YHK - yet another hacker news clone

Sounds like he is salty that somebody found an exploit using LLM that he found manually (which probably took a significant amount of time.) I can partly understand it, but I mean that's also just the game that somebody else might find an exploit, LLMs just make it easier. LLMs finding bugs is not a bad thing, just sucks for enjoyers of open source software in this particular case.

You can probably find more though.

But I guess Sony being a gatekeeper wasn't a gatekeeper enough for certain regulatory agencies.

I don’t know if he’s mad AI scooped a bug? Or that LLM slop kiddies don’t pay attention to that something is already known?

Slop kiddies using AI discovered the PS5 hypervisor exploit it relied on for installation. Initially they agreed to his request to delay reporting it to Sony until after GTA6 came out (so users could at least install and enjoy that highly anticipated game). But then they turned around and disclosed it anyway (the same or next day?).

They presumably gained a nominal bounty, but nuked the project he'd poured so much hard work into. Including support for the PS5 Pro he was preparing to release next year.

The community used to be a group of talented researchers, but he's frustrated it's diluted into participants who aren't aligned with his values and don't even understand the hacks they produce.

> I am stepping away from the ps5 scene and stopping all my work on ps5 linux. After pouring my heart and months of my life into it, including plans to finish ps5 pro support and release in 2027, it's all down the sink.

> The scene used to be a group of highly talented researchers, but now it is just a bunch of noobs using LLMs and writing hacks they don't even understand. Slop kiddies found the only hypervisor bug left, which I had also found a while ago, and decided to report to Sony.

> I asked them to at least wait for GTA 6 to come out so that people would have the opportunity to legally purchase the game and also enjoy linux. They agreed to wait, but not a day passed and they decided to waste it instead.

Right, including Sony. AI finding security flaws is very good in general, but one downside is that it will become easier to make "secure" devices that are hostile toward their owners.

People are still fixated on using AI to produce code (to reduce salary costs/dev time) rather than using it to audit bugs in one own's code, which they are better at.

The latter has "always" been obvious to me.

It's just boring. And the people that crow about "their" accomplishments are tiresome.

How old was this bug? How much energy has been devoted to RE of this proprietary console? Not enough, apparently.

This vulnerability will still exist in older versions. The project can still continue development of Linux on PS5 and, eventually, another exploit will be found that enables the installation on a later version.

Frankly, based on the language used, a resignation over this seems to have a lot more to do with the person being upset that LLMs are lowering the bar for entry. They seem more upset that their skills aren't as useful as they were.

It seems like the reputation as a PS5 hacker was the objective, not getting Linux running on PS5.

Oh man, if you read the threads about that it's such a time capsule of a different era:

e.g. from this thread: https://news.ycombinator.com/item?id=31628342

> I am honestly surprised how little SPAM there is on GitHub in general. Please don’t take that as a challenge!

I entirely sympathize with these maintainers too. I've had 2 instances where an LLM has surfaced a bug and I just couldn't get myself to open a PR and dump more work onto these maintainers, even after manually writing one up (neither were critical bugs, it's fine).

Seeing popular projects (like hermes) having 5k issues and 5k pull requests is madness.

At first, my brain parsed "spam" as in ye olde email spam. It took a moment for it to sink in that you meant code spam, instead.

But now that the two concepts are linked in my little pea brain: I kind of want to see how a system like SpamAssassin would work when applied to pull requests like it has been applied to email.

It can use reputation, real-time blacklists, triggers for form, and et cetera, with weighted scores for every aspect that are ultimately factored into one final score.

If final score is passing, the PR is presented for a human to review like a PR was (say) 5 years ago. If the final score fails, it goes into the circular file where it will probably die.

People who hate their job of course like to come out of the woodwork and say no one should enjoy it, but isn't it nice to have a society where at least some people can enjoy their work? I used to enjoy teaching but I'd never get a teaching job now because of how AI is being used in that sector.

Technophiles will say that we should embrace the future because its inevitable but how many good people quitting does it take before they realize that a vibe-coded future of fun isn't all there is to life?

This is definitely the case for me. Before AI tools became mainstream, it was already a difficult proposition to find other smart people who you could get along with and talk to, do something interesting together. The Internet made all the difference in my life because I was able to get outside my geographic region to do big things through open source and hacker communities. Now, that very important filter mechanism no longer works. It's Eternal September all over again. In a way, it's very much a domination of "ends" over "means" in the wider community that is being forced upon those who long focused on "means". For a lot of intelligent people, understanding something is /valuable on its own/, but for the wider world there is no value in simply knowing things, but what you do with that knowledge (or now that lack of knowledge). I even experienced this recently at DEFCON 34 where I saw other participants in some of the CTFs with me using AI tools and not really understanding what the tools were doing or what was happening, but just kind of bruteforcing/tokenmaxxing their way through. This isn't to say that those AI tools are fundamentally a bad thing to use in building open source software, security research, or even as a tool in a CTF, but that the "understanding" step needs to still be present or it destroys the fun in everything.

I'm certainly not having as much fun with computers these days, even as I've invested a lot of effort myself in local LLMs and trying to understand the tools and understand how to apply them reasonably, I've found I prefer much more analog entertainments. Thankfully there's always photography and lockpicking to entertain me at the moment and provide a pathway to meet other interesting fellows.

Same thing did happen to many work places. People at all levels proxy questions through LLMs and don't even bother to read/trim/edit the response.

Funny, how suddenly a tight, 1-2 sentence response on point is a sign of skill.

It is insane just how miserable the experience of FOSS hardware hacking in public is.

The expectation does not even the slightest match reality. You'd think "ah yes many eyes meaning all bugs get shallow", but instead you get worst of XDA-Developers and toxic wastelands where no sane person even answers anymore.

But this predates LLMs and was as miserable as it is now before as well.

In fact, I might even argue that LLMs made this _better_, because you can now avoid the "opening up in hopes of finding 1 helpful person below 99 annoying ones" through simple GPU compute.

Previously, you had to hope that through this self-inflicted horror, you'd find an expert that can augment you. Now that expert rests on huggingface.

It's still.. not perfect, of course. But it might be less miserable - provided that you adapt to the current state of things and stop with the "trawling for volunteers".

__

Of course, this does not help you against "skids let claude find bugs that you'd need and burn it for no reason" as per the twitter thread, but I wouldn't rule out that they would not have done that, if less information was public.

And.. that too was an issue before LLMs.

Information wants to be free, but so does your cat, and your cat gets run over by some crackhead in a 30 year old rusty pickup if you just put it outside without thinking.

So don't let it go out unattended.

That said, this "pep talk" is more directed at myself than at poor Andy. This must all suck big time.

the idea of gatekeeping is often seen as elitist or exclusionary (fairly enough in many cases) but i think this can be an exaggerated description of a culture that necessarily requires a standard of... let's say, desire to engage with material on a sufficiently deep level. many things can be for anybody, but they are not for everybody.

in the past i've seen the phenomenon of "opening up" subcultures or previously-niche intellectual/art fields described as democratization but i think that ignores a big part of what causes this, which can more accurately be described as commodification. access to difficult things was formerly measured by one's ability to expend effort in order to get there (ignoring, for now, the structural conditions that set one up for success in that effort). when these things are commodified, these efforts and identities become products to purchase, the right to which is nearly never limited; in fact, it's almost seen as evil to imply that they should not be available to any individual at any time that individual may desire access.

i know we all have to start somewhere, but there has always been some historical filtration that leads people who are not truly engaged with a subject on a deep level to disengage at some point. that's changing at a novel rate and scale across so many subcultures. it seems like a lot of us are just surprised at how many people even want access to what were once our sanctuaries and we're not capable of grappling with what it takes to adapt to these changes.

i don't think this will pass or that things will return to "the way they were" but there will always be pockets that resemble previous subcultural forms. we just have to re-learn how to identify them with a keener eye and how to better avoid or more-appropriately interact with those who have a more superficial interest in them.

And once in a blue moon something good comes out of it back to the real project.

The experience in these spaces is largely the same. LLMs can be used there, too, but when the experts are using them with experience to back it up the results are a lot better.

The people who are really struggling in my few hobby groups (not PS5) are those who enjoyed some social status from their knowledge. They were heros and people sought them out and revered their work in 2023. LLMs came along and partially leveled the playing field. When a determined kid with a Deepseek subscription can produce a sloppy version of what took you years to find, that sense of being a heroic figure at the next level is gone.

I think this reveals another wrinkle, which is that the status hierarchy wasn’t that solid or worthwhile anyway. Outside of a few vocal people trying to enforce the status hierarchy, most people don’t care who releases their jailbreak or PS5 exploit. They just want it. Whoever gets it to them first becomes the new king.

This PS5 incident has some strange element where supposedly keeping the reveal secret for 2 more weeks would have changed something with the GTA6 release. There were also 3 people who found the same exploit independent and some large amount of money on the line for the first of them to report it. The person who reported it signed off to spend time with his dying mother, so can’t really fault them for doing the thing they earned according to the rules of the program.

It seems more like a spirit drainer for the experienced maintainers who have to deal with the onslaught.

I suspect we’re going to see much more strict projects with fewer allowed contributors going forward.

Though on the upside, an experienced dev can use AI to become more productive, so perhaps they will be less dependent on contributions.