[gyomu]

Yes, those tools are extremely good at reverse engineering. With a bit of know how, it is now trivial to reverse engineer any protocol or crack any software, often in a matter of hours or less.

A lot of people in the industry have vested interests in this not being discussed openly so you don't hear too much about it, but the implications are huge.

[j-conn]

What are some of the implications? Where does widely available mythos-level hacking lead? By people with a vested interest, do you mean non-cloud software vendors?

[aero142]

Software that had a data moat because it was hard to integrate with or migrate off of will have that moat disappear. A web site is a client now. Building data migration too for all of you competitors is easier now.

[SyneRyder]

I've just had a SaaS that I use decide to implement a 2.4x price increase. I reacted instead by taking screenshots of every page of the SaaS, downloading their API docs, exporting what data I could, and asking Claude to build a self-hosted clone based just on those files. I had a read-only version of my entire data history completed in a single evening. Even at Opus API rates, it cost me less than half the price of a single annual seat.

[grepfru_it]

Heh and without api docs, just copy and paste the urls from network traffic and Claude will write a library for you.

[StanAngeloff]

One of the many SaaS products we use at Day Job chose to gatekeep its MCP behind an enterprise plan. A brief Claude Code session later and a better, more feature-full MCP than the official was reverse-engineered from internal APIs by Opus.

[hyperman1]

Right now, software is protected by the attacker not having enough competence. If that's over, the logical next step is using real encryption.

E.g. a synth has a public key embedded. To change settings, you upload them to the vendor, who blesses them with their private key.

Hacking such a synth requires either jailbreaking the synth, or the vendor losing their key . Both can be mitigated with tamper resistant hardware.

We're well ahead on this path already, I assume AI will accellerate it. This is very bad news for the right to repair.

[darkwater]

But everything you described was basically a byproduct of incompetence somehow no? On both side. That's why the right to repair and how local HW should be treated when the online counterpart is EOLed by the manufacturer should be mandated by law. A law that stands on the side of the citizen, the end-user, obviously.

[hyperman1]

I would not describe it as incompetence, more as

1) current encryption not available in the 1990's. These are the age of DES and weapon-grade vs commercial encryption. There was a legal cost blocking strong encryption.

2) Manufacturers were not as strongly opposed to people touching the internals. After WW2, most people could fix anything, because survival depended on it. Even in the 60's radios etc. came with schematics, and building your own was normal and cost-effective. The shift happened in the '90s, with governements requiring licensing for everything, and mass manufacturing making repair less cost effective than buying a new one.

Our current culture where only people blessed by the manufacturer are allowed to do anything is very recent.

[justafewwords]

(Reads:) "But, but...but... but everything... you described ...basically seem to be somehow a byproduct of incompetence...no"

[trying-to-generate-random-making-sense-content]

Let me gasps ask: The older six-fingers-"AI"-characters had learned an music-instrument by now, ander are much more capable of playing music you otherwise haddn't known or thought about..."?

um What about those early shadowy boygroup, whom seem asian, no ? (-;

[after-losing-entry-address-of-topic-question]

But back to your trustworth-written text, Yes!

regards,

[yonran]

I think companies with valuable data to scrape (e.g. media companies) will eventually lock it behind APIs that verify Apple App Attest or Google Play Integrity. And deprecate websites which are easily scraped too. Then it will be useless to reverse engineer APIs used by apps and we will have to run the unmodified client on an unmodified OS.

[ls612]

It wouldn't surprise me if reverse engineering is put on the "highly unsafe" list in the near future in the same category as bio because of these interests. Can't have the cattle classes be able to control their own property now can we?

[pixl97]

This is pretty much a given anyway. Making reverse engineering tools is already likely to get you sued by someone so model makers are apt to slow down the ability of their tools to reverse engineer to avoid the lawsuits themselves.

[ls612]

Heh finally the impunity of the NSA is good for once. Good luck suing them over Ghidra

[aizk]

What do you mean? Everyone is talking about Mythos.

[fn-mote]

I think GP is talking about cracking, not pen testing.

[trumpdong]

Those are the same thing. They're talking about decompilation and protocol analysis.

[bredren]

They're talking about patching Claude Code.

[ElFitz]

Some people even had some fun de-minifying JS and disassembling binaries. Successfully.