201–210 of 303 posts
Earlier quoted context omitted.
[flagged]
More like, if you pay a fee to use a service, you can find the bombs already hidden somewhere in your premises.
Earlier quoted context omitted.
The lesson here shouldn't be that Claude Code is useless, but that it's a powerful tool in the hands of the right people.
I'm growing allergic to the hype train and the slop. I've watched real-life talks about people that sent some prompt to Claude Code and then proudly present something mediocre that they didn't make themselves to a whole audience as if they'd invented the warm water, and that just makes me weary. But at the same time, it has transformed my work from writing everything bit of code myself, to me writing the cool and com…
[flagged]
[flagged]
Also realize that, unlike a security researcher, an attacker doesn't necessarily need to review the model out carefully to filter out the slop before a bug submission. They mostly just need to run the shit.
Earlier quoted context omitted.
>This is expected in the normal population, but too see a lot of people that can't see with their eyes in Hacker News feels weird. You are replying to an account created in less than 60 days.
This is a bit unfair. Hackers are born every day.
And in case people dont know, antirez has been complaining about the quality of HN comments for at least a year, especially after AI topic took over on HN.
It is still better than lobster or other place though.
Earlier quoted context omitted.
That's not what is happening right now. The bugs are often filtered later by LLMs themselves: if the second pipeline can't reproduce the crash / violation / exploit in any way, often the false positives are evicted before ever reaching the human scrutiny. Checking if a real vulnerability can be triggered is a trivial task compared to finding one, so this second pipeline has an almost 100% success rate from the POV: i…
>This is expected in the normal population, but too see a lot of people that can't see with their eyes in Hacker News feels weird. You are replying to an account created in less than 60 days.
Earlier quoted context omitted.
Well, the cloud is someone else's computer.
It is, but that's not a useful or insightful thing to say
Earlier quoted context omitted.
> Checking if a real vulnerability can be triggered is a trivial task compared to finding one Have you ever tried to write PoC for any CVE? This statement is wrong. Sometimes bug may exist but be impossible to trigger/exploit. So it is not trivial at all.
I'm tickled at the idea of asking antirez [1] if he's ever written a PoC for a CVE. [1] https://en.wikipedia.org/wiki/Salvatore_Sanfilippo
Earlier quoted context omitted.
More like, if you pay a fee to use a service, you can find the bombs already hidden somewhere in your premises.
And? They didn't put the bombs on your premises. Before "the service", you had bombs you didn't know about; after, you get to know about them.
Earlier quoted context omitted.
And? They didn't put the bombs on your premises. Before "the service", you had bombs you didn't know about; after, you get to know about them.
But the service also tells criminals and adversaries about the bomb locations.
AI is reviving debates about vulnerability research that we thought we killed off in the 1990s.
Earlier quoted context omitted.
[flagged]
Thank you for your kind comment. I recommend you watch the actual talk, and then understand what exploiting RCEs in things like the Linux kernel at such a scale that defenders can no longer keep up with actually means. The latter is their claim, not mine. Also realize that, unlike a security researcher, an attacker doesn't necessarily need to review the model out carefully to filter out the slop before a bug submissi…