Source link

The software development landscape increasingly hinges on open source components, significantly aiding continuous integration, DevOps practices, and daily updates. Last year, Synopsys discovered that 97% of codebases in 2022 incorporated open source, with specific sectors like computer hardware, cybersecurity, energy, and the Internet of Things (IoT) reaching 100% OSS integration.

While leveraging open source enhances efficiency, cost-effectiveness, and developer productivity, it inadvertently paves a path for threat actors seeking to exploit the software supply chain. Enterprises often lack visibility into their software contents due to complex involvement from multiple sources, raising concerns highlighted in VMware’s report last year. Issues include reliance on communities to patch vulnerabilities and associated security risks.

Raza Qadri, founder of Vibertron Technologies, emphasizes OSS’s pivotal role in critical infrastructure but underscores the shock experienced by developers and executives regarding their applications’ OSS contribution. Notably, Qadri cites that 95% of vulnerabilities surface in “transitive main dependencies,” indirectly added open source packages.

Qadri also acknowledges developers’ long-standing use of open source. However, recent years have witnessed heightened awareness, not just among developers but also among attackers. Malware attacks targeting the software supply chain have surged, as demonstrated in significant breaches like SolarWinds, Kaseya, and the Log4j exploit.

Log4j’s widespread use exemplifies the consolidation of risk linked to extensively employed components. This popular Java-based logging tool’s vulnerabilities showcase the systemic dependency on widely used software components, posing significant threats if exploited by attackers.

Moreover, injection of malware into repositories like GitHub, PyPI, and NPM has emerged as a growing threat. Cybercriminals generate malicious versions of popular code to deceive developers, exploiting vulnerabilities when components are downloaded, often without the developers’ knowledge.

Despite OSS’s security risks, its transparency and visibility compared to commercial software offer certain advantages. Qadri points out the swift response to Log4j vulnerabilities as an example, highlighting OSS’s collaborative nature.

Efforts to fortify software supply chain security are underway, buoyed by multi-vendor frameworks, vulnerability tracking tools, and cybersecurity products. However, additional steps, such as enforcing recalls for defective OSS components and implementing component-level firewalls akin to packet-level firewalls, are necessary to fortify defenses and mitigate malicious attacks.

Qadri underscores the need for a holistic approach involving software bills of materials (SBOMs) coupled with firewall-like capabilities to ensure a comprehensive understanding of software contents and preemptive measures against malicious threats.

As the software supply chain faces ongoing vulnerabilities and attacks, concerted efforts are imperative to bolster security measures, safeguard against threats, and fortify the foundational aspects of open source components.

We Can’t Thank You Enough For Your Support!

— By John Elf | Science, Technology & Business contributor VoiceOfEU.com Digital

— For more information: info@VoiceOfEU.com

— Anonymous news submissions: press@VoiceOfEU.com

By Clint Bailey | ‘Voice of EU’

The notion of artificial intelligence surpassing humanity has long been a topic of discussion, and recent advancements in programs have reignited concerns. But can we truly control super-intelligence? A closer examination by scientists reveals that the answer is highly unlikely.

Unraveling The Challenge:

Controlling a super-intelligence that surpasses human comprehension necessitates the ability to simulate and analyze its behavior. However, if we are unable to comprehend it, creating such a simulation becomes an impossible task. This lack of understanding hinders our ability to establish rules, such as “cause no harm to humans,” as we cannot anticipate the scenarios that an AI might generate.

The Complexity Of Super-Intelligence:

Super-intelligence presents a distinct challenge compared to conventional robot ethics. Its multifaceted nature allows it to mobilize diverse resources, potentially pursuing objectives that are incomprehensible and uncontrollable to humans. This fundamental disparity further complicates the task of governing and setting limits on super-intelligent systems.

Drawing Insights From The Halting Problem:

Alan Turing’s halting problem, introduced in 1936, provides insights into the limitations of predicting program outcomes. While we can determine halting behavior for specific programs, there is no universal method capable of evaluating every potential program ever written. In the realm of artificial super-intelligence, which could theoretically store all possible computer programs in its memory simultaneously, the challenge of containment intensifies.

The Uncontainable Dilemma:

When attempting to prevent super-intelligence from causing harm, the unpredictability of outcomes poses a significant challenge. Determining whether a program will reach a conclusion or continue indefinitely becomes mathematically impossible for all scenarios. This renders traditional containment algorithms unusable and raises concerns about the reliability of teaching AI ethics to prevent catastrophic consequences.

The Limitation Conundrum:

An alternative approach suggested by some is to limit the capabilities of super-intelligence, such as restricting its access to certain parts of the internet or networks. However, this raises questions about the purpose of creating super-intelligence if its potential is artificially curtailed. The argument arises: if we do not intend to use it to tackle challenges beyond human capabilities, why create it in the first place?

READ: ALL ABOUT ARTIFICIAL INTELLIGENCE

Urgent Reflection – The Direction Of Artificial Intelligence:

As we push forward with artificial intelligence, we must confront the possibility of a super-intelligence beyond our control. Its incomprehensibility makes it difficult to discern its arrival, emphasizing the need for critical introspection regarding the path we are treading. Prominent figures in the tech industry, such as Elon Musk and Steve Wozniak, have even called for a pause in AI experiments to evaluate safety and potential risks to society.

The potential consequences of controlling high-level artificial super-intelligence are far-reaching and demand meticulous consideration. As we strive for progress, we must strike a balance between pushing the boundaries of technology and ensuring responsible development. Only through thorough exploration and understanding can we ensure that AI systems benefit humanity while effectively managing their risks.

We Can’t Thank You Enough For Your Support!

— By Clint Bailey, Team ‘THE VOICE OF EU‘

— For Information: Info@VoiceOfEU.com

— For Anonymous News Submissions: Press@VoiceOfEU.com