Security through obscurity is dead, and AI delivered the fatal blow

An interesting consequence is that cybersecurity researchers and hackers are now AI researchers.

The prominent game right now is about the classes of attacks that AI can recognize both to exploit and to remedy.

Implicitly, that creates a new highly valuable class of vulnerabilities: the ones that AI for whatever reason is unable to readily see. Understanding those two groups will be paramount and will lead to better AI.

Speaking of obscured code:

I'm using AI to decompile old arcade games.

I am finding the craziest anti-tampering stuff. Three different routines - each watches the code of the others - and if anything changes - tank the machine by jumping into graphics RAM.

When I first started seeing this stuff I assumed my decompiler was broken. Nope. Just insane code.

It's not "dead", what kind of crappy binary take is this. It absolutely still work to an extent where making an attacker lose time does slow down attacks, thus increasing security.

You can absolutely make an agent lose its mind thus making it spend more tokens, to an extent where it might not be viable, but in all case, slowing down or making something more expensive is a direct way to increase security, so wasting either token or human time both is useful.

SBO+Real security > Security.

404