Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We found a division by zero bug in FFmpeg with a vibecoded fuzzer

code.ffmpeg.org

Post reply on HN
Print view View original

161–170 of 274 posts

Re: We found a division by zero bug in FFmpeg with a vibecoded fuzzer

#161

Post by da_chicken »

mapontosevenths wrote: post #157
da_chicken wrote: post #154

Earlier quoted context omitted.

I think when people are complaining about Captcha they're complaining about yet another "pick 6-20 pictures of traffic lights/school busses/stairs/stop signs/bicycles."

If they want to train an AI they should pay for it like everyone else. Modern bots have zero problems solving these, it's just free training for them.

> If they want to train an AI they should pay for it like everyone else.

They're paying for electricity and taking data without paying for it. It seems to me that they're paying for it exactly the same way everyone else in AI did.

Re: We found a division by zero bug in FFmpeg with a vibecoded fuzzer

#162

Post by rootnod3 »

black_knight wrote: post #106
_jackdk_ wrote: post #77

Earlier quoted context omitted.

Liquid Haskell might require you to prove that the divisor is nonzero, but even in standard Haskell there's common idioms for ensuring that a list is non-empty (data NonEmpty a = a :| [a]) or that text is non-empty (newtype NonEmptyText = NonEmptyText Text, with non-exported constructor, helpers like make :: Text -> NonEmptyText, or more advanced tricks like https://exploring-better-ways.bellroy.com/haskell-koan-type…

Definitely room for improvement on Haskell's standard library when it comes to the number-related type classes. Modern Haskell could do very well in this area with a good type-class redesign in this area. The issue I think is that this would invalidate a lot of existing code, relying upon that. But you can already replace Prelude with something else in your own code if you want to.

I think Idris has a better chance there.

Re: We found a division by zero bug in FFmpeg with a vibecoded fuzzer

#163

Post by a2ff6eeb0 »

krona wrote: post #84
TacticalCoder wrote: post #51

Earlier quoted context omitted.

> You're suggesting that LLMs get better at fixing bugs/vulnerabilities, but at the same time stop getting better at finding them? Are you implying that all code writing by LLMs atm is bug-free?

Absolutely not. By most accounts they're terrible at fixing anything other than trivial bugs in complex codebases e.g. Linux kernel, but they're much better at finding them.

So you put it in a loop and tell it to find the bugs in the code it wrote. What's the issue?

Re: We found a division by zero bug in FFmpeg with a vibecoded fuzzer

#164

Post by LoganDark »

gguingff wrote: post #132
semiquaver wrote: post #108

Earlier quoted context omitted.

Oddly enough I can’t access that site, it just heats up my phone solving hashes. Gave up after about a minute and anubis had only made it less than halfway through. I doubt the real bots have any trouble bypassing it.

happy to report my bots have no trouble with anubis or any other pow mechanism, little bit of deno and i'm right through.

The point is to deter bots that are scraping thousands to millions of websites in parallel, not user agents.

Re: We found a division by zero bug in FFmpeg with a vibecoded fuzzer

#165

Post by LoganDark »

inigyou wrote: post #96
cptroot wrote: post #86

This is not a real bug in FFmpeg. This is a demonstration that if you control a custom AVIO module it is possible to crash FFmpeg by giving it bad data.

Not custom. It's an existing module for a format called VPK. It's a quite trivial bug though, not exploitable apart from DOS and won't ever happen in a real file.

I thought you meant Disk Operating System until I realized you probably meant DoS

Re: We found a division by zero bug in FFmpeg with a vibecoded fuzzer

#166

Post by LoganDark »

criddell wrote: post #61
12j3afAv wrote: post #12

Earlier quoted context omitted.

I wonder from where Claude stole this fuzzer.

The very first line of the bug report: > This is a bug found with our fuzzer: https://github.com/daedalus/fuzzer/

I think they're talking about the misconception that LLMs can only ever regurgitate their training data verbatim enough to constitute mass copyright violation. And that that's therefore "stealing"

Re: We found a division by zero bug in FFmpeg with a vibecoded fuzzer

#167

Post by blarg1 »

inventor7777 wrote: post #151
semiquaver wrote: post #108

Earlier quoted context omitted.

Oddly enough I can’t access that site, it just heats up my phone solving hashes. Gave up after about a minute and anubis had only made it less than halfway through. I doubt the real bots have any trouble bypassing it.

It's puzzling how mild the reactions are to Anubis compared to the people reacting to seeing one singular Cloudflare captcha checkbox. I'd much rather a checkbox than a brief CPU-intensive hashing session.

> rather a checkbox than a brief CPU-intensive hashing session.

oh is that why my raspberry pi 5 can't browse websites anymore without freezing for a minute.

Re: We found a division by zero bug in FFmpeg with a vibecoded fuzzer

#169

Post by adrianN »

kayamon wrote: post #159
nonethewiser wrote: post #34

Earlier quoted context omitted.

No one can keep up with the volume of code AI produces. We wont stop using AI. We will use AI to check AI. Of course this is crazy, but it will also unlock pretty insane scaling and productivity and ultimately we will manage it on either end via requirements and tests.

Volume..... It used to be considered a quality of good code that there would be less code, not more. Some people always tryin to get the highscore on golf.

You can have both less code per problem and more code overall when you make problem solving cheap enough.

Re: We found a division by zero bug in FFmpeg with a vibecoded fuzzer

#170

Post by inventor7777 »

da_chicken wrote: post #154
inventor7777 wrote: post #151

Earlier quoted context omitted.

It's puzzling how mild the reactions are to Anubis compared to the people reacting to seeing one singular Cloudflare captcha checkbox. I'd much rather a checkbox than a brief CPU-intensive hashing session.

I think when people are complaining about Captcha they're complaining about yet another "pick 6-20 pictures of traffic lights/school busses/stairs/stop signs/bicycles."

Not in this case. I wish I could find the actual post, but I recall reading a post on HN recently where a majority of the commenters were claiming that when they even see a Cloudflare verification checkbox that they leave the website.

This makes no sense to me as in my experience, you click the checkbox and then it verifies you without extra steps.

Post reply on HN