Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hardening Firefox with Claude Mythos Preview

hacks.mozilla.org

Post reply on HN
Print view View original

121–130 of 176 posts

Re: Hardening Firefox with Claude Mythos Preview

#121

Post by mnicky »

freedomben wrote: post #100
kakacik wrote: post #83

Earlier quoted context omitted.

Chrome ain't better in any meaningful way for >99% of use cases. Heck, I am a dev and I use FF with ublock origin only, for past... 10 years? Same with my wife, after I've explained things to her and she understood how different internet experience can be thats the primary browser. So please don't put the argument like 'here is crappy underdog but please use it because monopoly is bad and google is a bit evil', its f…

Agreed, though many websites only test on Chrome and are unusable on Firefox. Ramp.com and mailgun come immediately to mind. Zoom also won't let you join with browser on Firefox. There's enough that I have to keep a chrome available for those types of sites. It shouldn't be this way, but it is

> Zoom also won't let you join with browser on Firefox.

FF works for me.

Re: Hardening Firefox with Claude Mythos Preview

#122

Post by kittikitti »

This is great, and it reflects some of the changes I've seen in the changelogs of Firefox and many others that have utilize Mythos. I'm closely watching a supposed data wall for AI models and this is a clear indicator that AI capabilities can still become much more advanced even at this point in time. It makes me enthusiastic about future releases and optimizations. Thanks for sharing.

Re: Hardening Firefox with Claude Mythos Preview

#123

Post by wnevets »

apexalpha wrote: post #72
kajman wrote: post #61

I dismissed the earlier non-technical blog post as shameless product boosterism for Anthropic. The linked hacks blog (which is a better source than this article) is a welcome release. It's hard to deny there's something real to this now, I think. Mozilla's internal definition of a "vulnerability" is also probably more widely applied than what many would intuit, but it is good that these issues are being taken serious…

At the same time other companies like AISLE are matching Mythos on vulnerabilities using older models but their own harnass: https://aisle.com/blog/aisle-matches-anthropic-mythos-on-fre... So while Mythos certainly is real I think you could do the same with Deepseek pro, GPT 5.5 etc...

Wasn't AISLE only able to find the same bugs when it was shown only the known faulty code? The worrying part about Mythos isn't the fact that it can find bugs. The worrying part is Mythos being able to find them on its own across entire code base as vast as Firefox then write exploits for what its found with a very basic prompt.

The skill required to find then create zero days is quickly approaching the floor.

Re: Hardening Firefox with Claude Mythos Preview

#124

Post by tialaramex »

IshKebab wrote: post #113
tialaramex wrote: post #107

Earlier quoted context omitted.

But there is AddressSanitizer for Rust and for C too right? As I understand it AddressSanitizer consumes LLVM IR, so from its point of view some C, C++ or Rust is all the same, and presumably also if you are a famous Russian streamer and you hand wrote LLVM IR instead of using a real programming language that too?

Yes I was including C in "C++". I dunno how much C Firefox uses. And I presume you can run AddressSanitizer with Rust but given Rust is memory safe by default, it's only going to find issues in `unsafe` code which is a tiny tiny fraction of most code. Google had a blog post a few months ago where they managed to put some actual numbers on this, because they almost shipped one Rust memory safety bug.

The lesson for other projects is very different if the reason these are all C++ bugs is just "We didn't ask Mythos for the bugs in Rust" versus if the difference is that asking Mythos for similar bugs in the Rust is futile because it won't find any.

Some of this is tempered if the pattern is that Mythos finds bugs mostly in dusty old C++ but the rates are much, much lower in newer C++, the reverse of Google's earlier finding for human researchers.

Re: Hardening Firefox with Claude Mythos Preview

#125

Post by apexalpha »

wnevets wrote: post #123
apexalpha wrote: post #72

Earlier quoted context omitted.

At the same time other companies like AISLE are matching Mythos on vulnerabilities using older models but their own harnass: https://aisle.com/blog/aisle-matches-anthropic-mythos-on-fre... So while Mythos certainly is real I think you could do the same with Deepseek pro, GPT 5.5 etc...

Wasn't AISLE only able to find the same bugs when it was shown only the known faulty code? The worrying part about Mythos isn't the fact that it can find bugs. The worrying part is Mythos being able to find them on its own across entire code base as vast as Firefox then write exploits for what its found with a very basic prompt. The skill required to find then create zero days is quickly approaching the floor.

I think they split the codebase in smaller files or modules and then tell the AI there's a bug in this particular file and to go find it.

Then they loop over a codebase like this. This way you always point a model at a 'known' bug. And I assume a smaller context window helps with quality.

Not entirely sure it's obviously proprietary.

Re: Hardening Firefox with Claude Mythos Preview

#126

Post by freedomben »

mnicky wrote: post #121
freedomben wrote: post #100

Earlier quoted context omitted.

Agreed, though many websites only test on Chrome and are unusable on Firefox. Ramp.com and mailgun come immediately to mind. Zoom also won't let you join with browser on Firefox. There's enough that I have to keep a chrome available for those types of sites. It shouldn't be this way, but it is

> Zoom also won't let you join with browser on Firefox. FF works for me.

do you hack your user agent or anything to get it to show you the option?

Re: Hardening Firefox with Claude Mythos Preview

#127

Post by tialaramex »

jonfw wrote: post #114
apexalpha wrote: post #72

Earlier quoted context omitted.

At the same time other companies like AISLE are matching Mythos on vulnerabilities using older models but their own harnass: https://aisle.com/blog/aisle-matches-anthropic-mythos-on-fre... So while Mythos certainly is real I think you could do the same with Deepseek pro, GPT 5.5 etc...

I used to work with a guy who would always say "if you're looking for trouble, you are going to find it" When I hear that "we found X bugs using some new tool", where the standard for bugs is low and doesn't neccessarily require user impact in realistic scenarios, I think to myself- duh! You went looking for bugs, of course you found them. For a sufficiently complicated product, in my experience, you don't have to lo…

> if you're looking for trouble, you are going to find it

That's the "'No Way to Prevent This,' Says Only Nation Where This Regularly Happens" of unsafe languages.

There are huge swathes of problems we know how to categorically prevent, but some people won't do it because they're more comfortable believing it was never preventable than accepting any culpability for not preventing it previously.

Re: Hardening Firefox with Claude Mythos Preview

#128

Post by IainIreland »

nh2 wrote: post #96
IainIreland wrote: post #31

Earlier quoted context omitted.

I work on SpiderMonkey, so I mostly looked at the JS bugs. It was a smorgasbord of various things. Broadly speaking I'd say the most impressive bugs were TOCTOU issues, where we checked something and later acted on it, and the testcase found a clever way to invalidate the result of the check in between. If you look closely at, say, this patch, you might get a sense of what I mean (although the real cleverness is in t…

Given the commit is 4 weeks old, will it eventually get comments? The code before the patch does not look obviously wrong. Now, some more lines were added, but would you now say it now looks less obviously wrong, or more obviously correct? It seems that the invariants needed here are either in some person's heads, or in some document that is not referenced. Reading the code for the first time, the immediate question…

Yeah, the test with the patch also adds comments. The human reviewer had extra context available.

I did get Opus to do an audit for similar problems elsewhere, to supplement the investigations that we were already doing by hand. It initially thought it found something, but when asked to produce a testcase, it thought for 20 minutes and admitted defeat. I suspect that the difference between Opus and Mythos is in small edges like this: if Mythos is smart enough to spot why Opus's discovery didn't work a little bit faster, and it can waste less time chasing down red herrings, then it's more likely to find a real bug within the limits of a context window. It's not that Opus completely lacks some capability, it's that it has trouble chaining all the pieces together consistently.

Re: Hardening Firefox with Claude Mythos Preview

#129

Post by _heimdall »

Diti wrote: post #2

I hope to see the day when (or if) the LLMs get so good at spotting and fixing bugs that all that’s left for the Firefox engineers to do is to focus on adding new features. This isn’t sarcasm. Firefox deserves to be used more. Most people I know don’t use it because “Chrome does almost everything better”, and Firefox can’t compete with the other browsers’ roadmaps.

Wouldn't that quality and availability just allow Chrome to pull ahead of Firefox that much faster?

If Mozilla created some proprietary LLM or harness that they used internally to outpace Chrome that may be a different story, though I also don't see that happening.

Re: Hardening Firefox with Claude Mythos Preview

#130

Post by benced »

grumbelbart2 wrote: post #93
benced wrote: post #67

Reading this article in the context of the Zig folks refusing to even consider LLM-generated bugs certainly shapes my perspective on what technologies will be in my toolchain.

Both are right and it depends on which model you use and who submits those bugs. The capabilities of leading models went from 99% noise to 99% valid bugs in essentially a few months. Some projects are flooded with the former and need to take precautions to avoid essential DoS attacks on the maintainers.

Yeah but Zig essentially has till Mythos releases (and arguably less time) to fix their policy. OSS that doesn't take LLM security reports at that point is a liability.
Post reply on HN