Security through obscurity is dead, and AI delivered the fatal blow(www.theregister.com)
12 pointsby CoderLim1103 hours ago5 comments
  • tow217 minutes ago
    Totally disagree tbh. Obscurity is about the only form of security worth the name these days.

    Don't run on open source software - doesn't matter how obscure it is, the LLMs will know about it.

    Don't run on software that other people use - if there is more than one copy of the software accessible, it'll be broken elsewhere and you'll be a victim of drive-by hacking.

    Do - run your own software, written by you, which nobody else uses, that is closed source and completely undocumented. Then you might have some chance of avoiding being hacked.

  • odyssey7an hour ago
    An interesting consequence is that cybersecurity researchers and hackers are now AI researchers.

    The prominent game right now is about the classes of attacks that AI can recognize both to exploit and to remedy.

    Implicitly, that creates a new highly valuable class of vulnerabilities: the ones that AI for whatever reason is unable to readily see. Understanding those two groups will be paramount and will lead to better AI.

  • qarlan hour ago
    Speaking of obscured code:

    I'm using AI to decompile old arcade games.

    I am finding the craziest anti-tampering stuff. Three different routines - each watches the code of the others - and if anything changes - tank the machine by jumping into graphics RAM.

    When I first started seeing this stuff I assumed my decompiler was broken. Nope. Just insane code.

    • nylonstrung8 minutes ago
      Yeah I've been using Ghidira to study the internals of strategy PC games I like and it's an extremely good learning experience given the paucity of OSS code for stuff like this
      • qarl4 minutes ago
        Yeah, I should be using Ghidira in my toolchain. I didn't know it existed so I had to reinvent the wheel.

        Although - Ghidira is often wrong about what code does. Make it run tests to verify its theories? BINGO.

    • noman-land10 minutes ago
      If you have the energy or desire to write this up it sounds really fascinating.
      • qarl6 minutes ago
        THAT is an excellent idea. Thank you.
  • pixel_poppingan hour ago
    It's not "dead", what kind of crappy binary take is this. It absolutely still work to an extent where making an attacker lose time does slow down attacks, thus increasing security.

    You can absolutely make an agent lose its mind thus making it spend more tokens, to an extent where it might not be viable, but in all case, slowing down or making something more expensive is a direct way to increase security, so wasting either token or human time both is useful.

    SBO+Real security > Security.

    • BrandoElFollito29 minutes ago
      This is what annoys me most when people talk down security by obscurity. Sometimes it is not even security, but logs sanity. I usually ask them if they prefer to have more or less useless logs. Still waiting for someone to want more (except researchers)

      Security in depth is made of (ideally independent) layers. Obscuring things is one such layer.

  • poguean hour ago
    404