alt Hacker NewsWe keep paying ever higher architectural prices for system isolation: user accounts, memory protection, unix permissions, capabilities... and it's all for nothing, when a determined program can almost always escape its sandbox. Should we just give up and assume that all software on a machine is cooperative and non-malicious, and just do our best to make sure we don't run malware in the first place? "Defense in depth" soon slips into "don't worry too much about this layer, the next layer will catch it.
tl;dr Just run as root bro, focus on the exterior attack surface, and don't download random crap.
>don't download random crap
One silver lining I haven't seen discussed much on HN: The latest LLM agents are good at decompiling binaries, which should help detect supply chain attacks.
I suppose the next round will involve supply chain attackers including bioterror-related symbols in the poisoned binary so LLMs will refuse to decompile it.
Anyways, I'm hoping someone will create an open-source project which distributes the work of binary analysis, with binary certification and user reputation systems etc.
This would also be an excellent goodwill project for one of the big AI companies, since this whole situation is kinda their fault.