Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Claude Code Found a Linux Vulnerability Hidden for 23 Years

mtlynch.io

Post reply on HN
Print view View original

81–90 of 303 posts

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#81

Post by skeledrew »

bigbugbag wrote: post #44
NitpickLawyer wrote: post #19

Earlier quoted context omitted.

Tokens aren't more expensive than highly trained meatbags today . There's no way they'll be more expensive "tomorrow"...

[flagged]

> they are and they will be

Calculate the approximate cost of raising a human from birth to having the knowledge and skills to do X, along with maintenance required to continue doing X. Multiply by a reasonable scaling factor in comparison to one of today's best LLMs (ie how many humans and how much time to do Xn, vs the LLM).

Calculate the cost of hardware (from raw elements), training and maintenance for said LLM (if you want to include the cost of research+software then you'll have to also include the costs of raising those who taught, mentored, etc the human as well). Consider that the human usually specializes, while the LLM touches everything. I think you'll find even a roughly approximate answer very enlightening if you're honest in your calculations.

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#82

Post by petesergeant »

Jcampuzano2 wrote: post #69
christophilus wrote: post #56

Earlier quoted context omitted.

This is where the Codex and Claude Code Pro/Max plans are excellent. I rarely run into the limits of Codex. If I do, I wait and come back and have it resume once the window has expired.

Claude and Codex pro/max subs aren't supposed to be used for commercial/enterprise development so its not really an option for execs in enterprise. They need to take into account API costs. At my F500 company execs are very wary of the costs of most of these tools and its always top of mind. We have dashboards and gather tons of internal metrics on which tools devs are using and how much they are costing.

> Claude and Codex pro/max subs aren't supposed to be used for commercial/enterprise development

lolwut?

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#83

Post by otterley »

Jcampuzano2 wrote: post #69
christophilus wrote: post #56

Earlier quoted context omitted.

This is where the Codex and Claude Code Pro/Max plans are excellent. I rarely run into the limits of Codex. If I do, I wait and come back and have it resume once the window has expired.

Claude and Codex pro/max subs aren't supposed to be used for commercial/enterprise development so its not really an option for execs in enterprise. They need to take into account API costs. At my F500 company execs are very wary of the costs of most of these tools and its always top of mind. We have dashboards and gather tons of internal metrics on which tools devs are using and how much they are costing.

Are they also measuring productivity? Measuring only token costs is like looking only at grocery spend but not the full receipt: you don’t know whether you fed your family for a week or for only a day.

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#84

Post by skeledrew »

lebovic wrote: post #8
KetoManx64 wrote: post #5

Earlier quoted context omitted.

Tokens are insanely cheap at the moment. Through OpenRouter a message to Sonnet costs about $0.001 cents or using Devstral 2512 it's about $0.0001. An extended coding session/feature expansion will cost me about $5 in credits. Split up your codebase so you don't have to feed all of it into the LLM at once and it's a very reasonable.

It cost me ~$750 to find a tricky privilege escalation bug in a complex codebase where I knew the rough specs but didn't have the exploit. There are certainly still many other bugs like that in the codebase, and it would cost $100k-$1MM to explore the rest of the system that deeply with models at or above the capability of Opus 4.6. It's definitely possible to do a basic pass for much less (I do this with autopen.dev…

Compare to the cost when said vulnerabilities are exploited by bad actors in critical systems. Worth it yet?

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#85

Post by asyx »

sph wrote: post #72
mavamaarten wrote: post #64

Earlier quoted context omitted.

I'm growing allergic to the hype train and the slop. I've watched real-life talks about people that sent some prompt to Claude Code and then proudly present something mediocre that they didn't make themselves to a whole audience as if they'd invented the warm water, and that just makes me weary. But at the same time, it has transformed my work from writing everything bit of code myself, to me writing the cool and com…

> it has transformed my work […] to me writing the cool and complex things > it's amazingly capable at that. > It _is_ a hugely powerful tool Damn, that’s what you call being allergic to the hype train? This type of hypocritical thinly-veiled praise is what is actually unbearable with AI discourse.

I don’t think it is controversial that AI tools are good enough at crud endpoints that it is totally viable to just let it run through the grunt work of hooking up endpoints to a service and then you can focus on the interesting aspect of the application which is exactly that service.

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#86

Post by iterateoften »

mavamaarten wrote: post #64
boplicity wrote: post #59

Earlier quoted context omitted.

The lesson here shouldn't be that Claude Code is useless, but that it's a powerful tool in the hands of the right people.

I'm growing allergic to the hype train and the slop. I've watched real-life talks about people that sent some prompt to Claude Code and then proudly present something mediocre that they didn't make themselves to a whole audience as if they'd invented the warm water, and that just makes me weary. But at the same time, it has transformed my work from writing everything bit of code myself, to me writing the cool and com…

Sounds like maybe you might have some mixed feelings about becoming more effective with ai, but then at the same time everyone else is too so the praise youre expecting is diluted.

I see it all the time now too. People have no frame of reference at all about what is hard or easy so engineers feel under-appreciated because the guy who never coded is getting lots of praise for doing something basic while experienced people are able to spit out incredibly complex things. But to an outsider, both look like they took the same work.

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#87

Post by skeledrew »

kasey_junk wrote: post #75
skeledrew wrote: post #70

Earlier quoted context omitted.

> Claude Code works on closed source (but decompiled) source Very likely not nearly as well, unless there are many open source libraries in use and/or the language+patterns used are extremely popular. The really huge win for something like the Linux kernel and other popular OSS is that the source appears in the training data, a lot. And many versions. So providing the source again and saying "find X" is primarily bri…

I’m not a security researcher, but I know a few and I think universally they’d disagree with this take. The llms know about every previous disclosed security vulnerability class and can use that to pattern match. And they can do it against compiled and in some cases obfuscated code as easily as source. I think the security engineers out there are terrified that the balance of power has shifted too far to the finding…

Many vulnerabilities aren't just pattern matching though; deep understanding of the context in the particular codebase is also needed. And a novel codebase means more attention than usual will be spent grepping and keeping the context in focus. Which will make it easier to miss certain things, than if enough of the context was already encoded in the model weights.

Same thing applies to humans: the better someone knows a codebase, the better they will be at resolving issues, etc.

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#88

Post by skeledrew »

KetoManx64 wrote: post #10
gmerc wrote: post #9

Earlier quoted context omitted.

You’d have to ignore the massive investor ROI expectations or somehow have no capability to look past “at the moment”.

Not really. I'm fully taking advantage of these low prices while they last. Eventually the AI companies will run start running out of funny money and start charging what the models actually cost to run, then I just switch over to using the self hosted models more often and utilize the online ones for the projects that need the extra resources. Currently there's no reason for why I shouldn't use Claude Sonnet to write…

> start charging what the models actually cost to run

The political climate won't allow that to happen. The US will do everything to stay ahead of China, and a rise in prices means a sizeable migration to Chinese models, giving them that much more data to improve their models and pass the US in AI capability (if they haven't already).

But also it'll happen in a way, as eventually models will become optimized enough that run cost become more or less negligible from a sustainability perspective.

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#89

Post by paulddraper »

mtlynch wrote: post #33
jason1cho wrote: post #25

This isn't surprising. What is not mentioned is that Claude Code also found one thousand false positive bugs, which developers spent three months to rule out.

> What is not mentioned is that Claude Code also found one thousand false positive bugs, which developers spent three months to rule out. Source? I haven't seen this anywhere. In my experience, false positive rate on vulnerabilities with Claude Opus 4.6 is well below 20%.

Source: """AI is bad"""

Re: Claude Code Found a Linux Vulnerability Hidden for 23 Years

#90

Post by rixrax »

I hope next up is the performance and bloat that the LLMs can try and improve.

Especially on perf side I would wager LLMs can go from meat sacks what ever works to how do I solve this with best available algorithm and architecture (that also follows some best practises).

Post reply on HN