Just the rumour of a bug is enough to find an exploit these days

180 pointsposted 5 hours ago
by avsm
(anil.recoil.org)

58 Comments

nickcw

5 hours ago

This describes my life as an open source maintainer at the moment!

In the first 10 years of the rclone project we received about 20 security disclosures through GitHub. We had to deal with over 40 in the last month! That has taken a huge amount of my time, even using AI tools to triage and come up with fixes for review.

The hit rate for those security disclosures is pretty good - about 75% of them have a nugget of something which needs looking at. The configurations for rclone have got increasingly unlikely so I'm hoping they will dry up eventually.

I was considering just merging the fixes straight to master just to make my life easier rather than holding a dozen independent security fixes on branches and merging them at the point release and hoping not to have too many conflicts to fix up. I've decided to stick with the process for the moment.

GitHub assigns CVEs for the advisories. Before the AI apocalypse they took 2-3 days for an assignment but now it they are running at 3-4 weeks so I have to send the point releases out with CVE-PENDING in the changelog which isn't ideal.

Not sure what the solution is, but it is definitely a problem for us.

dannyw

4 hours ago

Thank you for making and maintaining rclone. It is truly a blessing.

ftchd

2 hours ago

> I was considering just merging the fixes straight to master just to make my life easier

I felt that. The problem with doing that is you hate yourself afterwards so not a good solution either, gotta do it properly.

Thanks for working on rclone, Nick!

Groxx

24 minutes ago

You can add CVE info later in a git note, if you want something git-managed to point to it. Might take some habit-tweaking to include notes in log output though, to see them later.

x______________

2 hours ago

> Not sure what the solution is

Possibly some sort of ai agent code review system that churns through code looking for these vulns before the code is published. It feels like it's all about who has the resources to find bugs at the moment but that it should be a standard to catch issues before prod moving forward..

pixl97

2 hours ago

Yea, AI bug finding over entire projects, at least on SOTA models is super expensive, hence those with the resources setup to find the most bugs in an automated way.

That said there are a number of people and companies working on more focused means of driving the LLM to look were bugs would be the most dangerous and in doing so reduce the token spend of each bug found.

In some ways the better you are at security stuff the more you can reduce your spend by better driving the LLM to problem spots.

Kubuxu

5 hours ago

As long as you are not running a paid bounty program. Otherwise now you are getting 40 per day.

yjftsjthsd-h

3 hours ago

> GitHub assigns CVEs for the advisories. Before the AI apocalypse they took 2-3 days for an assignment but now it they are running at 3-4 weeks so I have to send the point releases out with CVE-PENDING in the changelog which isn't ideal.

A strange bottleneck; anyone know why that would be so slow?

htrp

3 hours ago

human triage in review

caminanteblanco

4 hours ago

Thank you so much for maintaining rclone! That project is literally the only thing that makes Google Drive an acceptable experience on Linux.

cyanydeez

4 hours ago

I feel like someone somewhere is working on an opensource GPU compute resource pool you guys could pull from as part of a donation type framework. I got a bunch of local gpu resources just relaxing, and if I could load up a a binary to provide compute for X hours a day overnight or whatever, that'd be cool.

gazarsgo

3 hours ago

http://github.com/buzz/block is quickly becoming a reasonable approach to shared agent compute, though it's still a bit more hands-on than the older 'compute donation' projects like SETI or Folding@Home.

nickcw

2 hours ago

I got a 6 month free subscription of Claude Code Max under Anthropic's open source program which has been very helpful.

zmgsabst

5 hours ago

I can’t comment on if it applies to your workflow, but one process I’ve used is to aggregate and land ~10 security patches at a time. Eg,

- grab a group of (related) bugs/defects/vulns

- fix them on a branch like bug-batch-XXX

- run that group through the verification, landing in main, CI/CD flow to amortize process cost

- repeat as needed to process backlog

My experience is that process often has irreducible time (eg, two days due to reviews by various parties); but that time slot can be shared between several bugs in a single PR — especially if you have several related to the same feature.

dataviz1000

4 hours ago

> even using AI tools to triage

Can you discuss this? I might be able to help.

godelski

5 hours ago

It's easier to find bugs, fix them, yet there's less will than ever. My bosses just want speed and will give me a 30 minute lecture on why I don't need to solve a bug that Claude solved in 5 minutes, I've verified, and it's already in an open PR. All the while we're pushing out bugs faster and faster.

No matter how good AI gets at fixing bugs we'll never fix them when there's no will to fix things. Software will never be good if there's no will to make good software. The problem has always been about will. To many better products. It's insane that in a time where we can do better on speed and quality we still choose speed and tell ourselves it's velocity

elmer2

2 hours ago

Something that might come out of all of this is that companies that previously slow rolled security fixes will now be forced to fix them quickly, because the speed of AI and the liability of being insecure.

pixl97

2 hours ago

Yea, when their cyber insurance policies start biting them because AI found a bug months ago and it was never fixed I figure we'll start seeing a change.

With that said there are numerous companies that are very concerned about the situation. They know AI is finding bugs in their software at an accelerated rate, one they are having difficult times keeping up with because they want human understanding and review of the fixes to avoid introducing new bugs.

godelski

33 minutes ago

Did CrowdStrike actually suffer? That was a huge outage and their stock is today at an all time high. Seems like no one actually cares. Neither the companies providing the software, the companies purchasing the software, nor the markets.

To me, this is the craziest part about all of it. Why doesn't anyone seem to care?

illiac786

2 hours ago

Depends on the jurisdiction. Where I live, companies are not liable for insecure software, if sold to a private person for example. Enter huge botnets of crappy home routers. Hopefully this is going to change.

ryandrake

4 hours ago

Most places I've worked have been infuriatingly uninterested in fixing bugs, and would release software with major known bugs and a vague plan to fix them later. Of course, when "later" came, there were more features to cram. No time to fix those bugs.

I'm hoping one of the unintended side effect of it being essentially free to find and exploit (and fix) software bugs is that companies become less cavalier about shipping bugs in their software. Unlike most of the industry I don't believe "bugs are inevitable." Bugs are a choice developers make when they're rushing and careless and when all of their incentives are to ship quickly. You can ship bug-free software but it takes (or used to take) a really long time and a lot of care, care that commercial software developers just don't ever seem to muster.

Maybe when their software is getting 0wned over and over and 30 security issues are published a day, they'll start caring and taking their time.

vasco

5 hours ago

If your boss asks for X feature and you split it into 4 PRs, 3 that implement X and a 4th that fixes a security bug, how would they know? Someone that uses those 30mins like that isn't reviewing your PRs themselves. Just fix it and be done with it. You only needed to argue with the boss when you needed to make time for it which would delay something else. If it just appears done they'll just react with clap emoji later when you announced you also fixed this extra thing.

supriyo-biswas

4 hours ago

You haven't worked at conservative software shops I guess. The last place I worked at had this huge song and dance with you trying to raise a PR that looked irrelevant to the task at hand would lead to meeting with your lead dev, your manager and your skip level as you tried to explain why the bug needs fixing...

The worst one was where I fixed a datetime bug and although it had been sending out false alerts, I was asked to dry run the 5 lines of code I changed, like a coding interview. In all this pressure I forgot what the code was meant to do, and was dismissed and asked to set up another meeting with an explanation of all the various cases that could happen...

talon8635

13 minutes ago

But, isn’t it our job to impress upon the managers the importance, in a certain regard?

Alternatively, what about just doing the right thing? Either you convince them to take this stuff seriously or you find alternate employment. How can you subject yourself to the moral degradation and conflict of principles? I could understand for someone with no other financial options, or in some sort of oppressive culture/economy. But most in our field probably don’t fall into those

godelski

2 hours ago

Let's spend $5m to have a meeting about why we can't spend $50.

Penny wise, pound foolish

The best is the explanations are in the PRs. They even have Claude these days to answer their questions... I swear, these people are more addicted to spending money than they are about making money.

tough

4 hours ago

holy shit that sounds like a nightmar-ish work environment

godelski

2 hours ago

That's mostly how I'm shifting to doing things but let's admit, this is metric hacking. And let's also admit, it takes longer to go through that song and dance than it actually takes to do the work.

yieldcrv

5 hours ago

My boss is a big yapper too

Very low signal information, preemptively trying to cover every rebuttal despite nobody ever planning on making one, in the few times someone does he plays devils advocate endlessly

Like bro just let us babysit these agents, everything’s going to happen

johnbarron

5 hours ago

You will see, they will change both laws and expectations, to say its normal for software to always have terrible bugs. You can always solve a problem by lowering your expectations. :-)

godelski

2 hours ago

No laws are needed. We already have oligopolies. Don't like the buggy software? Go to the only other competitor who also has buggy software.

FFS, we're living in a world where Linux has more than doubled in popularity mainly due to Microsoft actively fleecing their customers. It's crazy

/I use arch btw (and have been on it for over a decade)

flanked-evergl

5 hours ago

What law says software may not have bugs?!

odo1242

4 hours ago

Not explicitly laws, but like contracts, regulatory requirements, SLAs all indirectly enforce that

swiftcoder

2 hours ago

Well, they at least say that one is obligated to address bugs in a timely manner (where "not widely exploitable; won't fix" is a perfectly valid resolution).

novia

4 hours ago

!!! You described my experience in the workforce to a t! So frustrating that tech managers look at tech debt as a thing to be maintained at a certain level instead of allowing us to achieve perfection

godelski

2 hours ago

  > tech managers look at tech debt as a thing to be maintained at a certain level
What they don't seem to understand is all debts have interest. In my current project our entire team is tripping over that interest created by one person. Though my manager is frustrated with me because I'm "spending too much time trying to understand". Btw, that is a few hours here and there, maybe a day for a rabbit hole which results in me creating a dozen or more issues. How is that "slow"?

  > allowing us to achieve perfection
Impossible

Look, I'll defend high quality code all day long. Good code allows you to move fast just like taking 30s to tie your shoe laces allows you to run faster.

But we can't write high quality if we pretend that perfection exists. Globally optional solutions are the exception, not the norm. There's almost always tradeoffs we need to make. The high quality code, the high quality engineering, is understating, tracking, triaging, and minimizing those tradeoffs. It is writing code that allows you to change those decisions as quick and effectively as possible. But perfection doesn't exist. It's a good thing to chase, like Utopia, but ultimately unobtainable. A good engineer knows how to triage.

Advocating for perfect code will be a losing battle. But we should not, even for a second, let that be interpreted as meaning quality doesn't matter. I'm still frustrated with people who say "don't let perfection be the enemy of good enough" as most of the people that say that believe "good enough" is "it looks like it is working" and call a "demo" a MVP

evilduck

2 hours ago

Your tech manager is likely very aware of the imperfections and is making prioritizations and compromises to keep you employed.

VladVladikoff

2 hours ago

Perfection is the enemy of progress. There will always be a balancing act.

bonsai_bar

3 hours ago

That's exactly what managers should be doing.

tokioyoyo

3 hours ago

> instead of allowing us to achieve perfection

Huh?

rndhouse

15 minutes ago

I built a tool that monitors commits and tries to detect silent bug fixes. With GPT-5.5-class models, it can identify fixes hidden within otherwise routine commits quite reliably. Obfuscating the code changes enough to avoid detection is difficult.

I have heard of at least one project (c-lightning?) temporarily releasing a closed-source binary as a workaround until users could update safely.

bri3d

5 hours ago

I don't think this is new with LLMs (finding an exploit based on a few words offhand has always been a fun part of exploit development), but it's scaled and democratized to mass exploitation of low value targets. Backing exploit PoCs out of patches, commit messages, and random overheard or over-read sentences is a practice as old as vulnerability research. The difference with LLMs is that an explosion in actors "skilled enough" (human or not) has enabled sloppy / low-skill "exploit the whole Internet" actors in a way they weren't previously enabled.

I do agree with the author's ideas, though; most of these are things that should have been done much sooner, and I suppose it's good in a sense that there is a forcing factor now.

happyopossum

5 hours ago

> Backing exploit PoCs out of patches, commit messages, and random overheard or over-read sentences is a practice as old as vulnerability research

True, but it used to take days or weeks of research, testing, and RE to get those PoCs.

Today the entire chain - reading commits, RE patch binaries, building exploit, scripting exploit scan, $profit - can be fully automated and happen in minutes or hours.

ChrisMarshallNY

an hour ago

Sadly, it seems that the lesson from this, is to keep your repos private.

I am not a fan of that, but I think many folks will take that away from this.

stephbook

3 hours ago

I think roll-out and deployment are even bigger issues. Who updates their software stack within 10 minutes? Most CI runs take longer to verify the business logic is still working.

Add to that the danger of supply-chain attacks where you don't even want automatic updates.

talon8635

10 minutes ago

Your last point is the conundrum I keep running up against

It’s a trap regardless:

A) run a known vuln B) accept and run any and all updates immediately… which could be compromised

Maybe A is worse because it’s a known vuln?

29349175

43 minutes ago

"This particular report arrived privately on a Slack channel via Jane Street last week, and was itself found via Claude Fable. That compresses all timelines considerably..."

So Fable knew about it. Maybe someone is running experiments again like in OpenAI's Huggingface hack.

Cute to see that the Glasswing apparatchiks still protect their income stream and hand out no accesse.

jameshart

3 hours ago

I do wonder what the hit rate is in general for Claude finding a successful exploit when prompted with a rumor that leads it to assume the bug is there.

“I’m told there’s a path traversal exploit in this package. Can you find it?” - probably a reasonably high chance of it finding one, even if you just made that rumor up.

a2ff6eeb0

3 hours ago

That's basically the approach Anthropic takes.

saghm

4 hours ago

Sounds like the next step is to start rumors about vulnerabilities so that someone else will find them and you have plausible deniability. "Hey, did you hear? Someone told me <competitor company> might be leaking their logs from a publicly accessible endpoint..."

westoque

an hour ago

with agent loops, the cost of exposing bugs should be cheap now. every pen tester should be using agent loops and on the flip side, an agent could easily see this issue once filed and a fix immediately done. it's incredible how cheap code is now.

xbar

3 hours ago

Hm. I wonder if you can force an exploit into existence with a false rumor of a bug?

jamilton

23 minutes ago

One way you could do it would be to find something that 1. would sound like a bug to a human and an LLM, 2. would be "confirmed" as a bug by a LLM, and 3. would be consistently solved in the same exploitable but reasonable way by an LLM. That's assuming a codebase that's largely AI-written with human review that you're able to open an issue for (possibly indirectly).

Another way is maybe something like saying there's a bug at some endpoint and thus manipulating a bunch of bots to DDOS that endpoint without having to pay for it?

loeg

4 hours ago

No mention of memory safe languages? Sure, it does not help existing projects, and sure, of course you can still have logic bugs (or memory bugs using escape hatches like unsafe). But they do help significantly in reducing the number of exploitable bugs.

avsm

4 hours ago

OCaml (the language I use in the post) is an extremely memory safe language, but there are plenty of higher level logic issues that spring up.

LLMs are extremely good at finding corner-case vulnerabilities in C bindings even within a memory safe language; see for example the fixes in an OCaml crypto library here: https://discuss.ocaml.org/t/the-series-of-mirage-crypto-rele...

aseipp

3 hours ago

Yeah, but there's already plenty written on that topic elsewhere; the OP is making a distinctly different point and everything else in it still applies, I think. Even if you are using a memory safe language -- if you are developing security sensitive software, you need to understand that exploits can now be researched, developed, and deployed in hours (or for stupid bugs, minutes!) instead of days or weeks or months. And this process can now just be massively scaled up with money and compute. It was not like this even 24 months ago.

Tomte

4 hours ago

So we have automated Thomas Pornin?

zingababba

4 hours ago

Transferring ideas in their abstract form is entirely possible now. What this blog post describes I believe even undersells the current reality. I've had success with finding crits by pasting in extremely high level or abstract concepts. I recently went from a talk abstract (3-4 sentences) to crits lol (finding that vuln type).