Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hardening Firefox with Claude Mythos Preview

hacks.mozilla.org

Post reply on HN
Print view View original

151–160 of 176 posts

Re: Hardening Firefox with Claude Mythos Preview

#151

Post by tialaramex »

IshKebab wrote: post #148
tialaramex wrote: post #135

Earlier quoted context omitted.

> It's not going to find any in a memory safe language. I mean, it's not supposed to find any in the unsafe language either, but that's why it was used. Firefox not only uses unstable Rust features (via the exemption mechanism the same way Linux does it, trained professionals, closed course, do not attempt at home) it also presumably has some volume of its own explicitly unsafe Rust and so there's no reason this coul…

> I mean, it's not supposed to find any in the unsafe language either, but that's why it was used. No it is supposed to find them in C++, because we all know humans are infallible and it's super easy to write memory errors in C++. The whole point of Rust is that the borrow checker is infallible (pretty much anyway). > it also presumably has some volume of its own explicitly unsafe Rust "Some volume" is so tiny as to…

I assume you intended either "humans are fallible" or "humans aren't infallible" ?

I'd like to understand if Rust was skipped because they assumed it would be fine, skipped purely as happenstance, or in fact tested and found to not be problem. I don't like assuming things when I could measure instead.

Re: Hardening Firefox with Claude Mythos Preview

#152

Post by tkel »

benced wrote: post #67

Reading this article in the context of the Zig folks refusing to even consider LLM-generated bugs certainly shapes my perspective on what technologies will be in my toolchain.

Zig devs can run Mythos same as anyone else can. I think you are failing to understand the reasoning behind their decision. It's about contributors, not contributions.

https://kristoff.it/blog/contributor-poker-and-ai/

Re: Hardening Firefox with Claude Mythos Preview

#153

Post by ls612 »

metalliqaz wrote: post #150
apexalpha wrote: post #120

Earlier quoted context omitted.

Well it helps if 'looking for bugs' doesn't cost $300 per hour per set of eyes.

how much does it cost? my understanding of Mythos is that it runs a lot to find issues

The things I’ve read from various open source orgs with access to it is that Anthropic is giving them unmetered access for now as part of Glasswing. I’d bet that the corporate partners have to pay though.

Re: Hardening Firefox with Claude Mythos Preview

#154

Post by benced »

tkel wrote: post #152
benced wrote: post #67

Reading this article in the context of the Zig folks refusing to even consider LLM-generated bugs certainly shapes my perspective on what technologies will be in my toolchain.

Zig devs can run Mythos same as anyone else can. I think you are failing to understand the reasoning behind their decision. It's about contributors, not contributions. https://kristoff.it/blog/contributor-poker-and-ai/

Quoting from https://ziglang.org/code-of-conduct/#strict-no-llm-no-ai-pol...:

> Strict No LLM / No AI Policy

> No LLMs for issues.

> No LLMs for pull requests.

> No LLMs for comments on the bug tracker, including translation. English is encouraged, but not required. You are welcome to post in your native language and rely on others to have their own translation tools of choice to interpret your words.

If they would accept issues filed by AI or written by AI, they should edit their policy to say that.

Re: Hardening Firefox with Claude Mythos Preview

#155

Post by canucker2016 »

UltraSane wrote: post #52
crummy wrote: post #24

Curious if people think LLMs will lead to more secure or less secure software in five years.

In 5 years attackers have an advantage but in the long run I think more secure if developers use LLMs on software to find and fix all of the worse remotely exploitable bugs before release. LLMs are going to force devs to be much more security conscious.

I think it'll be a war of who has the better LLMs-as-security-scanner.

Ideally, you'd do a comprehensive all-source-code scan, (and the LLM-scanner finds everything during those scans), and fix all the reported defects.

Afterwards, any dev that commits code will run the LLM-scanner on the modified code (and affected areas) and fix any reported defects.

So the black-hat hacker would be shut out unless they get access to an LLM-scanner with better analysis than what the target project is using.

Major LLM-scanners could give priority access for new versions of LLM-scanners to major projects to find any defects in the current source code before any other party could use the reported defects against the project or their users.

So black-hat hackers would be left with developing their own LLM-scanner better/more efficient than existing major LLM-scanners.

Given enough incentive, they might develop such a tool. Look at the market for zero-day vulnerabilities for smartphones, esp iPhones.

Re: Hardening Firefox with Claude Mythos Preview

#156

Post by canucker2016 »

MetaverseClub wrote: post #35
rockdoe wrote: post #17

Earlier quoted context omitted.

How many of those are false positives though? Probably just over 5000? You get bug bounties if you report the kind of bugs Mythos identified. There's a reason no-one collected bounties from the "5000 defects" Coverity identified. The Mythos reports have several examples of chaining a whole bunch of logic in different parts of the program together to exploit something very subtle. The Coverity reports aren't anything…

it's just sad that Coverity represents the best working C++ static analysis tool.

There's also PVS-Studio. They also scan open source projects - see https://pvs-studio.com/en/blog/inspections/

It's hard to convince managers to spend money on static analysis tools (or any development tool).

Unless your company just got bad publicity for a bug and your devs come to you and demonstrate that a certain static analysis tool would have flagged that particular piece of code, most managers would let the beancounter-facet dominate the decision making process.

Re: Hardening Firefox with Claude Mythos Preview

#157

Post by tkel »

benced wrote: post #154
tkel wrote: post #152

Earlier quoted context omitted.

Zig devs can run Mythos same as anyone else can. I think you are failing to understand the reasoning behind their decision. It's about contributors, not contributions. https://kristoff.it/blog/contributor-poker-and-ai/

Quoting from https://ziglang.org/code-of-conduct/#strict-no-llm-no-ai-pol... : > Strict No LLM / No AI Policy > No LLMs for issues. > No LLMs for pull requests. > No LLMs for comments on the bug tracker, including translation. English is encouraged, but not required. You are welcome to post in your native language and rely on others to have their own translation tools of choice to interpret your words. If they would…

None of that is at odds with what I said. An AI isn't a human that you can invest time into developing into a contributor. I'm not sure what you aren't understanding. Did you read the article I linked?

Re: Hardening Firefox with Claude Mythos Preview

#158

Post by benced »

tkel wrote: post #157
benced wrote: post #154

Earlier quoted context omitted.

Quoting from https://ziglang.org/code-of-conduct/#strict-no-llm-no-ai-pol... : > Strict No LLM / No AI Policy > No LLMs for issues. > No LLMs for pull requests. > No LLMs for comments on the bug tracker, including translation. English is encouraged, but not required. You are welcome to post in your native language and rely on others to have their own translation tools of choice to interpret your words. If they would…

None of that is at odds with what I said. An AI isn't a human that you can invest time into developing into a contributor. I'm not sure what you aren't understanding. Did you read the article I linked?

I did and I read it previously. It has not changed my interpretation that the Zig project would decline issues mostly generated by LLMs due to their stated policy saying so.

If you’re saying their philosophy is compatible with LLM issues, I agree and I think they should change their policy to reflect that.

Re: Hardening Firefox with Claude Mythos Preview

#159

Post by uecker »

IshKebab wrote: post #149
uecker wrote: post #133

Earlier quoted context omitted.

As long as the memory-safe subset of Rust is used exclusively.

Not exclusively, just the vast majority of the time. Which it is. Read this: https://blog.google/security/rust-in-android-move-fast-fix-t... Exactly the same as using the memory-safe subset of Python or Java.

There exist memory safety bugs in Rust projects, so you will find them. Or maybe not with AI, as there is not enough training data?

The 70% number google claims is either BS or google-specific as other projects reported far lower numbers.

Re: Hardening Firefox with Claude Mythos Preview

#160

Post by tkel »

benced wrote: post #158
tkel wrote: post #157

Earlier quoted context omitted.

None of that is at odds with what I said. An AI isn't a human that you can invest time into developing into a contributor. I'm not sure what you aren't understanding. Did you read the article I linked?

I did and I read it previously. It has not changed my interpretation that the Zig project would decline issues mostly generated by LLMs due to their stated policy saying so. If you’re saying their philosophy is compatible with LLM issues, I agree and I think they should change their policy to reflect that.

I'm not saying that. It seems as though you aren't engaging with the content of their post explaining their reasoning or are missing the point.
Post reply on HN