Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hardening Firefox with Claude Mythos Preview

hacks.mozilla.org

Post reply on HN
Print view View original

101–110 of 176 posts

Re: Hardening Firefox with Claude Mythos Preview

#101

Post by Worf »

Maybe if Mozilla focused less on new useless features and redesigns, they would be able to focus more on writing secure and bug-free code.

I'm not only talking about big things like

* Pocket,

* several major UI redesigns and

* the offline translations,

but even tiny useless things like

* browser.urlbar.trimURLs,

* putting the search query in the URL bar instead of the URL after searching from the URL bar,

* messing with the Edit and Resend feature for no reason (the good one that updates the content length is still available at devtools.netmonitor.features.newEditAndResend) and

* probably thousands of little shit like this that took a bunch of developer hours to implement.

All of the above should've been add-ons.

And of course, we know Mozilla spends a lot of money on things unrelated to Firefox at all. It's amazing Firefox is somewhat secure and stable compared to Chrome, which is backed by Google with their infinitely deep pockets.

This is a web browser, after all. Something most people use all the time. Something that accepts untrusted input from thousands of sources every day. People use it pretty much every aspect of their lives - banking, personal communication, porn, expressing political opinions. It's used for viewing PDFs, playing media files, for interacting with a whole bunch of APIs (that IMO shouldn't be part of the web, but they are). Security should be top priority.

Re: Hardening Firefox with Claude Mythos Preview

#102

Post by IshKebab »

Diti wrote: post #2

I hope to see the day when (or if) the LLMs get so good at spotting and fixing bugs that all that’s left for the Firefox engineers to do is to focus on adding new features. This isn’t sarcasm. Firefox deserves to be used more. Most people I know don’t use it because “Chrome does almost everything better”, and Firefox can’t compete with the other browsers’ roadmaps.

Unfortunately we're probably still quite far from that. This is the best case for LLMs still - the quality of their output didn't matter as long as it worked, and there was a near-perfect oracle for checking if their output worked.

That's a really good use case for LLMs. It also applies to things like finding proofs in Lean and creating test stimulus. In both cases you know automatically whether the output is good, and it doesn't really matter if it isn't.

That isn't the case for most bugs, and definitely isn't the case for actually fixing bugs.

Re: Hardening Firefox with Claude Mythos Preview

#103

Post by IshKebab »

tialaramex wrote: post #40

They've only linked a few tickets, so of course maybe when we see all 271 actual distinct things the insight won't apply but all those I examined ended up as some C++ code with a nasty bug in it. Firefox is written in several languages, only about 25% of it is in C++ but every single one of these issues seems to touch the C++.

It's because they verified the bugs using AddressSanitizer so by construction it was only ever going to find C++ bugs.

Re: Hardening Firefox with Claude Mythos Preview

#104

Post by mplanchard »

Worf wrote: post #101

Maybe if Mozilla focused less on new useless features and redesigns, they would be able to focus more on writing secure and bug-free code. I'm not only talking about big things like * Pocket, * several major UI redesigns and * the offline translations, but even tiny useless things like * browser.urlbar.trimURLs, * putting the search query in the URL bar instead of the URL after searching from the URL bar, * messing w…

It would be amazing if we didn’t have to have this conversation on every single thread about anything related to Firefox.

Firefox/Mozilla tries literally anything to expand their feature set, customer base, or revenue stream? They need to stop spending money on that and instead spend money on the free product of theirs that I care about, in exactly the way I want.

Google surveilles the entire world, spends huge amounts on lobbying, degrades their own websites on other browsers? Not a peep, usually.

For my part, I pay mozilla for their VPN service, which I’m sure many here would decry as useless spending that should be going to firefox instead.

Re: Hardening Firefox with Claude Mythos Preview

#105

Post by ZrArm »

sfink wrote: post #75
ZrArm wrote: post #68

Earlier quoted context omitted.

> Mythos did in fact write PoCs for all bugs that crash with demonstration of memory-unsafe behavior (e.g. use-after-free, out-of-bounds reads/writes, etc). But report [1] says that "Some of these bugs showed evidence of memory corruption...", which implies that majority of these (which includes 271 bugs from Mythos) don't have evidence at all. Do I not understand something? > For us this is substantial enough eviden…

> But report [1] says that "Some of these bugs showed evidence of memory corruption...", which implies that majority of these (which includes 271 bugs from Mythos) don't have evidence at all. Do I not understand something? I'm guessing a bit, but for example: out of bounds reads are not memory corruption. Assertion failures in debug builds are also usually not memory corruption, and I'd guess that many of these bugs…

It makes sense, thanks, even though that wording is still somewhat confusing.

Re: Hardening Firefox with Claude Mythos Preview

#106

Post by Worf »

mplanchard wrote: post #104
Worf wrote: post #101

Maybe if Mozilla focused less on new useless features and redesigns, they would be able to focus more on writing secure and bug-free code. I'm not only talking about big things like * Pocket, * several major UI redesigns and * the offline translations, but even tiny useless things like * browser.urlbar.trimURLs, * putting the search query in the URL bar instead of the URL after searching from the URL bar, * messing w…

It would be amazing if we didn’t have to have this conversation on every single thread about anything related to Firefox. Firefox/Mozilla tries literally anything to expand their feature set, customer base, or revenue stream? They need to stop spending money on that and instead spend money on the free product of theirs that I care about, in exactly the way I want. Google surveilles the entire world, spends huge amoun…

> It would be amazing if we didn’t have to have this conversation on every single thread about anything related to Firefox.

If Firefox starts acting maturely, we can stop having these conversations. Until then we see useless crap in every update while most bugs don't get any meaningful attention. Some changes even made things worse than they were before, for example the new Edit and Resend (not so "new" anymore). If Mozilla starts acting the best interest of the user, stops with the ad BS and doesn't try to be everything all at once and actually focuses on Firefox, I would donate. And so would others. If I donate now, I doubt even 1% of my money would go to anything meaningful, like bug fixing.

> Not a peep, usually.

No, fuck Google and Chrome and even anything Chromium-based. Here's the peep from me.

> For my part, I pay mozilla for their VPN service, which I’m sure many here would decry as useless spending that should be going to firefox instead.

Does the profit from the VPN service go to Firefox? If not, what's the point of having a VPN service.

Re: Hardening Firefox with Claude Mythos Preview

#107

Post by tialaramex »

IshKebab wrote: post #103
tialaramex wrote: post #40

They've only linked a few tickets, so of course maybe when we see all 271 actual distinct things the insight won't apply but all those I examined ended up as some C++ code with a nasty bug in it. Firefox is written in several languages, only about 25% of it is in C++ but every single one of these issues seems to touch the C++.

It's because they verified the bugs using AddressSanitizer so by construction it was only ever going to find C++ bugs.

But there is AddressSanitizer for Rust and for C too right? As I understand it AddressSanitizer consumes LLVM IR, so from its point of view some C, C++ or Rust is all the same, and presumably also if you are a famous Russian streamer and you hand wrote LLVM IR instead of using a real programming language that too?

Re: Hardening Firefox with Claude Mythos Preview

#108

Post by kgwxd »

Diti wrote: post #2

I hope to see the day when (or if) the LLMs get so good at spotting and fixing bugs that all that’s left for the Firefox engineers to do is to focus on adding new features. This isn’t sarcasm. Firefox deserves to be used more. Most people I know don’t use it because “Chrome does almost everything better”, and Firefox can’t compete with the other browsers’ roadmaps.

Browser haven't needed new features in a very long time. Extensions were supposed to be the solution to that.

Re: Hardening Firefox with Claude Mythos Preview

#109

Post by [deleted] »

sfink wrote: post #75
ZrArm wrote: post #68

Earlier quoted context omitted.

> Mythos did in fact write PoCs for all bugs that crash with demonstration of memory-unsafe behavior (e.g. use-after-free, out-of-bounds reads/writes, etc). But report [1] says that "Some of these bugs showed evidence of memory corruption...", which implies that majority of these (which includes 271 bugs from Mythos) don't have evidence at all. Do I not understand something? > For us this is substantial enough eviden…

> But report [1] says that "Some of these bugs showed evidence of memory corruption...", which implies that majority of these (which includes 271 bugs from Mythos) don't have evidence at all. Do I not understand something? I'm guessing a bit, but for example: out of bounds reads are not memory corruption. Assertion failures in debug builds are also usually not memory corruption, and I'd guess that many of these bugs…

[deleted]

Re: Hardening Firefox with Claude Mythos Preview

#110

Post by mozdeco »

ZrArm wrote: post #68
mozdeco wrote: post #34

Earlier quoted context omitted.

Mythos did in fact write PoCs for all bugs that crash with demonstration of memory-unsafe behavior (e.g. use-after-free, out-of-bounds reads/writes, etc). For us this is substantial enough evidence to consider it a security vulnerability at that point, unless shown otherwise and it has always been this way (also for fuzzing bugs).

> Mythos did in fact write PoCs for all bugs that crash with demonstration of memory-unsafe behavior (e.g. use-after-free, out-of-bounds reads/writes, etc). But report [1] says that "Some of these bugs showed evidence of memory corruption...", which implies that majority of these (which includes 271 bugs from Mythos) don't have evidence at all. Do I not understand something? > For us this is substantial enough eviden…

> But report [1] says that "Some of these bugs showed evidence of memory corruption...", which implies that majority of these (which includes 271 bugs from Mythos) don't have evidence at all. Do I not understand something?

This is just the standard sentence we've been using for years. It has nothing to do with Mythos and for Mythos, almost all bugs show evidence of memory corruption (we do have a handful of bugs in JS IPC / JS Actors, one is in the blog post).

> Mythos is supposed to be pretty good at writing actual exploits, so (as I understand) there shouldn't be any serious problems with checking if bug is vulnerability or not.

Yes but if we have a choice between writing exploits and scanning more source, potentially finding more bugs, then of course we prioritize the latter.

Post reply on HN