Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Significant raise of reports

lwn.net

Post reply on HN
Print view View original

161–164 of 164 posts

Re: Significant raise of reports

#161

Post by virgil_disgr4ce »

jakevoytko wrote: post #129
charcircuit wrote: post #127

Earlier quoted context omitted.

Google Docs and VS Code are the first two that come to mind for autosave and they don't use a temp file.

Fun fact: I was on the Google Docs team from 2010-2015. Save didn't do anything but we still hooked up an impression to the keystroke to measure how often people tried to save. It was one of the top things people did in the app at first; it was comparable to how often people would bold and unbold text. And then as people gained confidence it went down over time.

This is DELIGHTFUL.

Re: Significant raise of reports

#162

Post by SAI_Peregrinus »

keeganpoppen wrote: post #153
Muromec wrote: post #143

Earlier quoted context omitted.

>it takes effort to familiarize yourself with new features, decide what should be enabled and what should be disabled, etc. What features? I update my rolling release once a month and nothing changes for the last 10 ish years. Maybe pipewire/pulse thingy was annoying and bluetooth acted a bit. With docker on rpi I even upgrade the whole zoo of things by just rebooting.

exactly. it is something you genuinely never need to think about, except for once in a blue moon. or, more like once in a leap year. and completely unmeasured by the "we will update it when our [horrific] business processes say it's okay" crowd is the cumulative angst of shit being broken FOR NO REASON. and that is to say nothing of the security vulnerabilities and all the other reasons that exist for updating your s…

The slower you update, & the longer you try to maintain a "long-term support" branch, the harder updates get. Gradual changes with a rolling release system are much, much simpler than the massive step changes of a "stable" distro.

Re: Significant raise of reports

#163

Post by Chu4eeno »

bri3d wrote: post #103
tptacek wrote: post #97

Earlier quoted context omitted.

It's a bigger deal than that. Academically, syzkaller is just a very well orchestrated fuzzer, producing random pathological inputs to system calls, detecting crashes, and then producing reproductions. Syzkaller doesn't "know" what it's found, and a substantial fraction of what it finds are "just" crashers that won't ever be weaponizable. An LLM agent finding vulnerabilities is an implicit search process over a corpu…

Yes, once we reach the broader conversation (I actually didn't initially grasp that the OP post was a sub-article under another one on LWN which then linked out to yet another article called "Vulnerability Research is Cooked"), I completely agree. Modern LLMs are _exceptionally_ good at developing X-marks-the-spot vulnerabilities into working software; I fed an old RSA validation mistake in an ECU to someone in a Git…

according to anthropic's red team not even the secret claude stuff they're holding back is able to weaponize vulnerabilities without simplifying (disabling mitigations etc).

so we might be lucky that the LLMs are able to find the vulnerabilities before they are able to weaponize them, giving defense a time window.

Post reply on HN