If it was microsoft they would ban github and gitlab account and not give cve.
I’m not a big Google fan but I will give credit where credit is due
They do put their money where their mouth is
I hate google but they still pay good money to opensource and take responsibility by organizing google summer of code.
A separate vulnerability in Linux allows users with limited rights to escalate to root. Tracked as CVE-2026-43499, it lurked in the OS for 15 years. Researchers from Nebula Security said they discovered it using Vega, Nebula’s AI-assisted vulnerability scanner. Matt Lucas, a researcher and founder of RedEye Security, explained
This will become more and more common as we use AI to find vulnerabilities faster (hopefully) than bad actors can use AI to find vulnerabilities.
If you pay attention you can hear a hundred NSA assholes tear their hair out
You don’t think frontier AI models are leaving some out deliberately?
If they leave it out someone else will find it, the days of leaving things out deliberately past.
20 years of hoarding CVEs down the drain.
Now they’ll never be able to gg ez their way into any country and will have to actually use their bribery budget to get more implants lol.
Which means the new paradigm will be ‘every piece of hardware is a supply chain attack.’
as we use AI to find vulnerabilities faster (hopefully) than bad actors can use AI to find vulnerabilities.
Oh small, simple child: who do you think has the better access to AI in the first place?
This is a reminder that US scientists during the cold war thought fish were russian subs because they didn’t have biologists on staff
Judging by the way they’ve treated big companies in the past the NSA is staffed by a bunch of people who use backroom deals with US tech companies to collect their data mostly.
I actually think a large plurality of them spend most their time tracking/stalking their wives and like people they argued with the day before.
small, simple child:
Didn’t downvote you but…
LOL! The level condescension sure is right on point Lemmy.That genuinely got a chuckle. In some ways I enjoy being that simple child. Full of wonderment at this universe around him.
Wonderment is cool. The key is to know to keep it as you learn more truths about the world.
Well, you know … “them”
The companies who are training AI… On Linux servers?
Wait no, obviously smaller actors you’re referring to with your mysterious comment.
Or maybe all the follow on tech companies that are the largest customers using AI aaand who also mostly use Linux
No no I’ve got it wrong, US government entities want a backdoor so restrict AI releasing, then during that window exploit non-US companies using Linux
It goes right to the top!
Linux’s “security through obscurity” was never going to last.
Edit: it’s a common concept in hacking. Shorthand for a type of security through improbability.
I don’t know where you got the notion from that Linux as a whole uses this concept, but it’s nonsense. There’s exactly one place where this definition fits, which is the GRUB bootloader encryption (which merely shifts the target for the Evil Maid attack from the initramfs to GRUB). But this is already adressed with Verified Boot.
Nothing else, let it be LUKS, PAM, SELinux, AppArmor or whatever has any business with STO.
From the fact it used to have to smallest user base of the big three. Less users = less probability of a nefarious person.
It’s really not that difficult a concept. I’m surprised people here are asking what it is.
Security through obscurity in OSS lol
There was never an actual notion of “security through obscurity”. LInux runs the complete Internet and most coporate server infrastructure. That’s where the actual money is.
People hallucinating that Linux is something obscure simply have no clue and confused their home desktop for real computing. Windows desktops are constantly targeted not because they are -unlike Linux- so wide-spread but because they are already insanely insecure. They are the low hanging fruit where you can cobble together some cheap shit and will still find million of PCs vulnerable. If you want to find a Linux comparison it’s definitely not server or desktops but cheap IoT devices not having seen an update (or any security to speak of) for many years.
For reference: We are talking about guests in a virtual pc escaping it’s container. That’s not something obcure. That’s basically all cloud hoster’s whole business model, thus the reason Google pays a lot of money for finding such exploits.
You could have just said that you don’t know what “security through obscurity” is.
Windows desktops are targeted because any place you have a user, you have a vulnerability. The vast majority of Linux installs are servers with extremely limited user activity, which narrows the attack vectors significantly.
In any system, the human is usually the weakest link.
The self-hosted crowd thinks reverse proxies protect you from the Internet. Don’t expect too much of them.
You are right about that a reverse proxy does not protect. But I can not relate that with security through obscurity.
The selfhosted guys are correct with that. Of course its not a magic pill, but it can help to minimize the attack surface immensely with little effort.
Security through what now?
Well, I guess it is obscure… Though only because the number of people who have a full grasp on how the code works is highly limited.
