Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A quick look at Mythos run on Firefox: too much hype?

xark.es

Post reply on HN
Print view View original

21–30 of 38 posts

Re: A quick look at Mythos run on Firefox: too much hype?

#21

Post by licorices »

goalieca wrote: post #2

There was a double fronted marketing push by both organizations. That much is true and this makes me more skeptical of the message and how exactly it was framed. If we just stick with c/c++ systems, pretty much every big enough project has a backlog of thousands of these things. Either simple like compiler warnings for uninitialized values or fancier tool verified off-by-one write errors that aren’t exploitable in pr…

Feel like LLMs main sue in these situations would be to work through these essentially nothing-burger issues? If they're essentially just time consuming to solve, rather than problematic, they should be fairly trivial for them to hopefully solve reliably enough right? I'm very doubtful on AI for actual issues a lot of times, but in my experience, it rarely finds bigger issues from scratch without a lot of extra context such as some hints towards what and where the issue is, and essentially full context explaining any relevant parts to it. However I do find that it often find minor issues when the context is small and contained, or as mentioned when it knows what the issue is, and the solution is simple.

I'm sure there's already plenty of work towards these things, but do bigger code bases completely shut out AI right now, due to the extreme amount of unsolicited PRs they get from AIs? I'd imagine if they were coordinated and structured properly on these things, they'd be more likely to be seen as an acceptable thing? I'm just spitballing, never worked on any real open source project, especially one where there's thousands if not millions of users and several issues every day, so my view on AI usage in these are mostly just from some instances where they ban all AI PRs and stuff like that because they are often really bad.

Re: A quick look at Mythos run on Firefox: too much hype?

#23

Post by Sweepi »

> Conclusion

"The Firefox 150 data suggests a tool that is genuinely useful for defensive security work, especially at scale, but the public record does not justify the strongest claims people want to make from it. The headline number is impressive, yet it bundles together bugs of very different significance and does not publicly resolve into a clean accounting."

I mean: Obviously. Does not matter how good or bad a product is, the current meta is to over-hype it in order to achieve maximum "news-penetration". Anthropic seems to have sth. "real". However, Since there is no way for outsiders to calculate real metrics like false-positive rate, cost (tokens, Dev hours for setup and review, ...)/ Issue found, ... there is no real way to put any scale on the hype-graph.

Re: A quick look at Mythos run on Firefox: too much hype?

#24

Post by kevincox »

The author seems to believe that dereferencing a null pointer is safe. DoS attacks aside dereferencing a null pointer in C++ is undefined behavior so you never know what could happen. It could easily result in bypassing seemingly unrelated security checks or any other behaviour. To know it wasn't exploitable you would need to check the compiled output of every compiler and set of flags used to compile Firefox.

Re: A quick look at Mythos run on Firefox: too much hype?

#25

Post by [deleted] »

MyFirstSass wrote: post #10
Eufrat wrote: post #3

Probably worth noting that the new-ish Mozilla CEO, Anthony Enzor-DeMeo, is clearly an AI booster having talked about wanting to make Firefox into a “modern AI browser”. So, I don’t doubt that Anthropic and Mozilla saw an opportunity to make a good bit of copy. I think this has been pushed too hard , along with general exhaustion at people insisting that AI is eating everything and the moon these claims are getting k…

Hackernews has also been completely co-opted by boosters. So much that i don't really visit anymore after 15 years of use. It's a bizarre situation with billions in marketing and PR, astroturfing and torrents of fake news with streams of comments beneath them with zero skepticism and an almost horrifying worship of these billion dollar companies. Something completely flipped here at some point, i don't know if it's b…

[deleted]

Re: A quick look at Mythos run on Firefox: too much hype?

#26

Post by Woodi »

Eufrat wrote: post #3

Probably worth noting that the new-ish Mozilla CEO, Anthony Enzor-DeMeo, is clearly an AI booster having talked about wanting to make Firefox into a “modern AI browser”. So, I don’t doubt that Anthropic and Mozilla saw an opportunity to make a good bit of copy. I think this has been pushed too hard , along with general exhaustion at people insisting that AI is eating everything and the moon these claims are getting k…

> new-ish Mozilla CEO, Anthony Enzor-DeMeo, is clearly an AI booster having talked about wanting to make Firefox into a “modern AI browser”

Ah... That's why they put free vpn into v150 - more human behaviors for training :))

Re: A quick look at Mythos run on Firefox: too much hype?

#27

Post by arealaccount »

HeWhoLurksLate wrote: post #14
MyFirstSass wrote: post #10

Earlier quoted context omitted.

Hackernews has also been completely co-opted by boosters. So much that i don't really visit anymore after 15 years of use. It's a bizarre situation with billions in marketing and PR, astroturfing and torrents of fake news with streams of comments beneath them with zero skepticism and an almost horrifying worship of these billion dollar companies. Something completely flipped here at some point, i don't know if it's b…

I haven't been able to find any communities with as high of a signal-to-noise ratio and breadth of experiences as HN, especially not public ones that one can stumble their way into without knowing a guy / joining a clique

Heh that’s a very low bar though

Re: A quick look at Mythos run on Firefox: too much hype?

#28

Post by dd8601fn »

dwedge wrote: post #13

This article felt really informative at first but sone point it was like reading an LLM getting stuck in a circle

It certainly promised more in the beginning than it actually delivered.

It all starts to feel like letting those “before the youtube video” ads run too long without skipping.

A hook you know people would like to know the answer to… followed by utter horseshit.

Re: A quick look at Mythos run on Firefox: too much hype?

#29

Post by SAI_Peregrinus »

bestouff wrote: post #16
goalieca wrote: post #2

There was a double fronted marketing push by both organizations. That much is true and this makes me more skeptical of the message and how exactly it was framed. If we just stick with c/c++ systems, pretty much every big enough project has a backlog of thousands of these things. Either simple like compiler warnings for uninitialized values or fancier tool verified off-by-one write errors that aren’t exploitable in pr…

Globally agreed excepted for the "harmless" bit. Hackers are good these days, and these apparently innocuous bugs can be exploited in creative ways

I think one thing we'll see is that "sophisticated" multi-step exploit chains will become the domain of script kiddies. They often already were, malware vendors often pre-packaged software that exploited several vulnerabilities in a row, but I expect that LLMs will make the "Attack Complexity" metric in CVSS even more useless than it already is.

Re: A quick look at Mythos run on Firefox: too much hype?

#30

Post by red-iron-pine »

MyFirstSass wrote: post #10
Eufrat wrote: post #3

Probably worth noting that the new-ish Mozilla CEO, Anthony Enzor-DeMeo, is clearly an AI booster having talked about wanting to make Firefox into a “modern AI browser”. So, I don’t doubt that Anthropic and Mozilla saw an opportunity to make a good bit of copy. I think this has been pushed too hard , along with general exhaustion at people insisting that AI is eating everything and the moon these claims are getting k…

Hackernews has also been completely co-opted by boosters. So much that i don't really visit anymore after 15 years of use. It's a bizarre situation with billions in marketing and PR, astroturfing and torrents of fake news with streams of comments beneath them with zero skepticism and an almost horrifying worship of these billion dollar companies. Something completely flipped here at some point, i don't know if it's b…

HN is a tech incubator's news blog. OpenAI literally got its start as a YCombinator project as part of YC Research.

Sam Altman of OpenAI was the president of YC for years.

Like, what did you expect mon ami?

Post reply on HN