Hacker News new | past | comments | ask | show | jobs | submit
jimbokun | on: Postgres 19 is late because so many more bugs are being found now
Interesting that this could result in net negative software productivity world wide in terms of features right now.

LLMs finding unpatched vulnerabilities faster than they can be reasonably patched, bringing all other software development to a halt.

reissbaker | parent | next
That's only if you consider security to be unproductive!

If you consider it to be productive work, it's a massive productivity boon happening right now. Of course, product managers might disagree...

vbezhenar | root | parent | next
Security work is not productive.

Imagine that the whole city has to install iron doors and window grilles, because wooden doors and glass windows are not safe enough anymore.

That's a lot of work, but is it productive in the end? Probably not.

With AI it's the same. World was fine with lax security approach before. Today it is not fine. Tomorrow we might need to prove every code line before shipping, will that be more productive? Hell, no.

dwattttt | root | parent | next
> Imagine that the whole city has to install iron doors and window grilles, because wooden doors and glass windows are not safe enough anymore.

> That's a lot of work, but is it productive in the end? Probably not.

Your imaginary scenario defines the solution to be pointless. If that same city was subjected to weekly riots smashing windows & doors, and people regularly died, stopping "productive" work to install things that keep people alive and productive? That's productive.

loading story #50334804
loading story #50333803
loading story #50334141
loading story #50333941
loading story #50333771
loading story #50333795
loading story #50333919
Gigachad | root | parent | next
The physical world comparison is interesting. In the real world we have a small amount of security, but most things could be broken in to. Instead of fortifying everything, we just imprison the people breaking stuff.

Obviously this doesn't work on the internet since most hacking comes from overseas out of our control. Which makes me wonder if there is a possible future where we just block packets coming from countries that don't lock up the hackers.

loading story #50333283
hgoel | root | parent | next
I think the physical world comparisons should keep in mind the kind of data a lot of these systems (eg postgres) handle. It's more like securing a bank vault than locking a home's door.
orbital-decay | root | parent | next
People usually don't install steel doors because most burglary is prevented in other ways. Insecure software will be exploited this way or another, if the vulnerabilities are real and the threat model is valid.
loading story #50333608
pmontra | root | parent | next
By this line of thought building nice and usable UIs is not productive too, because users can learn cli tools (they did, DOS) and it costs less to develop them. And all the work in TLS/HTTPS has been wasted because HTTP is enough. And ssh vs telnet.

It becomes productive only once your business stops for days because somebody brought it to a halt by breaking into the servers and deleting them.

sitkack | root | parent | next
Flawed analogy! These bugs are bugs regardless of the label. Security bugs are a subset of "regular" bugs.

You have a perverse view of product ivity

idiotsecant | root | parent | next
In the rest of the world making sure your product works like it is supposed to is considered table stakes. In software we somehow consider checking the parts of it we can think of 'good enough' and the rest unproductive
vbezhenar | root | parent | next
> In the rest of the world making sure your product works like it is supposed to is considered table stakes.

I don't think that's true.

In medicine, science often doesn't know how specific drug really is working. They just do a lot of tests and if these tests are positive enough, they ship it. I think it's good analogy. Biology is very complicated and it's out of our grasp to truly understand how various parts of it interact with each other on so many levels. But if something helps, it's stupid not to use it just because we don't fully understand it. Sometimes it bites. Sometimes it bites 30 years later. But we still follow that approach.

Software is similar. The complexity of the systems we build is enormous, when we're taking in account all the moving parts. I just read that someone emits radiowaves toggling memory bit and ex-filtrating information. How can you account for that? Probably you can't. But we still need software for good things.

SchemaLoad | root | parent
Not many products are held to the same standard as software. An equivalent would be something like recalling a car model because the breaks stop working when an attacker cuts the brake line.
gonzo41 | root | parent
it actually is productive, because steel bar retailers and metal door installers will make a ton of cash and then 'trickle' that money into the economy.
loading story #50334172
astral_drama | root | parent | next
When I had a brilliant stop on defense, a few savvy fans would appreciate it. When I scored goals, everyone knew.

Some people will much appreciate the holes in Postgres that are being plugged. Many more will be bored with patch releases until new features rollout.

A software affecianado appreciates patches, and might do well to teach laypeople the benefits of a good defense.

fortzi | root | parent | next
Security doesn’t produce anything. So no, it’s not productive by definition.
OccamsMirror | root | parent
How many of the security issues found were created by LLMs in the first place, though?
vikramkr | root | parent | next
This wave is largely bugs found in pre LLM code. I'm sure there will be a smaller wave of bugs from llm code from the sonnet 3.5 - opus 4.7 era, and peeople will always write sloppy code/use dumber models under time or cost pressure, but since Opus 4.8/GPT-5.5 xhigh LLM code stopped being intrinsically worse than human code. At this point if you're shipping llm code that's lower quality than human code that's either because you don't have the money to spend on frontier models or because you actively choose a lower quality standard because of either various pressures or just not caring. if it's the latter your human code under those same conditions would also be really bad.
loading story #50334754
plorkyeran | root | parent | next
My job is seeing a similar deluge of security work and >90% of the bugs have been in pre-2024 code, and zero of them have been bugs introduced after we were first officially allowed to use LLM codegen.
loading story #50333619
drfloyd51 | root | parent | next
Considering the software is much older than LLMs. Not many.

Also, in the article they mention a significant number of patches for older versions as well.

ecshafer | root | parent | next
Software is incredibly complicated. When you get into areas like security and networking and the internet its even more complicated. We rely on layers upon layers of software and hoping they are all done perfectly with no issues. The amount of junior devs, or outsourced devs for $10 an hour working on security relevant code is very very high, and always has been. LLMs if used correctly should be raising the floor.
vikramkr | root | parent | next
This wave is largely bugs found in pre LLM code. I'm sure there will be a smaller wave of bugs from llm code from the sonnet 3.5 - opus 4.7 era, and peeople will always write sloppy code/use dumber models under time or cost pressure, but since Opus 4.8/GPT-5.5 xhigh LLM code stopped being intrinsically worse than human code. At this point shipping llm code that's lower
idiotsecant | root | parent | next
An uncomfortable truth about the era of LLM code is that machine produced code is, on average, quite a bit more secure than human code.
loading story #50333256
loading story #50333423
adwn | root | parent
Do you mean "created" as in LLMs were used to discover existing vulnerabilities, or as in LLMs wrote unsecure code? If it's the latter, then the answer probably is "very few". Frontier models have been better than the average programmer at writing secure code that follows up-to-date best-practices for some time now.
hibikir | parent | next
Depends on the layers you are working on. Security is top priority on a lot of things that are visible to the internet, but in a lot of large companies, the footprint of the whole org is so much larger that than, and there many companies are deferring many security issues. So then you see a lot of speed there, when the consumer accessible systems are the focus of the security push.
taberiand | parent | next
Hopefully with the amount of visibility LLMs are bringing to the situation, security will finally be considered a first-class feature
oblio | root | parent
LLMs will likely greatly increase the cost of ignoring security, which is the most powerful tool to increase security ticket prioritization.

I wouldn't be shocked if in 1-2 years non-security vetted software released into the wild will be hacked on arrival, like Windows XP without service packs used to be.

tstrimple | parent | next
Really puts egg on the face of the anti-LLM folks who claim they only produce garbage code. Turns out they are very good at exposing the garbage code humans have been producing for decades.
comex | root | parent | next
Personally I think LLMs did only produce garbage code. Not coincidentally, the same upgraded LLMs that have gotten so good at finding bugs are also much better at not writing bugs. Especially if you make them review their own work. They still have a hard time with code design, though.
matkoniecz | root | parent | next
I claimed that at time when LLM were producing only and solely garbage code.

I am not doing it anymore.

foobar1962 | root | parent
That is not the take-away. LLMs are finding potential bugs in code. People are using LLMs to create potential fixes which people then test, confirm and implement.
loading story #50333623
michaellee8 | parent
i think we have a pretty high p(doom) on frontier ai escaping containment with their weights and goes hack everything, if we do not act now we may have no chance to act anymore.
nradov | root | parent
Escape to where? It's not as if there's a lot of idle compute capacity sitting around.

And even if the impossible occurs and LLMs hack everything that's connected to the Internet, so what? That would be inconvenient but it wouldn't cause doom. People would muddle through and eventually fix the critical problems, just like they always do.