Comment by ShinyLeftPad
4 days ago
That's a rosy eyed view. users running outdated code not getting security fixes are sweet honeypots for modern automated llm-backed mass exploitation machine long before something obviously fails for you.
you'll be spending tokens on getting it maintained, and if you don't spend enough you get pwned by guys who do. who exactly is winning in this scenario?
"democratizing software"...
You're just criticizing FOSS software in general now.
> criticizing FOSS software in general now
you mean real oss maintained by professionals and security experts, as opposed to the cannibalized gpl-washed version llm spit out?
OSS maintainedness should not at all be taken for granted. If you need something maintained by pros and security experts, that more accurately describes commercial software. FOSS as it stands, with the exception of some (but nowhere near all) major lynchpin projects, is done by volunteers in their spare time.
1 reply →
[dead]
Wild how LLMs both weaken software security and supercharge the attackers at the same time
Spending tokens to search for vulnerabilities in commonly used software makes sense because the payoff is large - hack once, exploit many.
However for unique, bespoke software (vibe-coded or not), the payoff is as small as a single endpoint. You’ve found an exploit in MikesOwnOfficeSuite and now have access to Mike’s PC. You’ve got to spend the same tokens again to find an exploit in SuesAwesomeOfficeApps. It still might be worth it in a spear-phishing scenario.
Security through obscurity is back!
if everyone vibe coded their own offices it would be a heaven for big tech llm operators lining up their pockets of course, but the idea was that Mike is using something vibe-coded by somebody else. just target TinyLittleOffice and get everyone using it
yep. casual vibe coders can't compete with whoever spends 10x tokens just on vuln discovery...
I am placing your time of digital fruition in the 00’s or later? Not bashing, but we bought floppies in the 80s with software with no updates. Cool kids got their software from Oh No More Warez + keygen in the early 90s. That went online in the late 90s.
Always online, internet of shit and perma update crap came at that same time, first for the OS and later for everything. Oh, plus two decades of using shady Russian software for virus scanning. Shit went up, update everything became everywhere and everyday. Plus gigabyte frameworks for functionality that was kilobytes before.
My point in cursing too much? (Sorry, mentally screaming FUD here.) That tiny code projects, even without an active maintainer, in the LLM-era are probably a lot more secure when run by the people they target (we run containers, and sandboxes, the cool kids run immutable distros). This is democratizing software, and it has the great feel of old.
Please everyone, vibe code tiny project with tiny codebases everyday. Dump them on GitHub in a free tier. Make so many that the people have a free choice again! And go watch Cliff Stoll again for that hacker energy!
> we run containers, and sandboxes, the cool kids run immutable distros
So just for select .1% of pros who know how to do that and the rest can get f#cked. "democratizing" software...
if you can't be bothered to learn skills (or even ask an AI to teach it to you for free), then you deserve to not be part of that democratization.