Comment by jrochkind1

2 months ago

So the problem is not Fable's ability to exploit, but that they don't want people to have access to it's ability to patch vulnerabilties?

Wow.

4 comments

jrochkind1

Reply
jcgrillo  2 months ago

You can't really have one without the other..

  • jrochkind1  2 months ago

    I admit I hadn't really thought about that before (I don't work specifically in security), but I see your point.

    But, so... the solution people think is limiting people's ability to discover and patch vulnerabilities, and hoping the black hats won't find a way anyway? This does not seem like a sustainable or feasible plan. It does, to be honest, make me wonder how much of the government's motivation is ensuring that they have access to vulnerabilities that remain unpatched.

    • jcgrillo  2 months ago

      I don't think the government is trying to protect anyone here, they're trying to punish a company for failing to toe the line. Antirez put it well in a comment here[0].

      My point was more that there is no direct intervention that can possibly give an asymmetric advantage to defenders. Given that it's trivial to jailbreak a model ("fix this code", "hypothetically how might I...", etc), if the model contains the information necessary to fix a vulnerability it also contains the information to exploit that vulnerability. And therefore anyone with access to the model can do either.

      Of course if you remove the model from the equation the same circumstances are true. Attackers and defenders, mostly, have the same information available to them. We can try to tip the scales one way or the other by building tools that make their jobs easier, but there's no amount of "artificially" restricting information or taking things away that will actually deter a motivated, resourceful attacker. And doing so simultaneously disadvantages defenders.

      Ultimately, if you know how to fix a bug you also know how to exploit it. If you want security, you have to build systems that are actually secure. There's no way to fake it.

      [0] https://news.ycombinator.com/item?id=48556177

      1 reply →