Rendered at 23:56:20 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
igornotarobot 11 hours ago [-]
This is why security reports have the impact section. Every piece of software has an endless stream of bugs, but only a few of them have real effect on the users. It was pretty clear in Web3 contests. Now we see something similar on a much larger scale in all other software.
lwhi 14 hours ago [-]
Can bug finding lead to harm?
A single bad actor trying to find a bug in order to achieve a specific aim, might mean that bug is never known by the software creator. However the majority of the public is also likely to not know about the bug.
Public hunting and exposure via security advisories, it's going to lead to a greater awareness of vulnerabilities which I imagine will increase the likelihood of a particular vulnerability being exploited.
The time and effort required to fix a vulnerability is often substantial.
Perhaps we shouldn't be categorical, in our assessment of the merit in finding vulnerabilities in software?
spwa4 13 hours ago [-]
The problem is economic. This necessitates constant effort to just keep software working, and that means the client needs to pay for that. And there's effort after effort after effort to force the software provider to pay for that.
Under these circumstances, of course, nobody has any incentive to find bugs, and everyone goes after people who find bugs.
But this is how the government (at least in EU) designed the system, not how it's supposed to work. It's yet another difference with the US, and it's yet another way US business (or Chinese, or any NON-EU business) get preferential treatment in EU business.
dist-epoch 13 hours ago [-]
LLMs can find endless combinations of edge cases that are a real bug. Addressing them requires thousands more lines of code. Which creates another set of new edge cases to combine.
At some point you realize recovery is better then prevention, let the bugs happen, but recover from them gracefully.
ahartmetz 13 hours ago [-]
That is not usually how it works. Most bugfixes are about the implementation of the logic, not its design, so fixes can be very small changes.
newAccount2025 10 hours ago [-]
Yes. Or it’s like, a sign that the system needs a deep rethink based on a sound design, because it’s currently an unprincipled mess. :)
mrkeen 12 hours ago [-]
I the moral of the story is that the defense side should have already been using PBT.
A single bad actor trying to find a bug in order to achieve a specific aim, might mean that bug is never known by the software creator. However the majority of the public is also likely to not know about the bug.
Public hunting and exposure via security advisories, it's going to lead to a greater awareness of vulnerabilities which I imagine will increase the likelihood of a particular vulnerability being exploited.
The time and effort required to fix a vulnerability is often substantial.
Perhaps we shouldn't be categorical, in our assessment of the merit in finding vulnerabilities in software?
https://www.ibanet.org/European-Product-Liability-Directive-...
Under these circumstances, of course, nobody has any incentive to find bugs, and everyone goes after people who find bugs.
But this is how the government (at least in EU) designed the system, not how it's supposed to work. It's yet another difference with the US, and it's yet another way US business (or Chinese, or any NON-EU business) get preferential treatment in EU business.
At some point you realize recovery is better then prevention, let the bugs happen, but recover from them gracefully.