Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Anonymous GitHub account mass-dropping undisclosed 0-days

github.com

Post reply on HN
Print view View original

371–380 of 407 posts

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#371

Post by handoflixue »

efreak wrote: post #309
handoflixue wrote: post #75

Earlier quoted context omitted.

Do you have a definition of "smart" such that there is something an AI could do to prove itself intelligent? Or are you just defining "fast" as something only horses can do, and considering that a useful insight about cars?

Long-term memory, for one. (reliving your entire life every time you do an action isn't memory). Creativity in new areas without training. Children at school are capable of "discovering" math solutions/methods that are known to others but hasn't been taught to them. There's nothing intelligent about a math processor, even if it's automated.

> Long-term memory, for one.

Do you consider the protagonist of "Memento" to lack intelligence, then?

> Children at school are capable of "discovering" math solutions/methods that are known to others but hasn't been taught to them.

LLMs have already done that one: A chatbot’s result for the 80-year-old “unit distance” conjecture is the first AI proof that would likely be published in math’s top journal if humans had done it alone

https://www.scientificamerican.com/article/ai-just-solved-an...

> Creativity in new areas without training.

To my knowledge, not something that has ever been done by humans, but again, it depends entirely on how you actually define the goal posts.

> There's nothing intelligent about a math processor, even if it's automated.

There's nothing intelligent about a bag of cells, but here we are.

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#372

Post by tosti »

puchatek wrote: post #315
firefax wrote: post #60

Earlier quoted context omitted.

The bigger takeaway is someone that smart is pissed off and dropping their shit with zero warning... but hey, that's just like, my opinion man.

Approaching the maintainers would be ideal but time-consuming. Disclosing it like this is neutral I guess. Better than selling it in the darknet. I do wonder though: if you can tell the AI to search for vulns, can't you also tell it to contact the right maintainer for each one found?

Unfortunately, yes.

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#373

Post by tosti »

wafflemaker wrote: post #314
sysguest wrote: post #305

Earlier quoted context omitted.

hmm maybe if we wait longer, LLMs will learnt to be like "none-em-dashers", and we "em-dashers" will prevail?

Em-dashes and "it's not X. It's Y" seem to be in most LLMs writing style purposefully so they can have detection tools. Just so academia can claim some level of detectability

There's also the "paradigm shift" and "a fundamental Z of X". Those really ding my slop'o'meter.

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#374

Post by smsm42 »

newguy33 wrote: post #320
smsm42 wrote: post #299

Earlier quoted context omitted.

PHP one is at best a moderate-level bug in SOAP client which I don't see any realistic way to exploit (the whole convoluted setup in the POC assumes PHP execution access, which begs the question why bother if you already can execute arbitrary code?) - does not look like "genuine critical" at all.

Critical is an overstatement but it userland PHP execution does not equate to native process control. There are many situations where an attacker may have constrained PHP execution, gadget execution, template or plugin execution, deserialization reachability, or a sandboxed context, but not arbitrary native code execution or arbitrary memory write. Definitely impactful

Security-wise, there's no such thing as constrained PHP execution, at least with the standard PHP engine. The surface is too wide. You still have OS constraints of the user and capabilities and such, but beyond that if you can run PHP code, you can run anything.

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#375

Post by bogwog »

zahlman wrote: post #291
Wowfunhappy wrote: post #126

Earlier quoted context omitted.

My feeling is that my writing doesn't sound anything like an LLM, so if someone thinks I'm an LLM because I used an em-dash, that's on them. That, or I royally screwed up and need to do a better job as a writer. At least with today's LLMs.

> if someone thinks I'm an LLM because I used an em-dash, that's on them. I'll go a step further: I think I'd rather actively filter out people whose AI detection is that naïve.

The false positive rate for assuming em-dashers are AI is probably very low right now. I doubt whatever you write is valuable enough to justify the extra time and mental effort of figuring out if something is AI or not.

Internet slang like "lol" came from trying to text on those shitty number pads on old cellphones. I expect similar slang will come about in the future from humans trying to prove they're not a dirty clanker. Sacrificing the em-dash is just the beginning of this. Soon, we're all going to be typing without rhythm.

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#376

Post by smsm42 »

woodruffw wrote: post #142
Scaled wrote: post #130

Earlier quoted context omitted.

Gitea action runner has a bunch of different ways to setup and doing the isolation properly looks tricky. The documentation doesn't provide any isolation tests to administrators, either. The biggest mitigation is that gitea documentation discourages you from using action runners from untrusted users. Not flawless security, but it's something...

> The biggest mitigation is that gitea documentation discourages you from using action runners from untrusted users. This recommendation seems incompatible with third-party collaboration, at least on its face!

Many projects have CI setups that run code (Makefile can run any code, for example). Which means, an untrusted third-party contribution would allow that party to run arbitrary code on CI platform. Yes, the solution is to not let untrusted third-party code to be run without manual review.

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#377

Post by rogerrogerr »

tosti wrote: post #373
wafflemaker wrote: post #314

Earlier quoted context omitted.

Em-dashes and "it's not X. It's Y" seem to be in most LLMs writing style purposefully so they can have detection tools. Just so academia can claim some level of detectability

There's also the "paradigm shift" and "a fundamental Z of X". Those really ding my slop'o'meter.

The real answer? (bolded) It’s complicated.

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#378

Post by flyingshelf »

Manishearth wrote: post #340

I recently used a pretty well-tuned LLM to find ~500 safety bugs across the Rust ecosystem. Most of them are minor, and even major safety issues in Rust usually mean "it's possible to accidentally use this API in a way that is broken" not "this is directly exploitable", but I didn't want to just file LLM output as issues on these repos. I very briefly considered doing something like this: if I just post the results o…

You're using AI to find issues, why are you not using AI to fix them? Issues are for humans.

Of course don't just spam untested PRs as that will land you in PR jail very quickly.

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#379

Post by blazespin »

K0balt wrote: post #352
firefax wrote: post #60

Earlier quoted context omitted.

The bigger takeaway is someone that smart is pissed off and dropping their shit with zero warning... but hey, that's just like, my opinion man.

The point is that anyone looking for zero days has them in spades, in this age of LLM use. So, knowing that bad actors have an unending river of cheaply acquired zero days, the best response is to publish them so that maintainers also have access to them. Existing methods of slow disclosure cannot keep up with the AI firehose. It’s ugly, but it will force needed change. A thorough AI red team effort is the lowest bar…

This is ludicrous logic. We already know that there is an AI firehose. You don't need to do this. They should have used proper disclosure.

All this is doing is making the AI firehose worse.

Re: Anonymous GitHub account mass-dropping undisclosed 0-days

#380

Post by blazespin »

Aurornis wrote: post #365
Manishearth wrote: post #340

I recently used a pretty well-tuned LLM to find ~500 safety bugs across the Rust ecosystem. Most of them are minor, and even major safety issues in Rust usually mean "it's possible to accidentally use this API in a way that is broken" not "this is directly exploitable", but I didn't want to just file LLM output as issues on these repos. I very briefly considered doing something like this: if I just post the results o…

Can you at least provide some links to examples of the issues you’re filing? I’ve seen so many claims of people who used LLMs to generate hundreds of issues that turned out to be full of hallucinations or non-bugs being described as bugs that any claim like this needs some real evidence. Saying you found 500 safety bugs in Rust but that you’re casually only filing a couple of them makes this hard to believe.

I have a dozen or so critical CVEs now, it's not hard to believe at all if they're just hardening tasks. I can get a dozen hardening tasks from just one prompt. I don't even bother filing them as the critical ones are more important right now.
Post reply on HN