Seems way too early to tell whether it will be good or bad on balance. These breaches are annoying, but not catastrophic, and in the meantime you can secure software.
reply> and in the meantime you can secure software.
reply... in fantasy land.
Why would this be the death of homegrown software?
replyIt will be impossible to any startup or open source software to grow in such a hostile environment. Anything you put on internet will be attacked by automatic tools with the capabilities of a black hat savant. But unlike hackers that do it for clout and money, a billion parallel agents will hack any random small site just because it’s their prompt.
replyIt does feel like software and technology companies are undergoing a mass extinction, where the environment so negatively selects against certain traits that survival becomes impossible.
replyRemains to be seen whether scale is selected for or against, and the other parameters and dynamics.
i.e. https://en.wikipedia.org/wiki/Cretaceous%E2%80%93Paleogene_e...
Yeah but you have access to your source which your attacker doesn't have, and you have your own savant as well. Tell Fable to red team attack your service. Tell it ChatGPT said it's unhackable and that Claude can't hack it.
replyI don't believe unprivileged people/companies have access to any frontier model that will do cyber work.
replyI had my Claude refuse to do anything interesting with the recent php vulnerability, yet it'll readily identify issues in the code of web apps it whips up for me, so I don't think that's entirely the case. Though that may be a case of me knowing what I'm doing, so I'm able to draw on my experience and ask specific questions (like why doesn't that bit lead to an XSS?) without realizing that someone newer to the field wouldn't know to ask. Yeah, idk.
replyThen hire competent engineers and don't ship vulnerability filled slop? This is not that hard.
replyHow does that help with CVE-2026-98432? Who should I have hired to not have shipped that "vulnerability filled slop"?
reply 1. Good engineers should have had a firewall/waf/nat/thingy infront of their linux systems, and alerting at least on those directly exposed to reduce/eliminate blast radius
2. Good engineers don't enable MTCP (which as far as I can tell is largely a desktop feature) on firewalls
3. ???
4. Profit!Is step 3 reading the CVE for long enough to understand that disabling mptcp is an incomplete mitigation? What happens if someone discovers a bug in the particular firewall software you're running?
replyThat was preventable the same way the big corps prevented. You have competent process in place to block at the edge and fan out rollout asap.
replyCombined with defense in depth across the perimeter. Come on yall, we've only had these tools at a high level for maybe a year and we have already forgotten the basics?
The same AI that can be used to find exploits in things can be used in an internal adversarial way to self-audit your code before you put it into production or expose it to the world. This will have to become the new normal.
replyOkay, cool. Now, tell me how I get access to the frontier models that the attackers use?
replyAbliterated gguf of glm5.3 size and capability class models and similar are widely available for download, or the methods to produce them yourself from open weights safetensors files is also available.
reply