logoalt Hacker News

lifeisloving • yesterday at 11:05 PM • 8 replies • view on HN

Its really not that hard to secure your servers, especially if your not a high value target. If you are a high value target, you should have security professionals on staff.

I dont think my security posture is all that much different than it was last year. Use a Secret Manager and or encryption, have backups, strong firewall rules, use canaries of some kind.

If anything llms are making security worse because there's more people offloading their thinking on llms, or people that skipped some steps in their learning journey because they just ask the llm to do everything. I dont think its necessarily because attackers have llms now, but that contributes.

Edit:

Damn Im getting mega downvoted for saying this. So are people of just at a consensus that there's nothing you can do? That we're in security armagedon???

Have you ever thought to consider that security took hit along with the general degradation of software because of AI??


Replies

moscoe • yesterday at 11:13 PM

You are literally the everything is fine meme. I admire your confidence. I never realized it was so simple!

UqWBcuFx6NV4r • today at 12:29 AM

Is this like when people say “it’s not that hard to write memory-safe C”, and then nobody does? I take this as actually meaning: “I feel that I can keep my shit locked down.”. Whether or not that’s true, which i’m skeptical of, plenty of OTHER people can’t, or won’t, or whatever. That’s the reality.

To speak to your edit: this is false equivalency. You can still decrease the odds of being hit. There are still better and worse ways to address security.

mort96 • today at 12:59 AM

Can you tell me what I should be doing differently then? I just host some services, among them Nextcloud that's written in PHP, protected by SSL, on a server running Linux. And I feel like the past week has been a lots

tbrownaw • today at 1:44 AM

It's tedious, which is a particular kind of being hard.

amelius • today at 2:05 AM

Have you not heard of supply chain attacks?

sanex • yesterday at 11:59 PM

I agree but disagree about the cause. People have always been bad at security and code in general.

bvcp • today at 12:39 AM

if anything we should be using ai to find this stuff before the bad actors, too bad the model providers are hell bent on regulatory capture via fear

LaurensBER • yesterday at 11:18 PM

[dead]