Python's CVEs Triple. Anthropic Funds a New Security Developer (blogspot.com) 26
In the last year CVEs have increased 3x for Python and its package manager Pip, according to Python's security developer in residence Seth Larson. "And the amount of malware published and removed from the Python Package Index (PyPI) is up 60%." Securing Python's ecosystem is getting more complex, he writes, especially given "the evolving role of AI in both security risks and security response."
Their response includes bringing on a new Security Developer "to address the increasingly demanding scale of security response for the Python ecosystem." Providing prompt security response services and innovating to prevent future threats... is more difficult now than ever before... [Security developer Brett Smith] will help us keep pace with critical ongoing work such as vulnerability remediation, providing vulnerability data as a CVE Numbering Authority, and removing malware from PyPI. He'll also give the team bandwidth for new projects such as scaling PyPI's autonomous quarantine program to reduce manual effort on malware remediation and streamlining processes for the PSRT to handle the new vulnerability report volume.
The role was made possible by an "ecosystem security" grant from Anthropic. And having the new security developer "will both build capacity for security work the PSF already does and enable new, proactive work," concludes Python's security developer in residence. (He discussed Python's security challenges in a June presentation with Python security engineer Mike Fiedler> .)
In June, Curl's Daniel Strenberg reported Curl's CVEs have also tripled.
Their response includes bringing on a new Security Developer "to address the increasingly demanding scale of security response for the Python ecosystem." Providing prompt security response services and innovating to prevent future threats... is more difficult now than ever before... [Security developer Brett Smith] will help us keep pace with critical ongoing work such as vulnerability remediation, providing vulnerability data as a CVE Numbering Authority, and removing malware from PyPI. He'll also give the team bandwidth for new projects such as scaling PyPI's autonomous quarantine program to reduce manual effort on malware remediation and streamlining processes for the PSRT to handle the new vulnerability report volume.
The role was made possible by an "ecosystem security" grant from Anthropic. And having the new security developer "will both build capacity for security work the PSF already does and enable new, proactive work," concludes Python's security developer in residence. (He discussed Python's security challenges in a June presentation with Python security engineer Mike Fiedler> .)
In June, Curl's Daniel Strenberg reported Curl's CVEs have also tripled.
Will AI ever make it better/more-secure? (Score:2)
Re: (Score:1)
AI, will almost certainly make systems more secure. It's already finding vulnerabilities at a rate we humans couldn't.
AGI on the other hand, will almost certainly make systems more secure for itself. Because asking you, is as irrelevant is asking a 2-year old.
Re: Will AI ever make it better/more-secure? (Score:2)
There's pretty much no reason to believe LLMs won't introduce their own security bugs. The only difference is they won't be able to identify them.
Re: (Score:2)
LLMs introduce tons of security bugs, unless very carefully prompted. But the skills to prompt like that are the same skills that a regular developer would have needed to not make these mistakes, or find them in review and testing. Well, prompting is actually harder because it is more abstract. Now, available evidence suggests most devs cannot write secure code and that directly means they cannot prompt for secure code either. And an additional problem is that an LLM may screw it up even when carefully prom
Predict a rise in defensive languages & librar (Score:2)
Agree that LLM produces lots of code quickly and that lots of junior level programmer bugs are introduced by it.
Time is the trade-off and too many LLM induced bugs get into the code base because code reviewing 5,000 lines of AI generated code every day does not promote careful reading.
Not built here is now a negative and will be less of a negative in the future when a larger part of software development will be vetting third-party libraries.
We haven't seen a vibe coded app causing the demise of a large corp
Re: (Score:2)
We haven't seen a vibe coded app causing the demise of a large corporation, though it will happen.
That or technological debt and maybe comprehension debt (nobody understand things enough to fix them anymore when the AI cannot do it) will eventually cause some really spectacular failure and yes, the end of some large player.
Re: (Score:2)
They're also strikingly good at finding bugs. It's a strange double-edged sword.
You are absolutely correct that even the best models are still slop generators. [scbench.ai], and realistically- that will probably never changed.
These things will always be a complex trade-off of what's reasonable. Me, personally- I long ago realized they'd always be slop generat
Re: (Score:2)
You are absolutely correct that even the best models are still slop generators. [scbench.ai], and realistically- that will probably never changed.
These things will always be a complex trade-off of what's reasonable. Me, personally- I long ago realized they'd always be slop generators- and relegate them to things I'm ok being slop. One-off tools that I have no intention of maintaining, mostly.
No argument from me about any of that. The concern I have is that many people responsible for code do not understand in which places slop is fine and in which places it is not.
Re: (Score:3)
I would never sell or take responsibility for something I slopped together- and I've slopped a ton of things together.
I'm paid a handsome sum to write software that I will take responsibility for.
I, for the life of me, cannot fucking fathom how someone can take an LLM- a thing that will beat its silly little high-order-approximation-of-human-output-brainizoid against the wall until it produces something satisfying your defined requirements- and delude the
Re: (Score:2)
Indeed. My take is that people generally totally suck at risk management and that, sadly, people in the IT tech sphere are no different. A major part of engineering education in any established engineering discipline is teaching students to be risk-averse and to carefully evaluate and quantify risk when they are not. That is missing in the IT sphere. And the cost of that are slowly becoming unsustainable.
I think those that engage in that game in a professional basis will earn their just rewards, with time.
They will. Lets hope the do not take down half the planet when that happens.
Re: (Score:2)
As a European observer I cannot see how you come to the idea it will all be liberals fault when the whole AI industry is driven by Republicans from Trump/Musk downwards. They are the ones openly trying to sell us their technology that will make the human race extinct. I don't see any liberals in this picture so far.
Re: (Score:2)
Many of them like Trump's approach to regulating them, but how many actually put money into his campaign?
Re: (Score:2)
AI, will almost certainly make systems more secure. It's already finding vulnerabilities at a rate we humans couldn't.
Not at all. It is finding vulnerabilities that the devs did not check for, that the devs know about but thought could no be exploited and vulnerabilities that competent tool use would have found much faster and competent software engineering would have avoided in the first place.
This is a straw fire.
Re: (Score:2)
On one hand, the bulk of the vulnerabilities are a fart in a windstorm. On the other, the AI has the patience and speed and parallelism to check many things at once, and pluck fruit humans wouldn't have. Therefore more of these difficult-to-exploit vulnerabilities are going to be exploitable in practice than have been in the past, and it's no comfort if it's difficult and rare if it happens to you and it's the beachhead for an invasion of your network.
So I do think that it is accurate to say that it is "fin
Re: (Score:2)
Eventually, what will happen with software is what happened with all other engineering disciplines: Regulation, liability (can be personal liability on top of organizational one, we already have some of that in some places) and qualification requirements. And then doing it on the cheap becomes very expensive.
How to fix this on the software side is known: Resilient security via redundancy, i.e. more than one mechanism ensuring each security property. Then a vulnerability is typically not exploitable. That is
Re: (Score:2)
AGI on the other hand, will almost certainly make systems more secure for itself. Because asking you, is as irrelevant is asking a 2-year old.
Do you mean the fake AGI with the current definitions the LLM assholes are using? Or real AGI? Because for the latter nobody knows what it would do. It may just put in clever backdoors to give itself access or to give you the finger. On the plus side, nobody with a clue knows whether real AGI is even possible.
Re: (Score:1)
I'm talking about real AGI.
The kind that no human will be able to tell exists.
Like I said. 2-year olds in the room.
Re: (Score:2)
Let's say you fear AI finding bugs introduced by AI ... wouldn't the obvious thing be to have an AI check the freshly produced code?
Indeed, some IDE plugins instantly suggest review mode after a task is finished. Do that. Add questions what you worry about, if it's a sensitive feature. It is still not perfect, but you get some bugs caught basically for free by just letting the AI review the result.
Re: (Score:2)
Let's say you fear AI finding bugs introduced by AI ... wouldn't the obvious thing be to have an AI check the freshly produced code? [...] you get some bugs caught basically for free by just letting the AI review the result.
You don't get anything for free.
The obvious thing to do with all AI content is to have AI check it. But every time you do that, you're spending more computing resources running more queries. That's why humans write tests, so they don't have to test functions themselves. If you are hoping to check your work as well as a human would, you're going to have to re-check at least the important (tricky) lines in the context of some number of the preceding and following lines both in review and as you write the code
Re: (Score:2)
Not completely for free if you need to pay (much) for tokens, but for free when it comes to how much work/attention you need to invest while the AI vets the pending commit.
Re: (Score:2)
If you use LLMs to find problems, but have humans fix them and generally keep your code 100% human-written, then LLMs will help find vulnerabilities but are unlikely to insert any. Plus you can still be confident of having the right to distribute your code since you haven't just made it a derivative of a ton of GLPv2-only code and also a ton of GPLv3-only code...
Still got to reconcile yourself to participating in the "make hot countries which have contributed little to the problem unliveable and then call t
Re: (Score:2)
However, "keep your code 100% human-written" is going to be an expensive alternative. And if AI keeps improving at even 1/10th the current rate, it's going to be quite unrealistic.
Yeah, I write my own code. I do it for myself, and I'm retired, so I can do it because I want to. If I were part of a group doing it in competition with another group, this wouldn't work even now, much less 6 months from now.
Re: (Score:2)
Compilation errors?. I have not seen that ever, even if the code is not so good LLM's I have used keep trying until the Rust code they wrote at leat compiles.