HN

Comments (125)

• Menu

  Plasmoid
  How did we get to the point where there are a thousand privilege escalation exploits in the kernel?Is the kernel simply too complex to reason about? Is it an underlying flaw in the security model or language implementation?Should we assume that all software is more compromised than the kernel?
• Menu

  dangelosaurus
  This is my team’s work. I’m happy to try to answer questions or take questions back to the team.And we're hiring! https://openai.com/careers/search/?q=cyber
• nas
  I've always considered local escalations to be possible in Linux (i.e. having user access almost certainly means you can get root). However, 948 vulnerabilities is kind of shocking. Hopefully we are getting to the end of the part where it "gets worse before it gets better".
• Menu

  rmbryan
  With these vulnerabilities and the ones not listed that are sure to exist, how is the internet still up? How are my lights on? Why aren't power plants exploding by the dozens?What are the mitigating factors that prevent this level of vulnerability from being an existential threat to humanity?
• bzmrgonz
  I wonder what Sidero Labs has to say about this article. My hopes are pegged on their efforts. I have my wagon ready to hitch on their horses. They are not a one pony show anymore guys, Talos OS can be standalone server OS, a hypervisor server or cluster, and their flagship of k8s node or cluster. We get all that in an immutable gitops ready OS. I'm practically sold on their offering.
• Menu

  getcrunk
  > For the near and medium term, having access to a low-privileged account on an operating system, that isn’t up-to-date on its latest available patches should be considered functionally equivalent to root access for a well-resourced threat actor.*buries head in sand**cries*
• Menu

  IcyWindows
  I think this is one area where Windows has an advantage.ACLs, Appcontainers with capabilities, etc have been something in the OS for more than a decade.
• Menu

  zahlman
  > We've developed an autonomous vulnerability discovery, exploitation, and patching pipeline. In one run with our cyber model, it validated and generated patches for 948 local privilege escalation vulnerabilities in Linux at an API cost of $1.2 million.Imagine if open-source organizations other than the Linux Foundation (and Mozilla I guess) could throw $1.2M of API-rate LLM usage at security.
• rishabhd
  Curious question - if any organization sponsored a 1.2mn USD program to find vulnerabilities in Linux, will they find these many vulnerabilities? Or use a professional software like Checkmarx or Veracode to do it with 1.2mn USD in license + human effort.Is it a funding + will problem or is it an AI problem?
• Menu

  ksec
  I wonder if they could run it on OpenBSD and FreeBSD as well.
• hoppp
  Well at least they are doing public service while hacking the planet.
• Menu

  clvx
  and yet thousands of iot devices will not get these updates. This is gonna be fun.
• tamimio
  These are becoming more and more marketing materials than actual findings, because OAI probably hit the wall in making their models smarter (just like how google try to specialize their models in legal or whatever), but they need to remain relevant in the news. Sol 6.1 sucked so bad in reasoning that either it’s actually a bad model or users behind the scenes get degraded outcome while using all the resources for these marketing stunts. Stop, it’s embarrassing, make better models or be gone, at least we will get cheaper RAM to advance the development of open weights models.
• sehw
  [dead]
• minfazhai
  [flagged]