defense.

      1. satvikpendem · 1791058103 · focus · HN ↗

         You only need one bad actor. For example, someone reading this thread could easily decide to start attacking it just because someone else said it wasn't worth it, as a personal challenge.

         1. PorciiVorbesc · 1791058764 · focus · HN ↗

            >You only need one bad actor.

            If that's your threat model then you shouldn't use any SW in exitance, FOSS or otherwise. In fact you shouldn't even go online, or even outside you own house, since one single bad actors exist everywhere. You can walk down the street and suddenly someone in a car runs you over(witnessed myself). And yet live goes on.

            1. satvikpendem · 1791058996 · focus · HN ↗

               Of course. I never said life doesn't go on or it's a worthwhile risk to care about, not sure how you got that from my comment.

               1. PorciiVorbesc · 1791059168 · focus · HN ↗

                  > not sure how you got that from my comment.

                  Because your comment didn't disprove that Cosmic DE isn't too niche for bad actors to get involved.

                  1. satvikpendem · 1791061234 · focus · HN ↗

                     It doesn't have to be niche (or not) to have bad actors. That doesn't make it likely of course but it is possible, and increasingly more so in the age of AI when you can simply point it at multiple projects in parallel.

                     1. PorciiVorbesc · 1791062524 · focus · HN ↗

                        >It doesn't have to be niche (or not) to have bad actors.

                        Then they shouldn't reject AI aids to help them patch vulns found by bad actors faster, no?

                        1. satvikpendem · 1791066091 · focus · HN ↗

                           I never said they should. I think you're reading too much into my comment, the point was something being niche doesn't prevent it from being threatened.

Unofficial Hacker News client; not affiliated with Y Combinator.