Versions of this have existed over the years: hackerone.com/ibb
I disagree and this it’s useful. But either way it’s not zero sum, there is a bunch outside the vuln find/fix cycle ai can help with as well that improve the worlds security libber.org/vulnerability_avo…
Yeah I had fun with the examples there but I think most of the roi is deleting code and pruning dependencies
Tactics to avoid vulnerabilities in the first place: collingreene.com/vulnerabili…
Ai has supercharged the vuln find/fix cycle but its also good at all the other things we can do. This is all obvious stuff people do but I hadn't seen written down
Potentially underexplored effect of ai on computer security: easier to get backdoors into open source software like cve-2024-3094. 100 bots building a year of credibility submitting patches to 100 projects then landing non-obvious backdoor.
I imagine ideal form is a big list of them w/case studies we hand to a typical Fortune 500 cto and say: consider these. Find -> fix -> prevent, don’t forget prevent!
This is great, thanks! I ran a mini version of this experiment long ago having 8 security consultancies all audit the same codebase. They mostly found the same 70% of vulns. Would love to try something like this at scale for all open source software
Unfound!
Heart of the question is even with better tools (ai) there is theoretical point where we found all the vulns. Where is that?
I know, I know, this incorrectly assumes we forever freeze all future changes to software,
Has anyone attempted to estimate the totals number of latent, unfounded, security vulns?
We know how many are found each year, we know the denominator (total code and rate of code change)
We need the “security - eternal truths” post/talk. All of us repeating what Dan Geer and Bruce Schneier said
The wins of infosec as a field are under discussed, what else goes on this list? libber.org/society_level_inf…
Totally agree. Have you ever done a big program scale “go delete surface area” stuff? I’ve only done it adhoc typically as the result of a point audit or cluster of vulns
A flight with no internet + this pleasant nerdsnipe = this long answer: collingreene.com/vuln_mgmt.h…
I'm organizationally sheltered but in a big company the above is what I think ideal looks like