I'm disinclined to be overly generous to Antrophic, but I have to say that regardless of whether the talk of Mythos being uniquely dangerous was mostly cynical: It would be great if this starts a trend of giving security-critical software a few months head start with any new significantly improved model.
Mythos Finds a Curl Vulnerability
131–140 of 298 posts
Re: Mythos Finds a Curl Vulnerability
#132Quote: "My personal conclusion can however not end up with anything else than that the big hype around this model so far was primarily marketing. I see no evidence that this setup finds issues to any particular higher or more advanced degree than the other tools have done before Mythos. Maybe this model is a little bit better, but even if it is, it is not better to a degree that seems to make a significant dent in co…
I commented this in another post but I'm going to repeat it because I believe its important for this discussion. > The worrying part about Mythos isn't the fact that it can find bugs. The worrying part is Mythos being able to find them on its own across entire code base as vast as Firefox then write exploits for what its found with a very basic prompt. > The skill required to find then create zero days is quickly app…
Opus can find bugs on its own in large codebases just fine with minimal prompting.
The great exaggeration is that this is a new capability.
Re: Mythos Finds a Curl Vulnerability
#133Earlier quoted context omitted.
To me, it is a very good data point. Curl uses all sorts of tools, including AI tools to find bugs. These tools, according to the article found hundreds of bugs including a dozen CVE. Mythos found one vulnerability. It means the Mythos is just another tool, not the revolution it claims to be. It is common that when a new tool is introduced that a bunch of bugs are found, with diminishing returns. Mythos finding one v…
The question is how many security vulnerabilities are actually left in the code after all the recent AI attention. Either Mythos is a nothingburger, or it's substantially more powerful but there's nothing left to do. Even a large amount of C can be correct eventually. Curl has the _potential_ to become a good data point maybe 6-12 months from now - if researchers and new tools find many more vulnerabilities then Myth…
False dichotomy
Re: Mythos Finds a Curl Vulnerability
#134Quote: "My personal conclusion can however not end up with anything else than that the big hype around this model so far was primarily marketing. I see no evidence that this setup finds issues to any particular higher or more advanced degree than the other tools have done before Mythos. Maybe this model is a little bit better, but even if it is, it is not better to a degree that seems to make a significant dent in co…
It may well be that the hype was primarily marketing. The other alternative is that Curl is simply secure enough that there was far less to find than in other projects.
Not really, curl has slow anonymous memory leaks because of how the connection session caching was implemented. If you don't periodically restart a program, than people encounter strange hard to diagnose issues sooner or later.
Also, looking at something that trips valgrind warnings already, may obfuscate a lot of problems in both your own code and the curl library itself.
One could report the issue as functioning as described in the API, but the developers do not accept direct community input into the project.
People use it out of convenience, but it is just as janky as most bloated projects. =3
Re: Mythos Finds a Curl Vulnerability
#135Earlier quoted context omitted.
I commented this in another post but I'm going to repeat it because I believe its important for this discussion. > The worrying part about Mythos isn't the fact that it can find bugs. The worrying part is Mythos being able to find them on its own across entire code base as vast as Firefox then write exploits for what its found with a very basic prompt. > The skill required to find then create zero days is quickly app…
Opus can find bugs on its own in large codebases just fine with minimal prompting. The great exaggeration is that this is a new capability.
> Opus can find bugs on its own in large codebases just fine with minimal prompting.
and then it write the exploits automatically for you?
Re: Mythos Finds a Curl Vulnerability
#136[dead]
Re: Mythos Finds a Curl Vulnerability
#137Earlier quoted context omitted.
Opus can find bugs on its own in large codebases just fine with minimal prompting. The great exaggeration is that this is a new capability.
> Opus can find bugs on its own in large codebases just fine with minimal prompting. and then it write the exploits automatically for you?
Yes
Re: Mythos Finds a Curl Vulnerability
#138Re: Mythos Finds a Curl Vulnerability
#139Re: Mythos Finds a Curl Vulnerability
#140Earlier quoted context omitted.
Considering Richard Dawkins has recently succumbed to the same delusion it is a reminder that no matter how intelligent someone may otherwise be, we are all human and have certain tendencies and blind spots; anthropomorphizing non-entities being one of those.
One phenomenon that spooks me is when intelligent people believe in idiotic things. It makes me wonder if there's a wrong turn in the road that I too might fall in the same pit.
Vigilance is warranted, I think.
I can't find it right now, but something came up a few years ago (probably on HN) about highly intelligent people being more adept at making up arguments to rationalize beliefs and actions that they had taken for other reasons entirely.
Sort of makes sense that wielding a more complex mind would offer more complex ways to go wrong, doesn't it?