It's also worth pointing out that the fact there is a new breed of exploit discovery tools itself is creating a new focus on finding and fixing security exploits.
Many (perhaps the majority?) of these were not discovered by AI agents, but were found due to extra thorough testing due to the fear of security issues being found by AI agents.
It's also important to know that some of these CVEs require super niche or unusual configuration to be exploited. This doesn't make them less valid, than elf that llms are good at is chaining exploits.
What it does do is make the defender's job significantly more difficult because how do you both stay up on all the latest vulnerabilities, but then also find valid patches without resorting to using vibe coding?
oh well, in that case i guess everything will be just fine. awesome!
There's something so awesome, about a corporate security researcher keeping vulnerabilities in pocket, to have something to report.
I love the sweet, sweet irony.
CVEs are good. It means critical issues were found and are being fixed.
No CVEs is the more worrisome of the two.
This is just spunge bob showing up the huge pile of trash all over.
In my 30 years carrier of sw eng there was not a single company i worked for that would take security seriosly enough. Not even the two banks I worked for, the security focus was higher there, but nowhere close to enough. Deadlines had to be met, shareholders had to be made happy. Security is the type of investment the better you do it the more invisible it looks and is easy for managers to put lower on the backlog.
The ocasional security researcher I had the privilidge to talk to or work with always had few vulnerabilities in pocket to report in case they dry up on the findings.
Good luck to the overworked understuffed teams in an average company.
LLM's are fast readers with pattern matching capabilities and few inhibitions to try things out. Interesting times ahead.
This shows number of discovered and publicly revealed ones.
The vulnerabiliries were mostly there already, just waiting in secret.
Good luck someone breaking in and finding it. Even I can't find it most of the time.
"wait until they come home, knock them out at the front door, and then beat them with this wrench until they tell us where the passwords are" 🔧
Also every time I read someone using this strategy, I immediately think of 'but what if the house burns down'. You can guard against network access from your vault by it not being on the network, but that comes with different risks.
Or if you want to get really paranoid, what about a state-level adversary that breaks into your home, records the entries in the password book, leaves with no trace, then uses it to login as you and monitor your activities, while you gleefully think that your online accounts are safe because they are in physical form.
Just something to think about 💭
Yes! Reticulum is in fact the solution to the security problems the mainstream mesh networks currently hold.
Not only can you tunnel Reticulum over Meshcore (a custom interface for that exists already), ~~there is also a Reticulum stand alone device that comes with encryption at rest https://github.com/cryptspeak/csCardputer/ ~~ scratch that, turns out thats a fork of ratspeak - a vibe coded trash project backed by sus capital and questionable incentives.
The other alternative would to just use rnodes instead of Meshtastic or Meshcore. But rnodes are usually not self contained, and depend on a phone or laptop for the routing.
Laptop and Phones have millions of lines of code to work, increasing the attack surface, hence a self contained device with encryption at rest like the csCardputer would be preferable in some cases because they can be somewhat more easy to audit.
Both projects are very early in their design and have a long way to go.
Recent events have made them popular as an alternative to cell phones, but it's premature and wasn't even built for the kind of security that's required for that secure communication.
The advertised purposes I have seen are for being in the wild, or rapid deployment in civil emergencies (natural ones, not man-made ones).
But that hasn't stopped the ignorant from finding it and shouting to others "this is the solution!“ as they love to do.
Isn't Reticulum what's aiming after the security needed for today's human-caused emergencies anyways?
Not taking your phone: simple
Using a phone in airplane mode with Bluetooth enabled to use a lora device: minimal concern in most contexts.
Standard android / iOS: A privacy nightmare.
Some devices are needed, many devices can collapse the mesh. In fact, depending on the conditions, it is recommended to use a rol "client_mute" (do not contribute to the mesh) in your device if there are many devices, for avoiding too many retransmits. I hope you understand, my english is limited.
Outside without my Mobilek? But hes my best friend!
It's a citation from @pmjv@lemmy.sdf.org 's works, synonymous with smartphone let's say. Evil smartphone.
Or just use a standalone device with a hard power switch, that doesn’t tether to your phone. My wife and I have a tiny little ESP32 mesh texting+location devices for when we’re in crowds where the cellular spectrum will be saturated, or where the reception is typically just shit. But they stay off unless we’re actively using them (like when we’re separated in the crowd).
If we go to a weekend festival, we just charge them before we leave and then they easily last all weekend. Because we’re only really using them as temporary beacon system to find our way back to each other.
Whats a mobilek?
Yes and no.
Yes, it's part of a mesh that needs a lot of passive sensors to hop farther than the radio. However, it's still long range and low power. You can get anywhere from like 1 mile to 50 mile distance in one hop depending on whether you have sight of them, like being at the top of a hill or something.
For an emergency situation where a family is within miles of each other, you can probably still make good use out of it as a long range radio.
Also, we assume that you take the device out and enable it during an emergency, so that others in an emergency will have access to a mesh. I imagine this would currently be the case. I mean, my devices are off right now. If shit hit the fan, I'd turn them on. I imagine I'm not the only one with this plan.
Isn't this opposed to the idea of Meshtastic? Doesn't the mesh only work if many devices are on passively?
Sorry for the YouTube link if you don't want to go there, I get it. SaveItForParts does a decent video on their usefulness and what you should look for when shopping.
The contraction for developers is devs.
yes
Is that a funhole reference?