Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Claude Code Found a Linux Vulnerability Hidden for 23 Years

mtlynch.io

Post reply on HN
Print view View original

11–20 of 303 posts

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#11

Post by twosdai »

KetoManx64 wrote: post #10
gmerc wrote: post #9

Earlier quoted context omitted.

You’d have to ignore the massive investor ROI expectations or somehow have no capability to look past “at the moment”.

Not really. I'm fully taking advantage of these low prices while they last. Eventually the AI companies will run start running out of funny money and start charging what the models actually cost to run, then I just switch over to using the self hosted models more often and utilize the online ones for the projects that need the extra resources. Currently there's no reason for why I shouldn't use Claude Sonnet to write…

I also have this feeling. But do you ever doubt it. that when the time comes we will be like the boiled frog? Where its "just so convenient" or that the reality of setting up a local ai is just a worse experience for a large upfront cost?

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#12

Post by iririririr »

twosdai wrote: post #11
KetoManx64 wrote: post #10

Earlier quoted context omitted.

Not really. I'm fully taking advantage of these low prices while they last. Eventually the AI companies will run start running out of funny money and start charging what the models actually cost to run, then I just switch over to using the self hosted models more often and utilize the online ones for the projects that need the extra resources. Currently there's no reason for why I shouldn't use Claude Sonnet to write…

I also have this feeling. But do you ever doubt it. that when the time comes we will be like the boiled frog? Where its "just so convenient" or that the reality of setting up a local ai is just a worse experience for a large upfront cost?

worse. he's already boiled. probably paying way more than that one dollar per bash script with all the subscriptions he already has.

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#13

Post by deaux »

KetoManx64 wrote: post #10
gmerc wrote: post #9

Earlier quoted context omitted.

You’d have to ignore the massive investor ROI expectations or somehow have no capability to look past “at the moment”.

Not really. I'm fully taking advantage of these low prices while they last. Eventually the AI companies will run start running out of funny money and start charging what the models actually cost to run, then I just switch over to using the self hosted models more often and utilize the online ones for the projects that need the extra resources. Currently there's no reason for why I shouldn't use Claude Sonnet to write…

> Currently there's no reason for why I shouldn't use Claude Sonnet to write one time bash scripts, once it starts costing me a dollar to do so I'm going to change my behavior.

This just isn't going to happen, we have open weights models which we can roughly calculate how much they cost to run that are on the level of Sonnet _right now_. The best open weights models used to be 2 generations behind, then they were 1 generation behind, now they're on par with the mid-tier frontier models. You can choose among many different Kimi K2.5 providers. If you believe that every single one of those is running at 50% subsidies, be my guest.

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#14

Post by KetoManx64 »

iririririr wrote: post #12
twosdai wrote: post #11

Earlier quoted context omitted.

I also have this feeling. But do you ever doubt it. that when the time comes we will be like the boiled frog? Where its "just so convenient" or that the reality of setting up a local ai is just a worse experience for a large upfront cost?

worse. he's already boiled. probably paying way more than that one dollar per bash script with all the subscriptions he already has.

Yeah, the $20 I paid to OpenRouter about 4 months ago really cost me an arm and a leg, not sure where I'll get my next meal if I'm to be honest.

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#15

Post by ThePowerOfFuet »

KetoManx64 wrote: post #5
jazz9k wrote: post #4

This does sound great, but the cost of tokens will prevent most companies from using agents to secure their code.

Tokens are insanely cheap at the moment. Through OpenRouter a message to Sonnet costs about $0.001 cents or using Devstral 2512 it's about $0.0001. An extended coding session/feature expansion will cost me about $5 in credits. Split up your codebase so you don't have to feed all of it into the LLM at once and it's a very reasonable.

>$0.001 cents

$0.001 (1/10 of a cent) or 0.001 cents (1/1000 of a cent, or $0.00001)?

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#16

Post by epolanski »

jazz9k wrote: post #4

This does sound great, but the cost of tokens will prevent most companies from using agents to secure their code.

I don't buy it.

Inference cost has dropped 300x in 3 years, no reason to think this won't keep happening with improvements on models, agent architecture and hardware.

Also, too many people are fixated with American models when Chinese ones deliver similar quality often at fraction of a cost.

From my tests, "personality" of an LLM, it's tendency to stick to prompts and not derail far outweights the low % digit of delta in benchmark performance.

Not to mention, different LLMs perform better at different tasks, and they are all particularly sensible to prompts and instructions.

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#17

Post by userbinator »

Not "hidden", but probably more like "no one bothered to look".

declares a 1024-byte owner ID, which is an unusually long but legal value for the owner ID.

When I'm designing protocols or writing code with variable-length elements, "what is the valid range of lengths?" is always at the front of my mind.

it uses a memory buffer that’s only 112 bytes. The denial message includes the owner ID, which can be up to 1024 bytes, bringing the total size of the message to 1056 bytes. The kernel writes 1056 bytes into a 112-byte buffer

This is something a lot of static analysers can easily find. Of course asking an LLM to "inspect all fixed-size buffers" may give you a bunch of hallucinations too, but could be a good starting point for further inspection.

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#18

Post by NitpickLawyer »

userbinator wrote: post #17

Not "hidden", but probably more like "no one bothered to look". declares a 1024-byte owner ID, which is an unusually long but legal value for the owner ID. When I'm designing protocols or writing code with variable-length elements, "what is the valid range of lengths?" is always at the front of my mind. it uses a memory buffer that’s only 112 bytes. The denial message includes the owner ID, which can be up to 1024 by…

> This is something a lot of static analysers can easily find.

And yet they didn't (either noone ran them, or they didn't find it, or they did find it but it was buried in hundreds of false positives) for 20+ years...

I find it funny that every time someone does something cool with LLMs, there's a bunch of takes like this: it was trivial, it's just not important, my dad could have done that in his sleep.

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#19

Post by NitpickLawyer »

jazz9k wrote: post #4

This does sound great, but the cost of tokens will prevent most companies from using agents to secure their code.

Tokens aren't more expensive than highly trained meatbags today. There's no way they'll be more expensive "tomorrow"...

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#20

Post by userbinator »

NitpickLawyer wrote: post #18
userbinator wrote: post #17

Not "hidden", but probably more like "no one bothered to look". declares a 1024-byte owner ID, which is an unusually long but legal value for the owner ID. When I'm designing protocols or writing code with variable-length elements, "what is the valid range of lengths?" is always at the front of my mind. it uses a memory buffer that’s only 112 bytes. The denial message includes the owner ID, which can be up to 1024 by…

> This is something a lot of static analysers can easily find. And yet they didn't (either noone ran them, or they didn't find it, or they did find it but it was buried in hundreds of false positives) for 20+ years... I find it funny that every time someone does something cool with LLMs, there's a bunch of takes like this: it was trivial, it's just not important, my dad could have done that in his sleep.

Remember Heartbleed in OpenSSL? That long predated LLMs, but same story: some bozo forgot how long something should/could be, and no one else bothered to check either.
Post reply on HN