rndhouse
Joined 5 years ago
Karma
98
Submissions
60
Member since
Sep 17
https://github.com/rndhouse
https://x.com/rndhouse
View on Hacker NewsRecent submissions
Comment · 2 months ago
They still matter in the sense that they impose a cost. In other words, they buy time, which is all the users need before updating.
I'm not sure if the cat and mouse game resolves clearly one way or another. Since the obfuscation can be hardened against LLMs during development.
Comment · 2 months ago
There are many techniques for making a closed-source binary harder to reverse engineer: polymorphism, symbol stripping, code encryption, packing, and so on. Closed-source binaries at least stand a chance of being effectively obfuscated, unlike open-source code.
Comment · 2 months ago
I built a tool that monitors commits and tries to detect silent bug fixes. With GPT-5.5-class models, it can identify fixes hidden within otherwise routine commits quite reliably. Obfuscating the code changes enough to avoid detection is difficult.
I have heard of at least one project (c-lightning?) temporarily releasing a closed-source binary as a workaround until users could update safely.
Comment · 2 months ago
Whay do you want traffic to go back to estate agents?
Comment · 4 months ago
I'm working on a tool for collaboratively reviewing Rust crate dependencies: https://github.com/thirdpass-org/thirdpass
Also supports npm, PyPI, and Ansible Galaxy.
Comment · 5 months ago
Hello,
The goal of Thirdpass as a service is to coordinate the collaborative review effort necessary to lower software supply-chain risks.
Multi-ecosystem support: crates.io, pypi.org, npmjs.com, and galaxy.ansible.com.
Thirdpass should enable anyone to review by pointing their spare AI capacity at dependencies.
Some thoughts over the years whilst working on this off and on:
* A coordination node can add a lot of value.
* It's difficult to motivate human reviewers.
* A review which adds partial coverage is still valuable.
* The supply-chain risk is not unique to JavaScript.
This project started in 2021 and was recently revived. I've honestly had a lot of fun working on this. I'm looking for contributors to help build and review.
I hope the community finds this valuable!
Comment · 6 months ago
I've been playing around with agent-native source annotation to specifically address the massively parallel work problem. Check it out here: https://github.com/draxl-org/draxl
Comment · 6 months ago
VCamper: use LLMs to spot security fixes before CVE publication
Once a patch for a security vulnerability is public, the patch itself can reveal the vulnerability before the CVE is published. VCamper uses a staged LLM pipeline to analyze a Git commit range and flag likely vulnerability patches, even when they look like routine changes.
It’s still a proof of concept, but on known cases like curl CVE-2025-0725 it got close to the published root cause from the patch alone.
This matters because LLMs could make it much harder to keep security fixes quiet: once the patch is public, the bug may be recoverable almost immediately. Quietly shipping a fix and hoping it stays under the radar may stop being a reliable strategy.
Comment · 4 years ago
OpenFare is attempting to solve this problem. It allows developers to effectively invoice by adding a file to their software package. No need to modify package managers.
Comment · 4 years ago
Two more alternatives to crev:
Comment · 4 years ago
I haven't heard about librepay before, thanks for letting me know. I'll take a look!
Comment · 4 years ago
> the cost of adding them (INCLUDING the transaction costs, the cost of dev hours spend on convincing the procurement dept, etc etc etc) is cheaper than the cost in dev hours
I think this gets to the heart of the matter. The goal with OpenFare (for non-FOSS) is to minimize this overhead cost. I believe that it can be minimized to a point where it is negligible. For FOSS it is already negligible. The method for minimizing that cost is to make a predictable pattern familiar and ubiquitous.
> had better respond quickly to security vulnerabilities and feature requests
That depends on the deal. If you buy software for $.01 what do you expect beyond your expectations had you paid nothing? Software support can't be assumed just because money is trading hands.