[HN Gopher] This year's insane timeline of hacks
___________________________________________________________________
This year's insane timeline of hacks
Author : laurex
Score : 254 points
Date : 2026-04-13 14:53 UTC (8 hours ago)
(HTM) web link (ringmast4r.substack.com)
(TXT) w3m dump (ringmast4r.substack.com)
| ArekDymalski wrote:
| >Stacked on top of each other across roughly a hundred days,
| these events are something a historian of computing security
| writing in 2050 will probably file as a turning point, regardless
| of what else happens between now and then.
|
| And yet, the public conversation around them has been quiet to
| the point of being strange.
|
| There's a lot current events that once would have been considered
| historical: trip around the Moon, war out of nowhere,
| unprecedented explosion of kleptocracy l, enormously scandals and
| so long. Noone of these are moving much of the needle among
| general public.
|
| Why? I think such indifference or rather apathy/torpor is a
| result of people becoming tired of constant stream of crises
| (either imaginary or real) that we're being flooded by. The
| capacity to react with something more than a shrug is finite. And
| I think we are being drained.
| mwigdahl wrote:
| Agreed, call it future shock or the Singularity or just overall
| outrage fatigue, people just aren't reacting to these kinds of
| things at a level commensurate with their risk or danger.
| titzer wrote:
| The idiocy out of the Whitehouse is an intentional strategy to
| flood the zone with crap that sucks all the air out of the
| room. They have intentionally broken the ability of the public
| to become informed through a number of means: attention
| atrophy, lowest-common-denominator mudslinging, and massive,
| manufactured, stupid global crises. People have become deaf and
| desensitized.
|
| The fact that humanity sent people back to the moon barely even
| registered. Crazy times.
| CoastalCoder wrote:
| > The fact that humanity sent people back to the moon barely
| even registered.
|
| Are you sure that people would have cared much even in better
| times?
|
| Although I'm just as subject to the fatigue as everyone else,
| this just isn't a pursuit that I see as important.
|
| TBH I think dealing with global warming, cancer,
| homelessness, AI impact on human cognitive development, and
| the loneliness epidemic are far higher priorities.
| nemomarx wrote:
| If I recall correctly opinion polling on the original
| Apollo program wasn't universally positive either. Space
| missions don't impress people who want money spent on the
| ground, it etc
| fhdkweig wrote:
| The famous spoken word poem Whitey on the Moon was on
| exactly this topic.
|
| "Accompanied by conga drums, Scott-Heron's narrative
| tells of medical debt, high taxes and poverty experienced
| at the time of the Apollo Moon landings. The poem
| critiques the resources spent on the space program while
| Black Americans were experiencing social and economic
| disparities at home."
|
| https://en.wikipedia.org/wiki/Whitey_on_the_Moon
| RGamma wrote:
| "Amusing ourselves to death" was eerily prescient. Now that
| the amusement stopped, what might happen next? Not the
| metaverse, that's for sure.
| lamasery wrote:
| I think nobody cares about the moon thing because 1) they
| aren't landing, and (this one's more for people who are
| paying some attention to this stuff to begin with) 2) it's
| basically the same mission they already ran on auto-pilot,
| but with people on board, so... I dunno, hard to get excited
| about some very-expensive passengers on an automated ride.
|
| I mean, part of why they cut the Apollo program short was
| because nobody cared back then either, after the first ~2
| landings, so they muddled on a while longer but support
| simply vanished in a hurry. It'd be surprising if people
| started caring more now. I suppose if we land people on the
| moon it'll be a bit more of an event than this one (the
| landing, not the launch) but I'd expect interest to plummet
| again after that. Hopefully they have better-selected video
| feeds for the landing than they did for this launch, I had my
| kids watch it and it was bad enough I think I'll have trouble
| getting them to sit down for another NASA launch stream.
| fhdkweig wrote:
| I'm interested in it as a means to an end. Supposedly this
| is to get ready for a lunar base. I would love to see that
| in my lifetime. Also, while it is not a mission objective,
| I want to see a space elevator which currently we can only
| do on the moon. Due to the lower gravity and slower spin,
| it is possible to make a space elevator out of Kevlar rope,
| which we can reliably make in bulk.
| SoftTalker wrote:
| > people becoming tired of constant stream of crises
|
| They aren't tired, they're distracted. X/TikTok/et. al. are all
| fire and motion mechanisms.
| energy123 wrote:
| The precipitous drop in fertility even in low income countries.
| The rise in populism and fear.
|
| It's the phones, humans are being DDoSd. We need government
| intervention against many aspects of modern technology.
|
| The profit motive works when it comes to reducing manufacturing
| costs and passing some of that on to consumers through the
| beauty of competition. It doesn't work so great when it's X
| training a transformer model to maximize the amount of time you
| spend doom scrolling so they can feed you gambling
| advertisements.
| scottyah wrote:
| Well society had to go and get rid of religion, so people
| needed another opiate.
| rootusrootus wrote:
| Considering how attached to his phone my hyper religious
| evangelical father-in-law is ... I don't buy it. If there
| is a causal relationship between those things, it goes the
| other way.
| lotsofpulp wrote:
| Total fertility rates dropped long before smartphones.
| phil21 wrote:
| > Why? I think such indifference or rather apathy/torpor is a
| result of people becoming tired of constant stream of crises
| (either imaginary or real) that we're being flooded by. The
| capacity to react with something more than a shrug is finite.
| And I think we are being drained.
|
| I think it's more that the impact of all these constant string
| of "crises" ends up having very little impact on the average
| American's lifestyle. Groceries a bit more expensive, gas
| higher, rent continues to creep up. Some giant incomprehensible
| national debt number gets higher. Those all suck and people
| complain about them - but they are complaining about them in
| packed bars while they drink $7 beers and eat $30 burgers and
| fries.
|
| You can only yell so many times that the world is ending before
| people tune it out since their day to day lives are largely
| unchanged. Just look at the focus on complaining about almost
| irrelevant things like the price of eggs or whatever totally
| irrelevant culture war topic of the day. It's societal bike
| shedding.
|
| I am firmly of the belief (and have been for quite some time)
| that the "average" middle class American is going to need
| severe pain - as in widespread great depression level pain -
| before anything really changes at all at the ground level.
| Americans have simply become so used to living the lifestyle
| being part of an insulated hegemonic superpower empire that
| they have taken that for granted as how things generally will
| always be no matter what happens. There is zero consideration
| for the amount of sheer effort, will, and constant vigilance it
| took to build and maintain such a state of being.
|
| Or put another way: Inertia is a hell of a drug.
| jmcqk6 wrote:
| Yeah, it's not indifference or apathy. It is overwhelm. There
| are too many things that need attention and not enough
| attention.
| atkrista wrote:
| One word, Hypernormalization.
| yoyohello13 wrote:
| I know for my part I am so tired of the constant crises. At
| this point I just want the inevitable collapse to hurry up and
| happen already so we can just focus on picking up the pieces
| and move the fuck on.
| tokioyoyo wrote:
| Because it doesn't really matter and has no legs? Over the past
| 15 years, we had a lot of data exfiltrations, lots of breaches,
| hacks, and etc. Nothing really happened, world moved on, people
| figured out a way to live around it. People who work at those
| companies get affected, but in general, unless the entirety of
| banking system collapses because of the hacks... nobody will
| really care. Even during the hay days of Equifax hack people
| were chatting how things will "happen this time". Nothing did.
| john_strinlai wrote:
| > _And yet, the public conversation around them has been quiet to
| the point of being strange._
|
| i dont think its that strange. there are multiple wars raging on,
| with many people fearing the breakout of a global conflict. a
| giant pedophile ring has been exposed that no one in power seems
| interested in doing anything about. prices for everything are
| haywire. markets are an absolute rollercoaster, hinging
| completely on one mans late night tweets. and so on.
|
| people just dont have the bandwidth to also learn about what an
| npm or github is, and why a hack of it is important. news
| stations are going to pick the news that results in the most
| people tuning in to watch. that is war, not whatever a mercor is.
|
| the non-tech (and many of the tech) people in my life are also
| just plain tired of hearing about hacks. they have heard that
| their information has been stolen 10 times or whatever in the
| last 5 years. they have heard 100s of "this company was hacked"
| stories. "another hack? who cares?".
| tokai wrote:
| Its the tech worlds equivalent to _eating X causes cancer_.
| ifwinterco wrote:
| HN is a bit of a bubble in that people here tend to be quite
| privacy focused and would be horrified at the prospect of their
| details being leaked.
|
| For a lot of normal people that's not the case and as long as
| they don't get someone actually stealing their identity etc.
| they aren't really concerned about these kind of things
| hydrogen7800 wrote:
| Frustratingly, I have my foot in both worlds to a degree. I'm
| interested enough in tech to pay attention and often lurk the
| tech bubble that is HN and hear about the raging dumpster fires
| from the folks who live and work in that domain. But I exist in
| a mostly non-tech world IRL where this exists among the other
| burning dumpster fires to the point that I can't care about
| another data hack, and i hate that I don't have the bandwidth
| to care. To a more acute degree, my mother was nearly wiped of
| half her life savings by "hackers"/fraudsters posing as
| employees of her bank. Being "hacked" is a part of life now,
| and outrage fatigue is real.
| Ray20 wrote:
| > a giant pedophile ring has been exposed that no one in power
| seems interested in doing anything about
|
| But that's not true. The European Union and many other
| countries are taking extreme measures to ensure that what
| happened in the United States never happens with them and they
| are introducing a bunch of different measures to strengthen
| control over society, the media sphere, and other measures to
| ensure that no pedophile rings could be exposed.
| Der_Einzige wrote:
| Really? The UK never even did anything except sweep the LAST
| pedophile ring uncovered under the rug too!
|
| https://en.wikipedia.org/wiki/Rotherham_child_sexual_exploit.
| ..
|
| https://en.wikipedia.org/wiki/Rochdale_child_sex_abuse_ring
|
| https://en.wikipedia.org/wiki/Investigations_into_the_Rother.
| ..
|
| "A 2024 report on child sex exploitation in Rochdale from
| 2004 to 2013 found that there was "compelling evidence" of
| widespread abuse, and that Greater Manchester Police and
| Rochdale Council had failed to properly investigate these
| cases, leaving girls "at the mercy of their abusers". While
| there were successful prosecutions, the report said that the
| investigations carried out during the period covered by the
| report only "scraped the surface" of what had happened, and
| that many abusers had gone unpunished."
| john_strinlai wrote:
| > _The UK never even did anything except sweep the LAST
| pedophile ring uncovered under the rug too!_
|
| the comment you are replying to is written sarcastically,
| ending with: _" to ensure that no pedophile rings could be
| exposed"_
|
| in other words, they agree with what you have written. your
| reply appears to assume the opposite.
| pfdietz wrote:
| Read again what you are responding to.
| imglorp wrote:
| As fatiguing as legal breach notices are to lay people, it's
| equally frustrating as a dev because security is not a
| distinguishing feature we can advertise in our product so we
| can't prioritize it at all. Let the lawyers figure it out later
| seems to be best practice now.
|
| And of course vuln finding is now automated so even if we do a
| good job locking it down this morning, nothing will not keep
| out the next wave tonight.
|
| Plus, our current political atmosphere encourages digital
| chaos, for example gutting CISA.
| philipallstar wrote:
| > a giant pedophile ring has been exposed that no one in power
| seems interested in doing anything about
|
| This was one of the things Trump got 2024 elected on - many
| Republican voters were extremely keen on this being addressed.
| I'm glad Trump's fumbled it now so the Democrats are interested
| in addressing it, though for the wrong reasons.
| vdqtp3 wrote:
| > so the Democrats are interested in addressing it
|
| They're not any more interested in addressing it than the
| existing administration - it's just a talking point like
| everything else. Ammunition to get elected and then put away
| in a dark closet.
| jgeada wrote:
| The issue is also one of agency: the public has absolutely no
| agency in this. There is nothing an ordinary member of the
| public can do to avoid having their data exposed, there is
| nothing they can do to cause corporations to have more robust
| security models nor to cause actual consequences for all the
| executives that chose profit over security at every possible
| decision point.
|
| To the public this becomes like the risk of being hit by
| lightning or being in a car accident, just background noise we
| avoid thinking about as much as possible. It is just the cost
| of living in this economy.
| titzer wrote:
| > Cisco's private GitHub was cloned.
|
| From this,
|
| https://www.sdxcentral.com/news/cisco-source-code-breach-lea...
|
| It sounds like they were/are using GitHub to host company-private
| source code, presumably of high-value.
|
| While it's hard to know exactly the setup (e.g. maybe they are
| running their own instance of GitHub internally), this is your
| reminder that public clouds are not secure, no matter how much
| you pay the maintainers of said clouds.
|
| Internal network compromise is of course always possible, but
| sheesh, it sounds like this list has lots of public cloud
| failures.
| jjmarr wrote:
| > In August 2025, three of the most notorious financially-
| motivated crews on the planet, ShinyHunters, Scattered Spider,
| and LAPSUS$, formally combined into a coordinated alliance widely
| tracked as Scattered LAPSUS$ Hunters (SLH), sometimes called "the
| Trinity of Chaos" (Resecurity; Cyberbit; Infosecurity Magazine;
| The Hacker News; Computer Weekly; ReliaQuest). Scattered Spider
| provides initial access through highly-effective social
| engineering and vishing. ShinyHunters handles exfiltration, leak-
| site management, and extortion. LAPSUS$ contributes its own brand
| of identity-system compromise.
|
| Lmao that cybercriminals are closing M&A deals to create
| vertically integrated SaaS companies.
|
| Do you think anyone was made redundant through kinetic means?
| alephnerd wrote:
| These kinds of groups operate as businesses and in some cases
| government agencies. It would be the same experience as working
| for any other tech company.
| jjmarr wrote:
| I know. There's a sense of schadenfreude that the Russian
| hackers are suffering through a big re-org right now.
| alephnerd wrote:
| Yep, but they'll land on their feet. Probably negotiate an
| ML Infra or SecEng role at Yandex.
| nirav72 wrote:
| Not too long ago, a few gigabytes of data being stolen was a big
| friggin deal. Now they're swiping data in the terabytes or even
| petabytes.
| RajT88 wrote:
| Bad news: All your data with data brokers will be public soon.
|
| Good news: All the data of elected officials will be public
| soon, and we may finally get some regulation.
| cols wrote:
| Add to this the Rockwell Automation attack and you get a
| beautiful Chickens-Coming-Home-To-Roost stew!
|
| https://www.cisa.gov/news-events/cybersecurity-advisories/aa...
| jrm4 wrote:
| As someone who's older, and is just generally gobsmacked all the
| time by the sloppiness in cybersecurity, all of this is just not
| surprising.
|
| Look, love or hate it, here's what happened; a LONG time ago (in
| tech terms) Microsoft and others normalized some very stupid
| practices; when I teach about it I basically illustrate it like
| this: "If I handed you a piece of paper that said 'Go jump off a
| bridge'" will you survive this encounter with me? Because a very
| large, perhaps majority, of computer infrastructure will not.
|
| We managed to put buttons on appliances that don't make the
| appliance explode, but failed to do that in email links, which
| are just buttons.
|
| And then, we still have yet to punish or hold accountable any
| large party who made things this way. Until we do that, keep
| expecting this.
| ryandrake wrote:
| > And then, we still have yet to punish or hold accountable any
| large party who made things this way. Until we do that, keep
| expecting this.
|
| This is the key. No incentive to change. It's always "the
| hacker's fault" and never "the manufacturer's negligence" or
| "the developer's carelessness" or "the user's gullibility."
| Combine this with the currently-prevailing Don't Blame The
| Victim mentality, and it's the perfect environment for never
| improving cybersecurity.
| myself248 wrote:
| But yet, the pigs who built the houses of straw and sticks
| got eaten. The pig who built the house of bricks is seen as
| responsible, even though it took longer and cost more; he
| made the right choice.
|
| The wolf is seen as ever-present. Failure to consider the
| wolf when choosing building materials has consequences.
|
| It blows my mind that this story has been part of our culture
| for centuries, yet we apply exactly the opposite model to
| cybersecurity.
| IsTom wrote:
| But have you thought about the bonus you can get by
| reducing house building costs in Q3?
| stackskipton wrote:
| Yea, CyberSecurity will get fixed when companies are held
| responsible to the point that data breaches have severe
| impact on bottom line.
| john_strinlai wrote:
| > _As someone who 's older, and is just generally gobsmacked
| all the time by the sloppiness in cybersecurity, all of this is
| just not surprising._
|
| as someone who used to work in cybersec (and is also older),
| most of the time (in my experiences) it isnt sloppiness.
|
| 1) people fight tooth and nail against anything that
| inconveniences them. security is almost always going to be an
| inconvenience tradeoff, so it is always fought against. from
| every person and every department. rolling out 2fa was worse
| than pulling teeth, despite it being a single button press
| ("approve") on the phone, once or twice a day (or less).
| c-suite is the worst, demanding exclusions and bypasses. its
| hard to say no to your bosses boss when they refuse to use a
| password manager, refuse to setup 2fa, or whatever the case is.
|
| 2) security offers no immediate or visible return on
| investment. so, it gets little to no positive attention by
| c-suite and even less budget. you end up with underpaid, under-
| qualified, over-worked people trying to figure out which thing
| they might be able secure out of the 10 things that need
| securing. half of them will be tied up trying to explain to
| someone why they cant use the company name as their password or
| begging someone to use the password manager.
|
| even here, a forum of hackers, security is often put in scare
| quotes and almost always mentioned beside the word "theater".
| people brag about still running windows 7, because it was the
| last good windows. antiviruses arent needed. X security feature
| is just a lie so that company Z can control my device. people
| get big mad when a company rolls out mandatory 2fa. and so on.
|
| edit: case in point, on this thread a comment was just posted
| with _" I think you can argue that cybersecurity doesn't really
| matter, in the grand scheme of things."_
| gdrift wrote:
| Freedom, Security, Convenience. Choose two.
| BobaFloutist wrote:
| > once or twice a day (or less).
|
| If that was all it was, people would be a lot less annoyed by
| it.
| jrm4 wrote:
| On 1) -- yes, but that's just how it is: I love the thing I
| read recently like "If people would just." -- okay, you can
| stop there, because people will never "just." But it really
| doesn't matter; you engineer the best you can around that. My
| favorite go to example here is _elevators._ We have
| successfully safety-engineered elevators so well that any
| idiot can shove their hand in front of a two ton door and the
| result will be so harmless that it 's a common practice now.
| Surely we can do that for CLICKING ON LINKS.
|
| 2) is harder, for sure. Great point.
| jancsika wrote:
| > We managed to put buttons on appliances that don't make the
| appliance explode, but failed to do that in email links, which
| are just buttons.
|
| Reminds me of the time I accidentally entered my bank PIN into
| my washing machine and hackers ran off with $500 of my money.
|
| What puzzled me most was the time and energy put into the
| attack, all for the off chance of a successful attack. Security
| footage showed them removing my washing while I was at work and
| replacing it with one the hackers controlled. This "phishing
| machine"-- as I now call it-- was apparently fitted with some
| kind of LoraWAN device waiting for me to unwittingly enter my
| PIN to unlock. Something my washing machine never asked me to
| do before, btw, but I did it anyway (like an idiot).
|
| I changed my bank PIN, but I still use the old PIN to run the
| phishing machine-- funny enough it's fully functional and in
| fact works better than the old one.
|
| All said, the hackers probably lost $1000 on the deal. Police
| said this is a _very_ common attack on washing machine buttons
| throughout the Southeast, so I 'm wondering if part of our
| current economic stagnation is due hackers going into
| bankruptcy from this.
| FuriouslyAdrift wrote:
| We just caught our company president, CFO, and head of sales
| using smuggled Starlink dishes on the roof with wide open wifi
| because our firewall "broke things".
|
| Thank goodness for all the other layers... the firewall is just
| doing basic hygiene. The SASE and zero trust policies are doing
| the heavy lifting.
|
| No one want's to follow any rules and when caught out do not
| want to take respnsibility for their own actions.
|
| Since it was an open wifi, I hope we get nailed for hosting
| child porn or cryptocoin scams... ffs
| burningChrome wrote:
| >>> We just caught our company president, CFO, and head of
| sales using smuggled Starlink dishes on the roof with wide
| open wifi because our firewall "broke things".
|
| Wait, what?!?! I gotta hear this story. I have so many
| questions like how in the hell do you casually smuggle in not
| one, but several Starlink dishes?
| stalfie wrote:
| If I can play devils advocate in favor of public disinterest
| about these events, I think you can argue that cybersecurity
| doesn't really matter, in the grand scheme of things. At least
| data exfiltration.
|
| What would the consequences for humanity be if every single
| electronic patient record was leaked onto the internet?
| Immediately hugely bad for some groups, unfortunately. After a
| good deal of embarrassment and drama however, some severe,
| perhaps the net effect is positive. It would most likely
| facilitate a lot of scientific inquiry. A lot of people,
| especially in medical deserts, also use Chatgpt as an md.
| Providing AI companies with high quality medical data is actually
| a public service.
|
| So it goes for many things in life, and except for financial and
| destructive wipe attacks, data security is mostly about
| protecting the IP of incumbents, which is somewhere between
| irrelevant and a net negative. It's hard to say what the long
| term consequences of the IP system breaking down would be, but
| there is a good argument to be made that it's not necessarily
| bad.
|
| As for individual people, most don't really care or are resigned
| to the fact that Google already knows everything about them, and
| probably abstractly enjoy the fact that a major company gets
| brought down to their reality. Plenty of societies have extremely
| collectivistic mindsets of public info being shared, like
| Scandinavian countries having public tax filings, and they work
| just fine.
|
| I think most people would secretly relish the outcomes of
| everything leaking everywhere. Just like people relish the
| Epstein files being released, and probably would have loved an
| unredacted version being leaked. Secrets are something human
| beings naturally gravitate towards to dig up and sharing, and
| this is actually for good, sensible reasons. Evolution has simply
| favored groups that did not hoard knowledge, at least not
| internally. There is a reason the scientific method has openness
| as a virtue, and is arguably one of the pillars that has carried
| humanity out of the dark ages.
| bradishungry wrote:
| It would be terrible, I don't think you're thinking about what
| kinds of discrimination can happen due to things like medical
| records. You can have laws in place to prevent it but if
| someone can freely see your entire medical history then people
| WILL take advantage of that. Not to mention how things like
| citizens traveling to states where abortion is legal, or if a
| parent disagrees with an operation could affect someone if
| things are public. This is only talking about medical records,
| too, the implications of other kinds of espionage have
| significant repercussions as well. Cybersecurity absolutely
| does matter
| stalfie wrote:
| Actually you're right, upon reflection the medical records
| example is a terrible one, given the proclivities of many
| governments and/or vindictive mobs. Although the greater
| issue here is that there exists governments that care about
| abortions, and the fact people accept living under their
| reign one way or another. Unfortunately those government are
| often in positions of power to figure this out and punish
| individuals no matter what.
|
| And I'd just like to underline the fact that this is truly a
| devil's advocate position, not something I'd argue strongly
| for.
|
| But for the LLM training data company, does that leak matter?
| I guess that depends on your stance about AI proliferation
| and safety. But if you don't it's at worst a boost for open
| source LLMs. Rockstar? A great deal of hard work has surely
| gone into GTA-6 between all the union busting but, but it
| hardly matters for humanity what particular game people use
| to entertain themselves. And the medical device company,
| although the wipe part is truly just senseless destruction,
| actually might benefit humanity more if a few bootleg
| factories of their products appear.
|
| Many of these are very stretched scenarios. But for instance
| in the case of espionage, the problem is not the fact that
| people are spying, the problem is that there is a war. And
| the more nefarious regimes tend to depend more on secrecy and
| lies in order to perpetuate themselves. If total transparency
| was applied to all governments equally, most democracies
| would be positively affected. The problem is not the leakage
| of the Epstein files. It's that this kind of activity could
| occur in secret and remained covered up.
| redanddead wrote:
| This is the most pragmatic answer. It was valued fairly. Those
| who stand to lose got spooked. For consumers we're looking at
| less privacy/new dangers in a globally connected world. We'll
| need to adapt, these corporations are trying to adapt to new
| risks. The labs will be held liable for corporate and sovereign
| losses when the damage is big enough, like meta/facebook
| recently
| BoppreH wrote:
| It's very different for Google, the giant faceless corporation,
| to know someone's search history. Making it _public_ is a
| different ballgame.
|
| I can't believe I have to say this, but you can't simply delete
| an important facet of society (expectation of privacy) and
| expect things to turn out alright. People will still have
| hangups around prudish topics and traditions. And privacy has
| always worked as an escape hatch for people in bad situations,
| either locally (controlling parents and partners) or society-
| wide (facist governments, genocides).
|
| Just because we can imagine a society where this information is
| public and everything still works, doesn't mean that there's a
| path from here to there.
| ckcheng wrote:
| The strangest thing I found is:
|
| > on April 7, 2026 ... U.S. Treasury Secretary Scott Bessent and
| Federal Reserve Chair Jerome Powell convened an urgent, in-person
| meeting in Washington with the chief executives of [major US
| banks] to brief them directly on the cyber risks posed by
| [Anthropic's] Mythos
|
| Then a similar meeting happened with the Canadian Financial
| Sector Resiliency Group (i.e. the Bank of Canada, the Canadian
| government's Department of Finance, the Canadian Deposit
| Insurance Corporation (Canada's FDIC) and Canada's six major
| banks).
|
| Multiple central banks don't usually do that right?
|
| https://www.ctvnews.ca/sci-tech/article/anthropics-new-ai-mo...
| sybercecurity wrote:
| Two possibilities:
|
| 1. Fear that a major vulnerability is found in a commonly used
| software package that puts multiple major banks and e-commerce
| sites at risk
|
| 2. Fear that major vulnerabilities are found in multiple,
| widely used software packages that lead to market downturn as
| IT company stocks crash.
|
| Probably others as well. Sounds more like a brief on worst-case
| scenarios that may happen and how they would effect the US
| banking sector. This is an important mid-year election this
| year too, so any big economic shock would be bad for the GOP.
| iugtmkbdfil834 wrote:
| That, or, not completely unlikely, he was shown all the
| vulnerabilities across all old software that banking, finance
| et al use daily and are unlikely to ever update. I am only
| half joking. There is a reason I think some people should
| stick to their areas of expertise.
| eastbound wrote:
| It currently works because those vulnerabilities are not
| exploited en masse. With AI, they can. It does change the
| game.
| iugtmkbdfil834 wrote:
| I am personally of several minds about it. However, I am
| not an expert in the field. I can somewhat reliably opine
| on humans and human behavior in general, but I concede
| that is harder to consider the impact in aggregate.
| dboreham wrote:
| Good job Anthropic products can't be used by the government
| then.
| Cider9986 wrote:
| How can money stolen from bank accounts even be offramped? It
| makes perfect sense to me how it works within crypto--
| transactions are not reversible. But how does this work in
| trad-fi, can't any money transferred just be sent back by the
| banks by editing the ledgers?
| iainctduncan wrote:
| As part of my work in technical diligence, I create medium-long
| form content marketing material on topics germane to PE
| investment in tech. In the last six months I did a series (not
| yet published) on the state of security in the age of gen-AI.
|
| Basically, we are entering the ransomware apocalypse. It is
| insane what a godsend gen-AI has been to the cybercrime sector.
| When all you need to do is make something good enough to fool
| some of the people some of the time, genAI is _perfect_.
|
| Things that used to work reliably - like trusting google ads or
| sponsored links not to be malvertizing sites - are meaningless
| now that gangs can trivially spin up networks of _thousands_ of
| fake interacting sites and linked profiles to sneak by fraud
| detection. Phishing attacks are ridiculously sophisticated,
| combining voice, text, and video impersonation. Supply chain
| attacks are going to mean package managers are handgrenades.
| Ransomware gangs are running full on SaSS services allowing
| script kiddies access to big gun material. Attacks that were
| previously only in reach of nation-state-sponsored actors are now
| available for peanuts. And all of this is going to worse because
| of everyone and their dog using gen-AI to pump out huge amounts
| of vulnerable code. And then there is the world of prompt
| engineering for data exfiltration...
|
| If you are young and wanting a promising trade in tech, security
| would absolutely be a good choice. Shit is going to get CRAZY.
| alephnerd wrote:
| > If you are young and wanting a promising trade in tech,
| security would absolutely be a good choice. Shit is going to
| get CRAZY.
|
| Yes, but you can't be a CISSP or SOC monkey - that has no
| future.
|
| You need to be an _actual_ Software Engineer who understands
| development fundamentals, OS internals, web dev fundamentals,
| algorithms, etc _as well as_ offensive and defensive concepts.
|
| To many "cybersecurity" graduates in North America aren't even
| qualified to do L1 IT Helpdesk, which is a shame because the IT
| to Security talent pipeline is critical (along with the SRE,
| SWE, and ML to security pipeline).
| iainctduncan wrote:
| Definitely agree. I guess I should have specified I meant
| "real programmer who wants a career". ;-)
| sdevonoes wrote:
| As an "actual" software engineer, what do you recommend me to
| read to work in cybersecurity? Assume I have a solid
| background in OS internals, algos, networking, software
| engineering. I have never worked in cybersecurity though (I
| have never reversed engineered anything)
| operatingthetan wrote:
| This just seems like the result is people are going to be
| driven off the internet. It will simply not be safe for the
| layperson.
| idiotsecant wrote:
| No man lands between walled gardens
| yoyohello13 wrote:
| Literally the Blackwall from Cyberpunk 2077.
| PradeetPatel wrote:
| It might not be a bad thing if we have an Internet for
| humans, and a segmented Internet for AI.
| kgwxd wrote:
| Who's enforcing that rule?
| pesus wrote:
| Sounds like an ultimately good thing to me. It was an
| interesting experiment, but the negatives largely outweigh
| the positives at this point.
|
| (I do realize the irony of writing this on HN, but I digress)
| babycheetahbite wrote:
| Just in general, the outcome of where technology is going may
| spur many to reduce their usage in favor of "the real world";
| I agree it might be a good thing.
| tokioyoyo wrote:
| Most people's internet is Instagram + Games from AppStore +
| TikTok + Netflix + Banking Apps. Everything is within
| specific walls and guardrails.
| RajT88 wrote:
| Oh, we're back to not being able to trust Google Ads again?
|
| I recall there being Malvertising campaign problems ~12-15
| years ago or so, and then they seemed to get on top of it.
| iainctduncan wrote:
| typosquatting is shaping up to be a serious problem again.
| sifar wrote:
| I get amused that people don't realize that genAI is an
| existential threat to the internet and everything that has been
| built on it.
|
| 1) One can no longer trust things out on the web. 2) One no
| longer needs things out on the web.
|
| For 1), I hope the defense mechanism kicks in time to bake
| security into our computing culture and pervades throughout the
| stack.
| zolland wrote:
| I can't tell if this is satire or not
| ellg wrote:
| You were trusting things on the internet before LLM's?
| nine_k wrote:
| The Internet is quite fine at delivering packages over
| encrypted channels which I can trust. (Except where
| interdicted by governments, like in China, India, Russia,
| Turkyie,..)
|
| The _Web_ is a rather different beast, but the question is
| not "can you trust the Internet", but "can you trust a
| random website", and now even "can you trust a previously
| trustworthy website".
|
| You of course should not trust any pictures or videos as
| critical evidence, they should be corroborated by other
| means. But this has been true for several years now.
| sifar wrote:
| To clarify, I meant it from a lay person's perspective. I
| do realize that one can argue if the average person will
| have developed this awareness now. The difference this
| time, I feel, is that the genAI tools are widely available
| for normal people to experiment with which will hopefully
| help develop this visceral feeling.
| pizza234 wrote:
| Careful system administration and web browsing were
| relatively safe; nowadays, even upgrading the local
| libraries carries risk that _must_ be assessed.
| UncleMeat wrote:
| While there genuinely was fake content and astroturfed
| material on the web prior to LLMs, the cost to produce this
| stuff has fallen enormously. A major corporation or a state
| actor might pay a bunch of money for inorganic content but
| it was hard for some rando in Estonia to spin up a network
| of fake content to monetize on tiktok or whatever. This
| leads to way more fake content about a much wider range of
| topics.
| dvfjsdhgfv wrote:
| > 1) One can no longer trust things out on the web.
|
| I assume you mean software, because we haven't been trusting
| other things on the web already for decades.
|
| As for software, everybody interested knew about inherent
| insecurity of supply chain of modern software but the
| solutions proposed were too expensive. We need an order of
| magnitude more money lost for organizations to start
| switching from today's security theater to a model with
| security built in.
| sifar wrote:
| In general and for software in particular too :). For
| general see my response to ellg.
|
| Even though we were aware of the insecurity of the supply
| chain, 1) In practice we tend to ignore it except for
| mission critical cases. We still do. 2) Autonomous
| vulnerability/exploitation at scale was difficult and
| reserved for high value targets.
|
| What you said will be accelerated by 2) now.
| strombofulous wrote:
| > If you are young and wanting a promising trade in tech,
| security would absolutely be a good choice.
|
| If AI is capable of performing these attacks, what would stop
| AI from replacing the security engineers?
| chucky_z wrote:
| The more I use AI and my workplace buys into it, the more I'm
| doing person to person work in a security context.
| iainctduncan wrote:
| exactly
| lelanthran wrote:
| > If AI is capable of performing these attacks, what would
| stop AI from replacing the security engineers?
|
| Because the threat model is one-sided - if an AI attack
| fails, the controller simply moves to the next target. If an
| AI _defense_ fails, the victim is fucked.
|
| Therefore, there is _still value_ in being the human in Cyber
| Security (however you are supposed to capitalise that!)
|
| There are still protections and mitigations that targets can
| do, but those things require humans. The things that
| attackers can do require no humans in the loop.
| _aavaa_ wrote:
| Red team has to be lucky once, blue team has to be perfect.
| How many places take red teaming seriously now?
|
| Compare how fast real attackers could iterate vs the
| defenders.
| charcircuit wrote:
| Stealing a bitcoin wallet by cracking the private key for
| it also requires red team to be lucky once. Once AI
| security gets to the point where the probability is
| infinitesimal for causing actual harm to the business it
| will be fine.
| _aavaa_ wrote:
| Yes, and on an infinite time horizon we are all dead.
|
| It's the time between then and now that we're talking
| about.
| charcircuit wrote:
| Existing concepts like defense in depth make it
| exponentially harder for an AI to build a full exploit
| chain. Even with a full exploit chain with one mistake
| you'll trigger a detection system which can fool your
| attack.
| UncleMeat wrote:
| This is less true than it seems. It is pretty rare to go
| from vuln to simple exploit for systems that people care
| about. There are plenty of vulns in chrome or whatever that
| were difficult to actually weaponize because you need just
| the right kind of gadgets to create a sandbox escape and
| the vuln only lets you write to ineffective memory
| addresses.
| dvfjsdhgfv wrote:
| LLM-based software is just another layer to be hacked.
| weare138 wrote:
| They're not and they won't. I'm from genx and have a
| background in infosec. I don't agree that AI is the cause of
| this sudden surge in activity or if this is even a sudden
| surge. This stuff was always occurring if you were paying
| attention. It just making the mainstream news now.
|
| Geopolitics is the cause of the recent uptick in activity.
| Many of these groups are state sponsored or just fronts for
| nation-states themselves. genAI just makes it easier for
| people further down the chain to go after low hanging fruit.
|
| The most significant impact genAI is having on infosec is
| creating work for those people in infosec through vibe coding
| and turning untested AI systems loose on internal networks.
| genAI just lets developers and admins shoot themselves in the
| foot faster. genAI is an artificial intern.
| idiotsecant wrote:
| How can open source software possibly survive this?
| Tepix wrote:
| Open source has advantages over closed source: You can
| demonstrate your sSDLC whereas with closed source you have to
| believe the vendor.
| baq wrote:
| There's no closed source software anymore, clankers are
| mighty good at decompiling.
| cyanydeez wrote:
| in the upside, the current Adminstration is making most of that
| legit grift, so investing in homegrown fruad should be on every
| PE's 2026 wishlist
| mmarian wrote:
| > If you are young and wanting a promising trade in tech,
| security would absolutely be a good choice. Shit is going to
| get CRAZY.
|
| I personally would still recommend software engineering.
| Security in far majority of places is still checkbox and cost
| driven. Outrage happens around incidents, but rarely are people
| willing to invest meaningful in their people. Security SaaS on
| the other hand, is doing great, so anything driving revenue
| there is good.
| zakki wrote:
| Do you have some pointers to start advancing in security world?
| lubujackson wrote:
| I have this mental model that the natural state of the web is to
| act like an organism that is continuously assaulted by viruses -
| sometimes that is SEO spam, sometimes actual viruses, sometimes a
| game-changing shift like AI vulnerability scanning. The pattern
| is the organism gets assaulted, digests the virus and comes back
| a bit tougher with more layers of complexity and defensiveness.
|
| I think right now we are waiting for the Morris worm
| (https://en.wikipedia.org/wiki/Morris_worm) equivalent shock to
| the system, but it is likely to be much, much worse and much more
| specific. I expect something that will make DOGE stealing SSNs
| look kind of tame. Something like every private GitHub exposed,
| every Visa card data and history exposed, every Mac injected with
| a rootkit, etc. It's like waiting for the plot from Sneakers to
| manifest.
|
| For all the security we have built over the last 50 years, it has
| been impossible (or nearly so) to lock down any web-accessible
| content. It is a structural issue at a certain level of
| complexity, the surface area is just far too wide for any focused
| effort. Aside from direct 0 day vulnerabilities in software there
| are vulnerabilities in core libraries, frameworks, CI/CD, cloud
| services, hardware bugs, gaps between services, permission
| vectors, etc.
|
| The U.S. has relied on the legal system to allow our insane
| credit card system to persist, where security by obscurity
| (knowing someone's CC#) is the main deterrent to abuse. I need a
| complex password to access any website, but CC#s are flying free.
| I think the combination of easy worldwide vulnerability scanning
| and U.S.'s focus on pissing every country off is going to lead to
| significant and unending asymmetrical warfare. If our gov't has
| been co-opted by big business, big business is going to become
| the target. As we have seen with Iran with Hormuz and Ukraine
| with drone strikes, it isn't so hard for small countries to fuck
| up global systems.
|
| We are entering a 90s-style phase where any script kiddie can
| cause massive disruptions. Trump likes to threaten NUCLEAR but
| security issues could potentially cause even more death and
| destruction - overwhelm the energy grid, open dams, crash air
| traffic control communications, etc. There is lots of concern
| over the oligarchy owning AI and keeping it for themselves, but
| the more immediate risk is that any country can potentially lash
| out with disruptive actions.
|
| There has been a retreat from globalization since COVID. I
| wouldn't be surprised if that extends to global internet
| communications as well. Internet traffic between countries might
| soon be severely restricted, that's the last line of defense we
| actually have if this goes as badly as Anthropic is implying.
| mring33621 wrote:
| Or not
| __alexs wrote:
| Anthropic's marketing team are terrifyingly good. I wonder if
| Opus came up with this plan?
| 0xdeadbeefbabe wrote:
| This AI and security genre really has legs.
| theincredulousk wrote:
| Cultivating and leveraging fear is truly a cornerstone of
| Security(tm).
|
| I don't think the claims about capability are ridiculous. The
| idea that the general capability is proprietary and that it
| will be exclusive to the trusted partners of one company is
| ridiculous.
| HDThoreaun wrote:
| All the big tech companies are getting access to mythos. If
| anthropic is blowing smoke with regards to its ability to find
| vulnerabilities it will leak very soon.
| gcr wrote:
| If cybersecurity is slowly ramping up in complexity, isn't the
| statement "we're living through the most consequential hundred
| days in history" always trivially true?
| tptacek wrote:
| Yep.
| semiquaver wrote:
| I know this ship has sailed but the modern term "cyber" usually
| referring to offensive or defensive software technology
| (presumably short for cybersecurity) drives me up a wall. It's
| even worse than "crypto". I find that people who use this term
| are, ceteris paribus, likelier to be full of crap.
| jjtheblunt wrote:
| "order of magnitude" seems to also be silly-speak very often,
| trying to sound more technical than "ten times".
|
| i suppose it is similar to "exponentially" being used when it
| doesn't mean exponentially.
| dvfjsdhgfv wrote:
| > "order of magnitude" seems to also be silly-speak very
| often, trying to sound more technical than "ten times".
|
| But these are two different things. If I hear "ten times" I
| assume the person actually means ten times; when they say "an
| order of magnitude", I'm aware they might mean 8 or 12.
| jjtheblunt wrote:
| agreed...thought of that after writing it, and thanks for
| noting it too.
|
| i thought the order of magnitude is often hipster phrasing,
| even on HN at times, but, when actually intended, it's like
| saying floor(log_base10( whatever )), so the ten times
| thing would have to be "roughly ten times" for example, to
| be comparable.
|
| Also, in some contexts the base isn't presumed to be 10, of
| course, though around here in loose jargon that's usually
| what folks are saying.
| tptacek wrote:
| It's so firmly established that, just like crypto, making a
| stink about it says more about the objector. I don't like it
| either! "Cyber" is cringe, and "crypto" should mean
| "cryptography". But I'm not the king of usage, and both those
| terms have new meanings.
| foobarian wrote:
| At least this site managed to not get shut down because it
| appears to foster timely communication to cybercriminals :D
| z500 wrote:
| At least we hardly ever have to hear anyone say "cyberspace"
| anymore
| strogonoff wrote:
| Each time I see "cyber" used in a headline (so far it
| happened once) without any other hints that it's about
| security, I am initially confused. What is wrong with the
| term "infosec", exactly? Clear, logical, well-known and most
| widely used term to mean--you guessed it-- _information
| security_.
|
| There does not have to be a term committee or term police for
| colloquial use, but to me referring to somebody calling it
| out when terminology makes no sense as "making a stink" says
| something about the objector.
| halJordan wrote:
| Cyber expands way past infosec. And that's the crux of the
| problem with the complainers these days. You don't
| understand the full picture. You've convinced yourself you
| do. And so you tilt at windmills like an idiot.
| semiquaver wrote:
| Ok, what's cyber to you?
| spacechild1 wrote:
| Is it really? I actually didn't understand the headline
| because I have never seen "cyber" been used this way. It's
| pretty stupid and I think we have all the rights to push
| back.
| dmurray wrote:
| Wanna cyber?
| MWil wrote:
| only if we crypto first
| DocTomoe wrote:
| As an old school hacker ... I feel your pain.
|
| Words change meaning all the time. I vividly remember when
| 'coder' was used as a diminutive, much like the later script-
| kiddie or code-monkey - "A software developer of little skill
| or knowledge". Today, people habitually call themselves that.
| halJordan wrote:
| The irony of calling yourself a hacker while complaining
| about new words being cringe when hacker is the epitome and
| grandfather of all cringe names in this domain.
| zarzavat wrote:
| The way I always understood it is that "coder" is a broad
| term that includes writing non-turing complete languages like
| HTML and CSS as well as turing complete languages, whereas
| the term "programmer" is more specific to writing executable
| code.
|
| Nowadays I'm not sure anyone is employed writing only HTML
| and CSS but in the 90s and 00s it was definitely a
| distinction worth making.
| tosser12344321 wrote:
| I'm a head of security, great career, did engineering into
| management, made a tidy living doing advanced work as a risk
| plumber across companies that have been relevant. I've built
| great teams, met and solved hard IR, delved into the real reaches
| of vuln research, other neckbeard things, got paid very well
| along the way. Seen and worked on the APT issues.
|
| More or less, I am the attractive resume, and: the game has
| changed folks.
|
| For what it is worth, I am taking my ball and going home in about
| 12 months. I've saved enough, locked in a perma-middle class
| lifestyle in a great nondescript city, and swapping over to
| offensive consulting and a AI-free, non-tech trade that won't
| take too long to get into - think a PA, nurse, plumber, etc.
|
| I'm not quite old enough and with the end of responsibilities as
| to FIRE, but I can read the writing on the wall enough to
| understand an AI-proof FI needs to be locked in before everyone
| else realizes the same. Many others in sec are feeling this.
|
| I think tech will find security pros willing to throw themselves
| into the fray for pay and optimism. There are others like me who
| are extracting their final nuts. There are others who have
| golden-handcuffed themselves into this ride with their mortgages
| and private school tuitions. And I'm sure some others will stick
| it out. There will also be an AI-enabled version of sec eng soon
| enough.
|
| But if private sector doesn't wake up to AI integrations -
| internal doc rollouts hoovering up PII that wasn't supposed to be
| stored there, externally-facing customer support portals social
| engineered and pivoted into, PRs via Slack comment via marketing
| hires who are ATO'd - this is going to be a 1990's-style BBQ
| where 0days on critical systems are dropped at happy hours at
| conferences nightly.
|
| And: your security teams are going to be burned out, banking up,
| and quitting. The risk acceptances, the double-speak, the slow-
| rolling, the half-baked risk thinking for engineering and product
| leads, the corners cut, the public endpoints opened up just this
| one time - that's going to be enough rope, and already is enough,
| to hang yourself in this offensive context that's building now.
|
| It is deeply humorous that SWE and engineering leadership has
| worked itself into this position via its AI push to unemploy
| itself while thinking it's the 1x white collar job exempt from
| automation threats.
|
| All it'll take is another recession like '08, and the leaves get
| shaken off the trees finally. Thankfully there is only one (wait,
| there are two probably), thankfully there are only two-to-three
| (wait, there are like 10) systemic market threats right now.
| theturtlemoves wrote:
| > a AI-free, non-tech trade that won't take too long to get
| into - think a PA, nurse, plumber, etc.
|
| I'm not sure if personal assistant or nurse are going to be AI-
| free. Plumber, welder, bricklayer, pest exterminator, sure.
| Don't underestimate the downsides of physical labor, though.
| Low pay and backbreaking.
|
| What writing on the wall? If anything, I think you'll be more
| needed, not less, in times to come.
| tosser12344321 wrote:
| > I think you'll be more needed, not less, in times to come
|
| Ya I get the need but you miss the point - no, you can't pay
| me anymore to wade into that and own risk, beyond a
| consulting context with low skin in the game.
|
| There is a wave of senior leads thinking like this, because
| the knife's edge of "enough risk to game it for pay" finally
| tilted too far, and the career has changed.
|
| In terms of going home after work and not yelling at my kids
| and spouse due to work stress due to the 10th 0day in a week
| on my corporate VPN/my retail-facing app/my..., there's a
| real QoL issue to consider. Many outside of security
| consistently misunderstands the mental health/career
| satisfaction/pay triad.
| operatingthetan wrote:
| >Ya I get the need but you miss the point - no, you can't
| pay me anymore to wade into that and own risk, beyond a
| consulting context with low skin in the game.
|
| In a situation of triage, "owning risk" is off the table.
| chasd00 wrote:
| > beyond a consulting context
|
| "Consulting, if you're not a part of the solution there's
| money to be made prolonging the problem" - Despair.com :)
|
| /i'm a consultant
| tosser12344321 wrote:
| The well-paved path into vCISO life
| 01100011 wrote:
| > Low pay
|
| I see you haven't hired a tradesman in the USA lately...
|
| Sure, my body would hate me for it, but as a plumber I could
| make about half what I make as a SWE and given the
| progressive tax structure and business write-offs I'd
| probably net a comparable salary.
| bottlepalm wrote:
| I'm starting to think anyone who knows anything about software
| engineering has a moral obligation to step up and defend
| against what's coming. I think the world needs us more than
| ever, this is a critical time that can go one way or the other.
| We need to use AI to defend and protect ourselves and the ones
| who can't protect themselves against malevolent AI and its
| users.
| tosser12344321 wrote:
| I wish there was a medium that would feel like it would work
| for this.
| semiquaver wrote:
| How?
| bottlepalm wrote:
| Working for companies doing it already, starting companies
| to do it, working free on open source project to hammer
| them down, or creating your own open source software to aid
| in AI defense.
| dboreham wrote:
| Like we did for electronic voting?
| rtdq wrote:
| There are two polar opposite vibes in this comment section: one
| guy above is calling FOMO, we should all get into the security
| trade, and yours is FUD.
|
| I hope this all lands somewhere in the middle but honestly who
| knows at this point.
| tosser12344321 wrote:
| I'd suggest talking to people in the security trade!
|
| And if you're planning it, plan it soon b/c vendors like
| Dropzone are carving out the entry sec eng ops/ir jobs in-
| house or at the MSPs, and Trail of Bits skills foss on GH are
| carving out the 2-3x extra $3-400k TC line sec eng roles .
| burningChrome wrote:
| This is huge and something I've been hearing a lot of rumblings
| about.
|
| I just did some quick research:
|
| - ~4.8 million unfilled cybersecurity roles globally as of
| 2025-2026
|
| - Global workforce ~5.5 million, but ~10.2 million needed to
| meet demand
|
| Not to mention the growth in the industry has slowed to ~0.1%
| year over year and you're seeing those shortages are outpacing
| the current workforce. Add in the most senior folks like
| yourself are just noping out and leaving the industry wholesale
| is troubling and unsettling.
|
| Its not surprising we're seeing an unprecedented level of
| successful attacks. We simply don't have the resources to keep
| up with the criminals/hackers out there who are moving
| significantly faster than the companies they are targeting.
|
| As others have pointed out, I'm not sure how this can get
| anything other than much worse in the near future.
| zipy124 wrote:
| Being a cyber criminal pays many multiplies of working in
| cyber, as it already is with legal offensive cyber paying far
| better than defensive cyber. Capitalism going to capitalism.
| Especially since the risk of cyber crime is so much lower
| than physical crime, with your ability to commit it cross
| border, and backed by a nation state it is unsurprising it is
| a growing problem.
| 01100011 wrote:
| I totally appreciate this take and have thought something
| similar but I am old enough to be familiar with the part of my
| brain responsible for these thoughts and know it has a long
| track record of being horribly wrong.
|
| Sure, hedge your bets. Get financially secure. But also
| consider that "nothing ever happens" is usually correct and the
| world has a way of ensuring things keep going in the direction
| they have to in order to give stability to the establishment
| (which we are generally a part of).
| tosser12344321 wrote:
| I've thought about that as well - what derails this, what
| invalidates the unstoppable forward march? That is often how
| the world works. City real estate costs were flying up year
| after year after year, and others rust-belting, until Covid
| and remote work, for example.
|
| So, what can derail AI out of left field? Maybe building DCs
| for it in Arizona and EMEA can, for one.... choosing very
| "water-rich" locations there for water-cooled systems.
|
| So, how could this land longterm, assuming AI works sort of
| good, sort of bad against the use cases? The real questions
| here for industry people though should be this:
|
| 1) How does this play out, over the 5-10 yrs we have to see
| it occur of trying it/redoing it/trying a new version/going
| back to the old version, all the while it's occurring over my
| career, all the while when I have bills to pay and
| relationships to maintain.
|
| Ans: I think that's a hell of a lot of financial and
| employment stress induced on us by people who don't
| understand the tech they're rolling out, the state change
| that's occurring, and don't need to deal with the
| consequences. All the while, I go mid career, to late career,
| dealing with what AI can actually do in the background.
|
| 2) What is actually going to work wrt being relevant to my
| job?
|
| Ans: I think what actually works is the vuln research aspect
| of AI, feedback loops rapidly, rapidly speeding up on that.
|
| And, what is the most stressful, obnoxious, high burnout part
| of the job - sec arch and vuln remediation, or IR and vuln
| response. Both about to go on overddrive, and already are if
| you're minding bug bounties and IR these days.
|
| 3) Has this happened to other industries, how did it go?
|
| Ans: trading, trading, trading, trading. Check it out.
| 01100011 wrote:
| I don't know what derails it, I just know that the line on
| the chart going up or down rarely goes straight. AI might
| finally be the thing that results in permanent exponential
| growth and not a sigmoid, or maybe it hits some limits.
| Maybe those limits are on the human side(our ability to use
| it, regulatory, social backlash, etc). Maybe management
| tries to cut out the tech folks only to result in a tangled
| mess of crap that only we can help them untangle? Maybe the
| folks with background knowledge will suddenly be needed en
| masse to control and leverage AI?
|
| We are, for example, about to grow the reach of tech even
| further thanks to AI. A large percentage of future warfare,
| for instance, will now be taken over by tech. If humanoid
| robots get gud, there's a whole 'nother world of
| applications that will probably need people to specify,
| test, improve, etc.
|
| Sure, on the one hand I think the value of writing code
| will probably go to zero in ten years(although some
| applications explicitly forbid AI coding like some critical
| infra or space stuff), but writing code is a small part of
| many SWE's jobs. AI currently still needs to be told what
| to build and how to make a cohesive, sensible product.
| Maybe that changes, maybe it doesn't. But the path to
| eliminating human work is not short or clear-cut.
| chasd00 wrote:
| i've been saying there's going to be some interesting "computer
| glitches" in the news over the next few years. We've already
| had one where someone convinced an AI to sell them airline
| tickets for $1. I expect many more strange bugs, some being
| very bad, in the future.
| mihaaly wrote:
| Feels like that there was a World War started on smaller spark
| than some of those in the OP in a tense world. And this world
| is tense again, very tense.
| myth_drannon wrote:
| Looking at the Israeli startup scene, there is a huge surge in
| cybersecurity investments (especially agentic security) in the
| last couple of months, looks very abnormal.
|
| https://www.calcalistech.com/ctechnews/article/hy8t7fcobe
| alephnerd wrote:
| There's nothing abnormal about that.
|
| These were all funded 2-3 years ago (heck I participated in
| some of these). Companies only go out of stealth when they are
| publicly announcing their Series A (usually right around the
| time of a major buyer event like BSides/RSA or DEFCON/Blackhat.
|
| Funding rounds usually happen around 5-6 months before they get
| announced on TechCrunch or Calcalistech becuase such
| information are a signal to competition about a specific
| approach. It's also a massive distraction from building,
| because then you have to deal with media, press releases, and
| actually have a product marketing team. You don't want to do
| this until you can hire a couple PMs and PMMs (which is usually
| around the seed-to-series A transition becuase you will have
| hit the $5M ARR mark by then).
|
| This how stuff is done here in SV as well and has been for
| decades.
| KIFulgore wrote:
| I miss the days when the big security concern was quantum
| breaking contemporary encryption. Air gaps and local stacks are
| overdue for a comeback.
| Animats wrote:
| Even that may not work. See Stuxnet.[1]
|
| [1] https://en.wikipedia.org/wiki/Stuxnet
| KIFulgore wrote:
| Yep, there is always the human factor. Leave a USB drive in a
| parking lot, someone will insert it. You don't even need an
| obvious drive anymore, a malicious cable will suffice.
| Animats wrote:
| Almost all those events were on Hacker News. This hasn't been a
| secret.
|
| Companies need to get serious about levels of security. Only some
| things need to be protected, and you have to accept a substantial
| level of inconvenience and cost for those items. In my aerospace
| days, we had a bidding rule of thumb that running a project at
| SECRET doubled the cost. Running a project at TOP SECRET had an
| even bigger cost multiplier. A surprising amount of material was
| not classified at all, for cost reasons.
|
| Banks and credit card processors get this. Most other businesses
| don't.
| halJordan wrote:
| They've been on HN, but that's the author's point. Even this
| article on HN- the top comment is a series of complaints about
| "hurr durr ai needs to get off muh lawn"
|
| The point is that the people, who self-identify as the ones the
| author is supposedly asking for help, are the ones who are
| refusing to acknowledge the elephant in the room so they can
| feel smug. Just like your "but i read about every incident
| mentioned, where's my cookie"
| themafia wrote:
| > And yet, the public conversation around them has been quiet to
| the point of being strange.
|
| These events aren't new or novel anymore. The fact that the news
| does or does not report on something is indicative of editorial
| prerogatives and nothing more.
|
| > This is a curious observation more than a complaint.
|
| We went from 25% of the world population using the internet to
| now more than 80% are on the internet. More people understand the
| fundamental issue, and so are uninterested by it, so for-profit
| publications will not cover it.
| CoryOndrejka wrote:
| Combine every attack being a social engineering attack plus
| foundational model hacking-fu and we're in a shocking
| _interesting_ place. Identity itself becomes a pretty interesting
| opportunity /threat. Wrote an oped [1] with friends from Badge on
| this topic 6 months ago.
|
| [1]: https://idtechwire.com/opinion-in-an-ai-world-every-
| attack-i...
| xtracto wrote:
| A couple of days ago I was thinking about something related to
| this: How would the "computing" space look like once we get to
| the ultimate evolution/development of the AI/LLMs or whatever
| comes after it?
|
| Say in 10 years, once we have things like a Claude Mythos (or
| better) model running on "real time" at the speed of how Taalas
| runs ollama now.
|
| I have a feeling that "cyberspace" (however we want to call it)
| won't matter anymore. "Computing" won't matter anymore. Say, I
| want to implement a Massive Multiplayer Lemmings like game, it's
| done at the snap of my fingers. Say I want to find a way to
| "crack" X software? done. Say I want to find a vulnerability in Y
| website? easy peasy. Say I want to build a "Powerpoint" clone,
| done (not that it matters, as making a presentation will be as
| simple as saying "Mythos5, make a presentation about X,Y,Z with
| nice and meaningful transitions".
|
| Same with music, video, images, etc. Once everything can be
| created automagically... what happens? (say, "Make me a film like
| the original John Wick but with the wit and style of Kingsman,
| make a young Sean Connery the main actor).
|
| So, ultimately cyberspace will be so chaotic with the current
| "rails", that it will be completely different to what we know
| now.
|
| At the risk of being booed here in HN, I also have a hunch that
| the more we go there, the more stuff like "trustless computing"
| or "proof of N" (having to SPEND something, some real life,
| finite effort, to do things online) will gain more force.
| Somehow, Hashcash was conceived to deal with spam/automation type
| of attacks, so I assume a version of that will have to be used to
| "structure" Cyberspace in the future.
|
| My hypothesis is that this will take us back to "the real world"
| due to "surfeit": Kind of what happens once you add a "trainer"
| to a game and suddenly you have all the money/resources, and then
| it becomes boring. Once the "digital" stuff is solved, we will go
| back to the real world.
|
| Very exciting times.
| levek wrote:
| > Say I want to find a way to "crack" X software? done. Say I
| want to find a vulnerability in Y website? easy peasy.
|
| OTOH, such a powerful model might be able to do formal
| verification practical, too. So your model might say "Can't get
| RCE on that software because the model that developed it also
| created a proof that that's impossible".
|
| > Once everything can be created automagically... what happens?
|
| The people who can come up with novel concepts would matter a
| lot more then than they do now. Like how image models can
| create pictures in the style of van Gogh, but they wouldn't if
| van Gogh hadn't existed. So we'd need "van Goghs" to come up
| with the new things that the models would create a thousand
| varieties of.
|
| > Somehow, Hashcash was conceived to deal with spam/automation
| type of attacks, so I assume a version of that will have to be
| used to "structure" Cyberspace in the future.
|
| "Proof of N" doesn't need to involve spending something. It
| could be "proof of citizenship" (or some other "proof of
| offline identity") combined with rate-limiting per identity.
| The right cryptographic protocols could do it without revealing
| your identity to the service you're interacting with.
| thordenmark wrote:
| Yes, AI is getting better at finding exploits and cracking
| software, but it will also get just as adept at defense. It will
| all escalate, but mostly maintain parity.
| fzzzy wrote:
| An attacker only has to win once. A defender must win every
| time
| xtracto wrote:
| I wonder, how long until that certain CrowdStrike kernel level
| plugin that brought down a third of the world's Windows comptuers
| gets hijacked by a malicious actor.
| sdevonoes wrote:
| Finally we know what AI is good for! And It's not about make
| mundane developers more productive
___________________________________________________________________
(page generated 2026-04-13 23:00 UTC)