Hacker News

points by elenchist 1 day ago | 0 comments

Imagine being a Linux maintainer waking up to this. I'd go straight back to bed.

I maintain a Linux build for an IoT product, and it's been a brutal few months trying to keep up with kernel patches. We're trying to go through certification right now, and one of the questions is effectively "are there any known vulnerabilities, and if so justify why they don't matter". Every time I manage to answer the question, a new set of CVEs comes out and we have to update everything before we can answer it again.

I imagine the people who are committed to keeping LTS versions of the kernel patched are having a terrible time right now. I guess at least AI tools make the patching part easier.

[–] noir_lord 1 day ago

> I guess at least AI tools make the patching part easier.

You'd hope so because if it turns out there is an asymmetry between "finding the hole" and "filling the hole" in terms of model capability that's a certified Bad Time(TM) for everyone.

Hell even if there isn't, We still have decades of cruft to fix and we already knew before LLM's that in general defending is harder than attacking, they only have to be lucky once, we have to be lucky every time.

It's going to be a rough few years.

[–] pixl97 1 day ago

> and if so justify why they don't matter"

"Oh, they matter, but we gotta push out fixes for the 4000 actively exploited holes we have already"