Very unrelated to the content of the article, but that is a pretty weird ft ligature in the heading. It looks a letter from another alphabet. Which maybe makes this pretty cool after all.
Six curl CVEs after OpenAI and Anthropic came back with zero
51–60 of 68 posts
Re: Six curl CVEs after OpenAI and Anthropic came back with zero
#52One does not "discover" a CVE like this. To discover a CVE would mean you searched for a particular piece of software and found it vulnerable according to the NVD. That's not a novel discovery by any means. What they did is they found bugs and that they were exploitable in certain edge cases. As the bugs turned out to be vulnerabilities, they were assigned a CVE in the NVD with low severity. IMHO Aisle stockedpiled t…
What would the correct terminology actually be here I wonder?
In short, they found vulnerabilities and each have been assigned CVEs.
Re: Six curl CVEs after OpenAI and Anthropic came back with zero
#53Wow, this announcement is good content marketing. Don't get me wrong, it's interesting. But there is no technical discussion as to how they did it. It's simply: we did it and Mythos and Codex didn't. It's good to know that it's possible, but I'd have already expected it. Put a base model versus a base model + harness + whatever else, and yea, if you do it right then you have a better system to find vulnerabilities. >…
The homepage says something about AI guided fuzzing based on libfuzzer or AFL. Looks like they have the LLMs identify a bunch of interesting functions to test, generate some test harnesses, and then sort through the fuzzer findings at a high level, which sounds like a pretty good idea.
Back when I first heard of it, the HuggingFace hack reminded me about how you don't have to be particularly smart to find vulns, just aggressive in looking for them. AFL on its own "learned" how to construct well-formed JPEGs and PDFs by fuzzing decoders for these formats, back in the pre-LLM dark ages.
Of course the HuggingFace hack proved to be much more than that...
Re: Six curl CVEs after OpenAI and Anthropic came back with zero
#54Curl seems to becoming one of the favourite things to demo AI finding vulns. Curl is going to end up incredibly secure.
Curl has a well earned reputation for high quality code. If you find something there it means you are good. There is a lot of software where finding a vulnerability mostly means you bothered to look and are not completely stupid. Nobody is going to be impressed if you find an issue with something that everybody already knows is poorly coded.
Its vulnerability overview page[0] also helpfully lists which were caused by the use of C. The fact that even an extremely-high-quality codebase like Curl is still encountering things like use-after-free issues is pretty damning for the people clamoring that it is perfectly possible for skilled programmers to write safe C.
If even Daniel Stenberg can't consistently write safe C code, I think we can assume that nobody can. Either you switch to a memory-safe language like Rust, or you adopt a high-cost runtime checker like Fil-C, or you'll have to live with a never-ending series of memory safety vulnerabilities.
Re: Six curl CVEs after OpenAI and Anthropic came back with zero
#55Wow, this announcement is good content marketing. Don't get me wrong, it's interesting. But there is no technical discussion as to how they did it. It's simply: we did it and Mythos and Codex didn't. It's good to know that it's possible, but I'd have already expected it. Put a base model versus a base model + harness + whatever else, and yea, if you do it right then you have a better system to find vulnerabilities. >…
>All six are rated Low severity
This says it all. Nothing important was missing. This is marketing hype.
Re: Six curl CVEs after OpenAI and Anthropic came back with zero
#56Curl seems to becoming one of the favourite things to demo AI finding vulns. Curl is going to end up incredibly secure.
Anyone care to guesstimate how much effort there would be in creating an actually-secure curl and openssl? Using something like Common Lisp or Lean, instead of C.
Re: Six curl CVEs after OpenAI and Anthropic came back with zero
#57Earlier quoted context omitted.
Curl has a well earned reputation for high quality code. If you find something there it means you are good. There is a lot of software where finding a vulnerability mostly means you bothered to look and are not completely stupid. Nobody is going to be impressed if you find an issue with something that everybody already knows is poorly coded.
Its vulnerability overview page[0] also helpfully lists which were caused by the use of C. The fact that even an extremely-high-quality codebase like Curl is still encountering things like use-after-free issues is pretty damning for the people clamoring that it is perfectly possible for skilled programmers to write safe C. If even Daniel Stenberg can't consistently write safe C code, I think we can assume that nobody…
Where is your extreme assessment coming from?
Re: Six curl CVEs after OpenAI and Anthropic came back with zero
#58Wow, this announcement is good content marketing. Don't get me wrong, it's interesting. But there is no technical discussion as to how they did it. It's simply: we did it and Mythos and Codex didn't. It's good to know that it's possible, but I'd have already expected it. Put a base model versus a base model + harness + whatever else, and yea, if you do it right then you have a better system to find vulnerabilities. >…
The homepage says something about AI guided fuzzing based on libfuzzer or AFL. Looks like they have the LLMs identify a bunch of interesting functions to test, generate some test harnesses, and then sort through the fuzzer findings at a high level, which sounds like a pretty good idea.
It's an effective approach. Google project zero started doing this in 2024
https://security.googleblog.com/2024/11/leveling-up-fuzzing-...
Re: Six curl CVEs after OpenAI and Anthropic came back with zero
#59Very unrelated to the content of the article, but that is a pretty weird ft ligature in the heading. It looks a letter from another alphabet. Which maybe makes this pretty cool after all.
It's a very unfortunate ligature imho because there is no distinction between f and t. Looks funky
PS: the image in the background looks like a nod to David vs Goliath, love that detail
Re: Six curl CVEs after OpenAI and Anthropic came back with zero
#60Wow, this announcement is good content marketing. Don't get me wrong, it's interesting. But there is no technical discussion as to how they did it. It's simply: we did it and Mythos and Codex didn't. It's good to know that it's possible, but I'd have already expected it. Put a base model versus a base model + harness + whatever else, and yea, if you do it right then you have a better system to find vulnerabilities. >…
> Wow, this announcement is good content marketing.
Why do you think companies hire PMMs?