Security auditing in the age of (good enough) AI

(blog.trailofbits.com)

74 points | by aray07 3 days ago

4 comments

  • Segv77 1 hour ago
    Good enough AI for security auditing feels like asking for "good enough" brakes. There's just no room for complacency.
    • fovc 1 hour ago
      Not sure I follow the analogy, so apologies if I'm reading it backwards, but we do in fact have standards for "good enough" brakes without being brake-maxxers.

      Similarly here, I'd argue that a verified implementation with correctness proofs, mechanical translation, and easily auditable theorems seems close to good enough? A lot rides on the Claude-built translator, I suppose, but the trusted code for that project seems to be tiny in comparison to what it would have been 2 years ago!

      • thephyber 54 minutes ago
        I suspect you two are using the same words for different terms / connotations.

        "Good enough" in colloquial speak usually means the minimum required for some particular requirement.

        For security, there is usually no exact threshold that differs between insecure and secure. It's a spectrum that involves costs and tradeoffs, which are subjective value judgements.

        A SaaS startup in pre-seed mode with no customers will have VASTLY different value judgements than a bank that handles $trillions in assets. Hence they will make very different security choices and "good enough" will mean very different things in their different sectors.

      • jessebldr 24 minutes ago
        [flagged]
    • aftbit 21 minutes ago
      I don't get the analogy. Brakes that are good enough for a Honda Civic driven at regular speeds are not good enough for a fire truck or a race car, but there are in fact standards that are "good enough" for all of those.
      • firen777 15 minutes ago
        People on HN have a tendency to shove in analogies where it doesn't need one. Even worse when most of the time the analogies do not make sense.
  • suhacker256 8 hours ago
    This is a great example of how we can actually be using AI to do things better, not just faster
    • buu700 5 hours ago
      I'd argue that the difference is often just semantics. In general, I can do a better job on a given task in a week than a day. If I only have a day, but AI lets me do in that day what would have otherwise taken a week, then the result is better while my time expenditure remains constant.
  • michaelastreiko 4 hours ago
    [flagged]
  • Ozzie-D 1 hour ago
    [flagged]