Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google announces Sec-Gemini v1 a new experimental cybersecurity model

security.googleblog.com

Post reply on HN
Print view View original

41–50 of 53 posts

Re: Google announces Sec-Gemini v1 a new experimental cybersecurity model

#41

Post by upcoming-sesame »

asadm wrote: post #16
qwertox wrote: post #10

There is generally something about the Gemini models which feels a bit different than Claude, ChatGPT or Mistral. I always have the feeling that I'm chatting with a model oriented towards engineering tasks. The seriousness, lack of interest of being humorous or cool. I don't know if this is because I interact with Gemini only through AI Studio, and it may have different system instructions (apart from those one can a…

2.5 has been amazing for programming. I just send it entire repo as context when I am lazy and then ask it for entire modified files back with the (medium sized) change. It almost always works! I wish to either start using cursor or some vscode extension to do this from ide itself.

How do you send an entire repo to it ? file by file ?

Re: Google announces Sec-Gemini v1 a new experimental cybersecurity model

#42

Post by infoSecer »

It always blows my mind that nobody at Google thought it would be a good idea to very carefully review the answer of the AI. In the second screenshot, the prompt asks about CVE-2024-3400, and at first glance this appears ok.

But in the affected systems section it states:

> Also Hitachi Energy RTU500 firmware and Siemens Ruggedcom APE1808 firmware.

I cannot find any reference that this Hitachi device is vulnerable to that CVE. Hitachi has a nice interface to list all vulnerabilities of their devices, this CVE is not part of it. In the Mitigation section any mention of Hitachi is also missing. Almost as if this device is not vulnerable.

There is some more weirdness, like it doesn't mention the "portal" feature is also vulnerable.

Re: Google announces Sec-Gemini v1 a new experimental cybersecurity model

#43

Post by dartos »

tyushk wrote: post #23
qwertox wrote: post #10

There is generally something about the Gemini models which feels a bit different than Claude, ChatGPT or Mistral. I always have the feeling that I'm chatting with a model oriented towards engineering tasks. The seriousness, lack of interest of being humorous or cool. I don't know if this is because I interact with Gemini only through AI Studio, and it may have different system instructions (apart from those one can a…

You put into words something I've been struggling to describe for a long time. Gemini gives short, succinct responses with whatever information you need and minimal anything else. ChatGPT, Claude both fill text with mannerisms, formatting, etc. I didn't realize just how big the difference was until I tested it. "How do I clear a directory of all executable files on Debian?" Gemini 2.0 Flash: (responses manually forma…

Probably because both anthropic and openai were on the whole AGI train where they were trying to heavily personify their products.

Google never seemed to personify theirs, IIRC. They always presented their AI tools in a utilitarian way.

Re: Google announces Sec-Gemini v1 a new experimental cybersecurity model

#45

Post by ebursztein »

infoSecer wrote: post #42

It always blows my mind that nobody at Google thought it would be a good idea to very carefully review the answer of the AI. In the second screenshot, the prompt asks about CVE-2024-3400, and at first glance this appears ok. But in the affected systems section it states: > Also Hitachi Energy RTU500 firmware and Siemens Ruggedcom APE1808 firmware. I cannot find any reference that this Hitachi device is vulnerable to…

Thanks for looking in-depth in our post. The Hitachi RTU500 mention is not an hallucination, we did check for those. It is mentioned in the Mandiant threat intelligence data.

Re: Google announces Sec-Gemini v1 a new experimental cybersecurity model

#46

Post by cainxinth »

Y_Y wrote: post #11
qwertox wrote: post #10

There is generally something about the Gemini models which feels a bit different than Claude, ChatGPT or Mistral. I always have the feeling that I'm chatting with a model oriented towards engineering tasks. The seriousness, lack of interest of being humorous or cool. I don't know if this is because I interact with Gemini only through AI Studio, and it may have different system instructions (apart from those one can a…

> The seriousness, lack of interest of being humorous or cool. I love this. When ChatGPT compliments me on my great question or tries to banter it causes me great despair.

It was flattering for a nanosecond, and then you realize 4o will call almost anything “insightful” or “profound.”

Re: Google announces Sec-Gemini v1 a new experimental cybersecurity model

#47

Post by infoSecer »

ebursztein wrote: post #45
infoSecer wrote: post #42

It always blows my mind that nobody at Google thought it would be a good idea to very carefully review the answer of the AI. In the second screenshot, the prompt asks about CVE-2024-3400, and at first glance this appears ok. But in the affected systems section it states: > Also Hitachi Energy RTU500 firmware and Siemens Ruggedcom APE1808 firmware. I cannot find any reference that this Hitachi device is vulnerable to…

Thanks for looking in-depth in our post. The Hitachi RTU500 mention is not an hallucination, we did check for those. It is mentioned in the Mandiant threat intelligence data.

Have you considered that Mandiant is wrong? I cannot find any evidence that it would be vulnerable. Hitachi doesn't even appear to be a technology partner of Palo Alto (https://technologypartners.paloaltonetworks.com/English/dire...).

As far as I can tell, the only connection between those is, that CISA released this alert which mentions multiple unrelated advisories in one post. Which happens to be the Siemens Palo Alto and another unrelated Hitachi advisory in RTU500: https://www.cisa.gov/news-events/alerts/2024/04/25/cisa-rele...

Re: Google announces Sec-Gemini v1 a new experimental cybersecurity model

#48

Post by querez »

indeyets wrote: post #27
querez wrote: post #24

Earlier quoted context omitted.

I use a very simple custom system prompt (not on my work machine at the moment, but essentially something along the lines of "for technical questions, please be concise and to the point, and when asked for code, omit explanations and emit just the code itself unless I ask for explanations"), and it does wonders.

It’s interesting that my default prompt is exactly the opposite one: “do not write the code unless I ask for it specifically”. I like to use LLMs as a discussion partner, but writing code is trivial after a good discussion and I can do that myself

I guess it depends on use-cases. I use ChatGPT a lot for "trivial" questions a la "how do I uncommit a specific file in my last git commit" or "how do I paste from one PIL.Image into another one". In the past I would have to search google, click on the StackOverflow link, and then parse that whole page. Asking ChatGPT to give me just the snippet is faster, so doesn't get me out of my flow as much.

Re: Google announces Sec-Gemini v1 a new experimental cybersecurity model

#49

Post by amitport »

ZYbCRq22HbJ2y7 wrote: post #38

Does it seem like a bad idea to trust something that is probablistically correct with security?

Like with any automatic procedure: Are humans better?

Specifically, in their own example they are just citing Mandiant, which may itself be wrong...

https://news.ycombinator.com/item?id=43595294

Re: Google announces Sec-Gemini v1 a new experimental cybersecurity model

#50

Post by regulayshun »

qwertox wrote: post #10

There is generally something about the Gemini models which feels a bit different than Claude, ChatGPT or Mistral. I always have the feeling that I'm chatting with a model oriented towards engineering tasks. The seriousness, lack of interest of being humorous or cool. I don't know if this is because I interact with Gemini only through AI Studio, and it may have different system instructions (apart from those one can a…

[dead]
Post reply on HN