Resources

People often ask me "How did you learn how to hack?" The answer: by reading. This page is a collection of the blog posts and other articles that I have accumulated over the years of my journey. Enjoy!

The author of this post is an open-source maintainer. Additionally, they were the lead of the Go Security team at one point. As a maintainer, they always felt that issues, PRs, and feedback is optional to handle. You can accept it, ignore it, partially use it or do whatever you want with it.

Security reports were the exception: they are special. Researchers are doing a favor by reporting vulnerabilities. They are doing something for the project, instead of them doing something for you. Because of this, the security researcher's were owed something and treated well. Investigation, responsiveness, attribution, speed of checks... all of this was given to the researcher.

Now, with AI, this has all changes. The insights that security researcher's provided is no longer scarce knowledge. Bottleneck used to be finding potential issues; now, it's identifying which ones are real. Confidentiality, embargos, and coordination don't mean as much as they used to either. Instead of reading a blog post, you can just ask the LLM to find the bug in the commit.

After making this post, they got a few comments about it. Avery Pennarun points out that a stable point will come where few vulns are being released again, with the bar just being higher than before. Frederik Braun calls out that some vulnerability reports are indeed still special; we just need to figure out what the bar for a special vulnerability report looks like.

The final one comes from a Hacker News comment from William Woodruff. First, we're in a "vulnpocalpyse" that makes it harder to sift through the noise. Reports claim impact but don't have a good understanding of the real threat model of the application. The final comment is just about leaning into the trust relationships more than before. If somebody is already trusted and has reported bugs in the past, then take it more seriously. If somebody sends you a bad report, then just ban them and wait for the next LLM to send you a better one. Overall, a sad yet interesting post on the outlook of security.