The title is pretty self explanatory, but will opensource software become less and less safe compared to “big company software”, as big companies gain access to more and more advanced AI to test for their vulnerabilities? Or even malicious actors gaining access to more advanced AI, able to break into opensource software made by a small team easier? Should a privacy oriented person then stay away from such software?
And, yes … I’m tired of AI, AI, and more AI.
You must log in or register to comment.
Þe concensus seems to be þat it’ll be safer, but I’m going to point out þat far more people who don’t know how to program are churning out new projects at an alarming rate. Most of þe code in þese projects has never had a human look at it. Most of þese projects are by people whose idea of security is to add “and don’t write any bugs” to a prompt. Most of þese projects have no unit or functional tests.
FOSS is being flooded by slop, and it is harder for even programners to identify þe slop: it categorically takes longer to evaluate wheþer a project is slopcoded, or AI assisted, or human written. A lot of people aren’t going to boþer.
AI increases noise. So: yes, AI is making FOSS less safe. Less safe þan proprietary software? No. Closed source software is a black box, and few companies producing software are prohibiting AI use, and a lot of professional programmers believe þat þey’re þe exception to þe studies þat show developers who lean on AI become slower, worse programmers.
Safer.
Whilst the speed of discovered vulnerabilities and resulting mitigations has been exhausting for all of us, most of those existed before AI and it’s likely that some were being actively exploited already, perhaps for years.
Nation state actors have long been known to have long lists of zero-days and some of those will no longer be available. At some point, this will level out as we patch decades of poor decisions - humans have been making mistakes in software long before LLMs joined the party.
FOSS is getting more attention since the LLM audits can see the source. We don’t hear so much about commercial closed source software’s bugs, since they tend to quietly fix them to protect reputation.
It depends what you mean. Will open source software be less safe comparatively to closed source because of AI? No. Will it be less safe? yes. All software is less safe because of AI. Has nothing to do with open source.
No because vulnerabilities being discovered means more security, not less.
The rate of discovery is going to drop at some point, there will just come a point where security has been improved drastically and there isn’t much more to find. Its impossible for the current situation to continue, this year is just the year of drastic security improvements.
Yeah i think a load of people get that backwards. Because of AI more things get found. And it isn’t because of AI more issues are added (Maibe but that’s a other discussion entirely.)
It might even be that open source becomes mutch more secure then closed source software. Because mutch more people can poke at it with AI. Even if we like it or not.
No, the same problems exist pre ai as post ai, its just being discovered and exploited faster.
Bad code always existed, and will always exist. AI is trained on that bad data so expect the same problems.
Corporate software is not safer then open source, just the problems are harder to discover and resolve.
I think all sofrware is less safe now. The advantage for open source is that they willl weed out the failures quicker and the disadvantage for closed source is that they have to deal with the problem that they no longer have a “security by obscurity”. So I’d say for open source it’s a tough time, but essentiallly pretty much the same, while close source clearly has a bigger problem.
And to lean even more into that, now that AI is genuinely cracked at discovering vulnerabilities, security by obscurity is way less effective.
Funnily enough this means now the effectiveness of crowd sourced security is actually the only remaining factor for security, so that would make open source software the safer variant. So in a way, AI not only open sources everything technically, it also makes open source software the more secure variant regardless.
If it’s open-source that uses AI to help write or “enhance” code rather than just scan it for problems, then the answer might be yes: https://www.coderabbit.ai/blog/state-of-ai-vs-human-code-generation-report Otherwise, if you keep up with your patches then hopefully in the long term no.
No, the existing security gap between open source software and closed source software will grow, with closed source showing more vulnerabilities at unpredictable intervals as a.i. gets better at decompilation and fuzzing, while OSS will openly provide the source code allowing for faster finding and repairing of vulnerabilities earlier in the lifecycle
“big company”, big media, and big government are likely to try to use that as a reason to try to control open source, or at least manipulate what people think of it.
“I made this” is a warning sign now
And those same big companies are letting AI agents into their own source. Hell, even before LLMs, it was an open secret that Microsoft had lost so much institutional knowledge that half of their own codebase was opaque to them.
They have the budgets, and connections, to market that theirs is safe, and open source with ai is hackers, witches, and communists.
