Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Six Harmless Bugs Lead to Remote Code Execution

mehmetince.net

Post reply on HN
Print view View original

11–20 of 29 posts

Re: Six Harmless Bugs Lead to Remote Code Execution

#11

Post by Zephilinox »

patates wrote: post #8
boston_clone wrote: post #7

Earlier quoted context omitted.

Thanks, ChatGPT.

For fun (not because I'm trying to defend the capabilities of LLMs, but really just out of boredom), I tried to make this better with this prompt: > make this sound less AI-generated and more like a proper hacker news comment with some SUBSTANCE: (insert the OP comment from above) and Gemini 3 Flash generated this: > This is exactly why CVSS scores can be misleading in practice. You see this constantly at Pwn2Own: it…

Both those responses sound clearly like AI though

Re: Six Harmless Bugs Lead to Remote Code Execution

#12

Post by patates »

Zephilinox wrote: post #11
patates wrote: post #8

Earlier quoted context omitted.

For fun (not because I'm trying to defend the capabilities of LLMs, but really just out of boredom), I tried to make this better with this prompt: > make this sound less AI-generated and more like a proper hacker news comment with some SUBSTANCE: (insert the OP comment from above) and Gemini 3 Flash generated this: > This is exactly why CVSS scores can be misleading in practice. You see this constantly at Pwn2Own: it…

Both those responses sound clearly like AI though

Totally! And even if it weren't, I'm still for labelling the AI generated content.

It's just when someone's going to generate something, they should at least give a little more thought to the prompt.

Re: Six Harmless Bugs Lead to Remote Code Execution

#13

Post by [deleted] »

patates wrote: post #8
boston_clone wrote: post #7

Earlier quoted context omitted.

Thanks, ChatGPT.

For fun (not because I'm trying to defend the capabilities of LLMs, but really just out of boredom), I tried to make this better with this prompt: > make this sound less AI-generated and more like a proper hacker news comment with some SUBSTANCE: (insert the OP comment from above) and Gemini 3 Flash generated this: > This is exactly why CVSS scores can be misleading in practice. You see this constantly at Pwn2Own: it…

[deleted]

Re: Six Harmless Bugs Lead to Remote Code Execution

#14

Post by jacquesm »

patates wrote: post #10
jacquesm wrote: post #9

Earlier quoted context omitted.

I wished there was a 9th bit that we could use to tag AI generated content with.

9th bit is the color: > I think it's time for computer people to take Colour more seriously Source: https://ansuz.sooke.bc.ca/entry/23 , "What Colour are your bits?"

Yes, that's what I had in mind.

Re: Six Harmless Bugs Lead to Remote Code Execution

#15

Post by amelius »

jacquesm wrote: post #9
patates wrote: post #8

Earlier quoted context omitted.

For fun (not because I'm trying to defend the capabilities of LLMs, but really just out of boredom), I tried to make this better with this prompt: > make this sound less AI-generated and more like a proper hacker news comment with some SUBSTANCE: (insert the OP comment from above) and Gemini 3 Flash generated this: > This is exactly why CVSS scores can be misleading in practice. You see this constantly at Pwn2Own: it…

I wished there was a 9th bit that we could use to tag AI generated content with.

Unicode can maybe invent an escape code.

Re: Six Harmless Bugs Lead to Remote Code Execution

#16

Post by jacquesm »

amelius wrote: post #15
jacquesm wrote: post #9

Earlier quoted context omitted.

I wished there was a 9th bit that we could use to tag AI generated content with.

Unicode can maybe invent an escape code.

That is one law I could get behind actually: the absolute requirement to label any and all AI output by using a duplicate of all of Unicode that looks the same and feels the same but is actually binary in a different space.

And then browsers and text editors could render this according to the user's settings.

Re: Six Harmless Bugs Lead to Remote Code Execution

#17

Post by amelius »

jacquesm wrote: post #16
amelius wrote: post #15

Earlier quoted context omitted.

Unicode can maybe invent an escape code.

That is one law I could get behind actually: the absolute requirement to label any and all AI output by using a duplicate of all of Unicode that looks the same and feels the same but is actually binary in a different space. And then browsers and text editors could render this according to the user's settings.

Yes, it would already help if they started with whitespace and punctuation. That would already give a big clue as to what is AI generated.

In fact, using a different scheme, we can start now:

    U+200B — ZERO WIDTH SPACE
Require that any space in AI output is followed by this zero-width character. If this is not acceptable then maybe apply a similar rule to the period character (so the number of "odd" characters is reduced to one per sentence).

Re: Six Harmless Bugs Lead to Remote Code Execution

#18

Post by tgv »

amelius wrote: post #17
jacquesm wrote: post #16

Earlier quoted context omitted.

That is one law I could get behind actually: the absolute requirement to label any and all AI output by using a duplicate of all of Unicode that looks the same and feels the same but is actually binary in a different space. And then browsers and text editors could render this according to the user's settings.

Yes, it would already help if they started with whitespace and punctuation. That would already give a big clue as to what is AI generated. In fact, using a different scheme, we can start now: U+200B — ZERO WIDTH SPACE Require that any space in AI output is followed by this zero-width character. If this is not acceptable then maybe apply a similar rule to the period character (so the number of "odd" characters is redu…

Unfortunately, people here know their way around tools to take out the markers. Probably someone will vibe up a browser plugin for it.

Re: Six Harmless Bugs Lead to Remote Code Execution

#19

Post by patates »

tgv wrote: post #18
amelius wrote: post #17

Earlier quoted context omitted.

Yes, it would already help if they started with whitespace and punctuation. That would already give a big clue as to what is AI generated. In fact, using a different scheme, we can start now: U+200B — ZERO WIDTH SPACE Require that any space in AI output is followed by this zero-width character. If this is not acceptable then maybe apply a similar rule to the period character (so the number of "odd" characters is redu…

Unfortunately, people here know their way around tools to take out the markers. Probably someone will vibe up a browser plugin for it.

I sometimes use AI to fix my English (especially when I'm trying to say something that pushes my grammar skill to the limit) and people like me can use that to inform others about that. Bad actors will always do weird stuff, this is more about people like me who want to be honest, but signing with (generated/edited with AI) is too much noise.

Re: Six Harmless Bugs Lead to Remote Code Execution

#20

Post by amelius »

patates wrote: post #19
tgv wrote: post #18

Earlier quoted context omitted.

Unfortunately, people here know their way around tools to take out the markers. Probably someone will vibe up a browser plugin for it.

I sometimes use AI to fix my English (especially when I'm trying to say something that pushes my grammar skill to the limit) and people like me can use that to inform others about that. Bad actors will always do weird stuff, this is more about people like me who want to be honest, but signing with (generated/edited with AI) is too much noise.

Yes, and I think the big AI companies will want to have AI-generated data tagged, because otherwise it would spoil their training data in the long run.
Post reply on HN