Birbla

Join the discussion

Write your take first — we'll ask for email only when you're ready to publish.

Sign in
  • Hacker News
  • Wow... What have they done to that webpage to make it that unreadable?

    And why?

    Ouch.

    by gertrunde
  • Am I crazy to think this title is just incorrect? They say AI reports are welcome, not fixes.
    by jscd
  • That was sloppy work on my part. Updated.
    by voxadam
  • They say AI reports are welcome, especially when corroborated by human triage, and/or when accompanied by fixes (unconstrained by any adjective, eg human or otherwise).
    by nickysielicki
  • No, AI assistance is NOT welcome in general. They mention security bug reports, so using AI like ASAN etc. is welcome.
    by 3asj176
  • Why is AI assistance not welcome?
    by swingandamiss
  • You need to understand that they have no choice.

    Attackers are going to use AI models to find bugs or 0 days quicker than those without it and of course they will not report them.

    So it only makes sense to allow it and accept (valid) AI reports from reputable security researchers to keep ahead before a bug gets exploited in a vulnerable release.

    As long as the submitter shows their understanding of the reported bug means and what the change is, it is fine to do so, with the reviewers gating invalid reports.

    > so using AI like ASAN etc. is welcome.

    AddressSanitizer is not "AI", nor does it use AI. [0]

    [0] https://static.googleusercontent.com/media/research.google.c...

    by rvz
  • They plainly, explicitly welcome it:

    "Recently the OpenSSH team have received a large number of security bug reports, many of which are findings from AI models or made with AI assistance. While many AI reports are determined not to have security impact when considered in the context of a realistic threat model, we very much welcome these reports, especially when combined with human triage, analysis, test-cases and particularly when accompanied by proposed fixes."

    by mmooss
  • > No, AI assistance is NOT welcome in general.

    Can you cite that? I see them specifically welcoming AI security reports; I don't see any evidence that other AI submissions are not welcome.

    by akerl_
  • Darn, still no host headers so we can reverse proxy on a single ip
    by qudat
  • You could wrap a TLS-connection around your SSH-connection, and then use the ALPN to indicate SSH, so that your reverse proxy knows, what to do with it.
    by stragies
  • If we did this in SSH then I think we should do it properly and take inspiration from TLS ESNI https://datatracker.ietf.org/doc/draft-ietf-tls-esni/25/
    by djmdjm
  • > Darn, still no host headers so we can reverse proxy on a single ip

    How would this be done? After the "SSH-2.0" banner, the first packet is SSH_MSG_KEXINIT and there's no space in that for a "Host" header:

    * https://datatracker.ietf.org/doc/html/rfc4253#section-7.1

    by throw0101a
  • Glad they're not letting potential high false positive rate preclude discovery of true positives. Better to get a lot of noise with a little bit of signal, if the alternative was not get that signal at all.
    by 4L3XV33
  • > ssh(1): add a "ssh -Z user@host" mode that prints the keys that will be tried for public key authentication in the order that they will be used.

    Oh, that's a nice new feature:)

    by yjftsjthsd-h
  • Yeah, I've occasionally had to divine from verbose debug output that the remote host didn't like more than three or so public key attempts before requiring another auth type.
    by ahartmetz
  • I don't think there has been a single month in the last 5 years that I haven't had to figure out which public-key was used to authenticate me to a host via `ssh -vv` - often to let someone else who is failing to connect know which key to use.

    The `-Z` is less useful - as I almost always know exactly which and what order the public keys are - as most of our sshd instances fail after 5 attempts - so making sure either (A) the correct ones or used or (clumsily, B) - just putting the correct one in the first five to try.

    Would be a nice feature to echo which key successfully worked.

    by ghshephard
  • "[..] a security bug identified by AI tools is subsequently independently discovered by a different researcher. This suggests that adversaries who do not report bugs to OSS projects are likely to be able to discover these bugs too. Given this, the OpenSSH team will, for now, be making more frequent releases to get bugfixes into users' hands more quickly rather than batching them until the next planned release."
    by alpn
  • Meanwhile Zig developers: not even a spell check fix using AI will get accepted
    by cromka