Hacker News Reader

Comment by mrheosuper | Hacker News Reader

As FW engineer, I am both horrified and intrigued.

The fact that there are so many devices lack even basic security features horrified me. A webcam that activity light can be turned off remotely, that's a big no no for me.

But the use of LLM is also very interesting, we may put LLM in the loop to harden our devices.

Sorry community, but it's our job to make the reverse engineer harder.

View on HN

Why is your job to make the reverse engineer harder? When the user buys a product, it should be theirs to do whatever they want, even brick it. Your job should be creating the product the user wants to use, not building obstacles, otherwise you are creating something actively user-hostile. What if your company goes out of business and the user ends up with a device that can't be updated, that depends on cloud services that don't exist anymore, or worse with security vulnerabilities?

"Making reverse engineer harder" is just a side product of "improving security" that upper-level people like to hear.

I definitely don't want my C-suite people reading "The product X of company Y has been reversed engineered" on their newspaper.

In the old days, when businesses were not governed by pure greed, many electronic products, if not the majority, included schematics in their user manual. If a product today made a point of pride of having fully open source firmware and included a github/gitlab link, there would be no reverse engineering to write about. Security can be obtained also with an open source firmware.

If you can use a custom chip yep, if it's commodity hardware probably not. You could use secure boot/secure memory etc but that can be a footgun in itself later.

What do you mean "Custom chip", like ASIC ? Never in my career that i feel the need to make our own ASIC.

Parent comment was likely about how are you supposed to put LLM into your chip. Commodity ICs are already optimized down to their minimums wrt compute/memory/storage. Ultimately, I think it will prove that RE examples like this are going to become a difficult problem to solve.

Oh no, i mean using LLM in the loop, keep forcing it to break our device, gives it every tool that an average tinker can access.

I misunderstood you then, sorry. Yes, that makes complete sense but ultimately I think this will likely not be enough. Implementation will be hardened but new models with better capabilities will be released, and will discover vulnerabilities that would not have been caught or discovered with prior models.

Reply on news.ycombinator.com