Earlier quoted context omitted.
http://github.com/buzz/block is quickly becoming a reasonable approach to shared agent compute, though it's still a bit more hands-on than the older 'compute donation' projects like SETI or Folding@Home.
404?
Just the rumour of a bug is enough to find an exploit these days
101–110 of 142 posts
Re: Just the rumour of a bug is enough to find an exploit these days
#102Earlier quoted context omitted.
There are many techniques for making a closed-source binary harder to reverse engineer: polymorphism, symbol stripping, code encryption, packing, and so on. Closed-source binaries at least stand a chance of being effectively obfuscated, unlike open-source code.
and those measures have always been merely annoyances. except for the VM methods which impact performance significantly. now none of those methods matter as you can just instruct an LLM to bang its head against the wall until the wall breaks.
They still matter in the sense that they impose a cost. In other words, they buy time, which is all the users need before updating.
I'm not sure if the cat and mouse game resolves clearly one way or another. Since the obfuscation can be hardened against LLMs during development.
Re: Just the rumour of a bug is enough to find an exploit these days
#103Re: Just the rumour of a bug is enough to find an exploit these days
#104This describes my life as an open source maintainer at the moment! In the first 10 years of the rclone project we received about 20 security disclosures through GitHub. We had to deal with over 40 in the last month! That has taken a huge amount of my time, even using AI tools to triage and come up with fixes for review. The hit rate for those security disclosures is pretty good - about 75% of them have a nugget of so…
Thank you for the insight! Are you going back to the changelog and editing the CVE-PENDING? I think this would be a justifiable edit of the release history that I'm not sure is possible on github.
Re: Just the rumour of a bug is enough to find an exploit these days
#105It's easier to find bugs, fix them, yet there's less will than ever. My bosses just want speed and will give me a 30 minute lecture on why I don't need to solve a bug that Claude solved in 5 minutes, I've verified, and it's already in an open PR. All the while we're pushing out bugs faster and faster. No matter how good AI gets at fixing bugs we'll never fix them when there's no will to fix things. Software will neve…
My take is that when the bubble bursts good software will remain. Right now all the big players are hiding the cost. Anthropic (in my mind) is especially egregious at tokenmaxxing without telling you whats going on. A simple request to edit a text file launches multiple agents which takes ages, and burns tokens. All the while it calles it "Sautéeing" or whatever random verb they spew out as you wait for your answer.
Re: Just the rumour of a bug is enough to find an exploit these days
#106Earlier quoted context omitted.
Yea, when their cyber insurance policies start biting them because AI found a bug months ago and it was never fixed I figure we'll start seeing a change. With that said there are numerous companies that are very concerned about the situation. They know AI is finding bugs in their software at an accelerated rate, one they are having difficult times keeping up with because they want human understanding and review of th…
Did CrowdStrike actually suffer? That was a huge outage and their stock is today at an all time high. Seems like no one actually cares. Neither the companies providing the software, the companies purchasing the software, nor the markets. To me, this is the craziest part about all of it. Why doesn't anyone seem to care?
Because the purpose of Crowdstrike is not to prevent exploits or make computing safer, its purpose is to allow corporate CTOs to tick a checkbox.
Re: Just the rumour of a bug is enough to find an exploit these days
#107Earlier quoted context omitted.
But, isn’t it our job to impress upon the managers the importance, in a certain regard? Alternatively, what about just doing the right thing? Either you convince them to take this stuff seriously or you find alternate employment. How can you subject yourself to the moral degradation and conflict of principles? I could understand for someone with no other financial options, or in some sort of oppressive culture/econom…
> But, isn’t it our job to impress upon the managers the importance, in a certain regard? I think it is. But this appears to be an unpopular opinion and I'm not sure why. The question I'm still unsure about is if managers realize they are surrounding themselves with "yes men". The other question I'm still unsure about is if people realizing that not saying "no" (or "yes, but") is not meaningfully different from being…
Michael Burry managed just fine, I believe. Secondly, I think the "in every case" is too strongly worded. I am working in an org right now where it has not happened yet. Perhaps it is only a matter of time, but let me have my optimism.
Re: Just the rumour of a bug is enough to find an exploit these days
#108It's easier to find bugs, fix them, yet there's less will than ever. My bosses just want speed and will give me a 30 minute lecture on why I don't need to solve a bug that Claude solved in 5 minutes, I've verified, and it's already in an open PR. All the while we're pushing out bugs faster and faster. No matter how good AI gets at fixing bugs we'll never fix them when there's no will to fix things. Software will neve…
It is not "will" it always is money. There was an article some days ago where someone was claiming "with AI only you decide how many bugs you have" — well no the same forces apply because tokens are not free and business wants to do stuff that directly earns money. Well we have to make cases and measure where the bug costs money and how. Lots of bugs are irrelevant and not blocking people from using the software. If…
> It is not "will" it always is money.
So it isn't money. You can argue that it is power, that the money is the proxy, but this still wouldn't answer the question.
The reason I'm pushing back hard here is these simplistic answers are just thought terminating cliches. They dismiss the problem, calling it inevitable and unsolvable. It only helps to preserve the status quo. It only helps empower those who seek to take our own. So I call bullshit
Re: Just the rumour of a bug is enough to find an exploit these days
#109Earlier quoted context omitted.
> But, isn’t it our job to impress upon the managers the importance, in a certain regard? I think it is. But this appears to be an unpopular opinion and I'm not sure why. The question I'm still unsure about is if managers realize they are surrounding themselves with "yes men". The other question I'm still unsure about is if people realizing that not saying "no" (or "yes, but") is not meaningfully different from being…
Michael Burry managed just fine, I believe. Secondly, I think the "in every case" is too strongly worded. I am working in an org right now where it has not happened yet. Perhaps it is only a matter of time, but let me have my optimism.
> Michael Burry managed just fine
Re: Just the rumour of a bug is enough to find an exploit these days
#110It's easier to find bugs, fix them, yet there's less will than ever. My bosses just want speed and will give me a 30 minute lecture on why I don't need to solve a bug that Claude solved in 5 minutes, I've verified, and it's already in an open PR. All the while we're pushing out bugs faster and faster. No matter how good AI gets at fixing bugs we'll never fix them when there's no will to fix things. Software will neve…
Something that might come out of all of this is that companies that previously slow rolled security fixes will now be forced to fix them quickly, because the speed of AI and the liability of being insecure.
USA has that digital misuse law that makes it a crime to use software in unintended ways. So claude or codex finding bugs in their software is actually illegal... I am not sure if really no one tried this yet or if they did and I just missed the news.