Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hardening Firefox with Claude Mythos Preview

hacks.mozilla.org

Post reply on HN
Print view View original

161–170 of 176 posts

Re: Hardening Firefox with Claude Mythos Preview

#161

Post by IshKebab »

uecker wrote: post #159
IshKebab wrote: post #149

Earlier quoted context omitted.

Not exclusively, just the vast majority of the time. Which it is. Read this: https://blog.google/security/rust-in-android-move-fast-fix-t... Exactly the same as using the memory-safe subset of Python or Java.

There exist memory safety bugs in Rust projects, so you will find them. Or maybe not with AI, as there is not enough training data? The 70% number google claims is either BS or google-specific as other projects reported far lower numbers.

> There exist memory safety bugs in Rust projects, so you will find them. Or maybe not with AI, as there is not enough training data?

No, there are simply too few memory safety bugs in Rust projects for AI to find any. It found 271 bugs in Firefox so you're talking around 0.3 bugs found in the same amount of Rust.

> The 70% number google claims is either BS or google-specific as other projects reported far lower numbers.

The post I linked didn't mention 70% so I guess you didn't read it. And if you're talking about the "70% of C/C++ security bugs are due to memory safety" stat, then no it isn't bullshit. The same (or very similar) number has been found by numerous companies and projects. Not that that stat is relevant here.

Re: Hardening Firefox with Claude Mythos Preview

#162

Post by IshKebab »

tialaramex wrote: post #151
IshKebab wrote: post #148

Earlier quoted context omitted.

> I mean, it's not supposed to find any in the unsafe language either, but that's why it was used. No it is supposed to find them in C++, because we all know humans are infallible and it's super easy to write memory errors in C++. The whole point of Rust is that the borrow checker is infallible (pretty much anyway). > it also presumably has some volume of its own explicitly unsafe Rust "Some volume" is so tiny as to…

I assume you intended either "humans are fallible" or "humans aren't infallible" ? I'd like to understand if Rust was skipped because they assumed it would be fine, skipped purely as happenstance, or in fact tested and found to not be problem. I don't like assuming things when I could measure instead.

> I assume you intended either "humans are fallible" or "humans aren't infallible" ?

Ha yes.

Re: Hardening Firefox with Claude Mythos Preview

#163

Post by uecker »

IshKebab wrote: post #161
uecker wrote: post #159

Earlier quoted context omitted.

There exist memory safety bugs in Rust projects, so you will find them. Or maybe not with AI, as there is not enough training data? The 70% number google claims is either BS or google-specific as other projects reported far lower numbers.

> There exist memory safety bugs in Rust projects, so you will find them. Or maybe not with AI, as there is not enough training data? No, there are simply too few memory safety bugs in Rust projects for AI to find any. It found 271 bugs in Firefox so you're talking around 0.3 bugs found in the same amount of Rust. > The 70% number google claims is either BS or google-specific as other projects reported far lower numb…

It is impossible to interpret this number (271) without looking into details. People certainly found plenty of memory safety and others bugs in Rust projects in the past, so I do not understand you claim that there too few to find any.

Curl reported 40% and more recently it dropped to about 20% of issues caused by their use of C. And this even with the requirement to stick to old C89. OpenBSD reported 30%. I assume the 70% either have to do with C++ or - more likely - there is a huge selection bias.

Re: Hardening Firefox with Claude Mythos Preview

#164

Post by bvisness »

OhMeadhbh wrote: post #51

When I was at PalmSource, I tried to get budget for CoVerity or Fortify (static code analysis tools.). "Too expensive," my management chain said. I spent another year putting together a deal for a lower cost but limited to scanning the network stack. "No, it's based on BSD and BSD is inherently secure," my management chain said (neither is true, btw.) I eventually left and wound up at Mozilla where there were a numbe…

Even a quick glance at the bugs revealed in the blog post would quickly disprove your theory.

Re: Hardening Firefox with Claude Mythos Preview

#165

Post by seebeen »

IainIreland wrote: post #31
paulvnickerson wrote: post #23

Earlier quoted context omitted.

What types of vulnerabilities was it finding? Cross site scripting, privilege escalation, etc? Mostly memory corruption or any Javascript logic bugs?

I work on SpiderMonkey, so I mostly looked at the JS bugs. It was a smorgasbord of various things. Broadly speaking I'd say the most impressive bugs were TOCTOU issues, where we checked something and later acted on it, and the testcase found a clever way to invalidate the result of the check in between. If you look closely at, say, this patch, you might get a sense of what I mean (although the real cleverness is in t…

Can't remember when I last heard TOCTOU term being used. Nice :)

Re: Hardening Firefox with Claude Mythos Preview

#166

Post by londons_explore »

> We fixed a total of 423 security bugs in releases in April.

And any one or two of them could have led to a random web ad stealing your ssh keys and installing a keylogger to get into your bank account.

I often wonder if we're taking the right route with computer security. Would we be better off having a whole virtual machine for every web page, application or service? Or even physically separate hardware you just vnc into?

Re: Hardening Firefox with Claude Mythos Preview

#167

Post by tialaramex »

uecker wrote: post #163
IshKebab wrote: post #161

Earlier quoted context omitted.

> There exist memory safety bugs in Rust projects, so you will find them. Or maybe not with AI, as there is not enough training data? No, there are simply too few memory safety bugs in Rust projects for AI to find any. It found 271 bugs in Firefox so you're talking around 0.3 bugs found in the same amount of Rust. > The 70% number google claims is either BS or google-specific as other projects reported far lower numb…

It is impossible to interpret this number (271) without looking into details. People certainly found plenty of memory safety and others bugs in Rust projects in the past, so I do not understand you claim that there too few to find any. Curl reported 40% and more recently it dropped to about 20% of issues caused by their use of C. And this even with the requirement to stick to old C89. OpenBSD reported 30%. I assume t…

> I assume the 70% either have to do with C++ or - more likely - there is a huge selection bias.

Daniel admits that he "might" just be counting differently.

I expect some of it is C++ because there sure is plenty of additional complexity to fit in the same size brain and yet you retain the same absolute requirement to juggle everything at all times or the software blows up but I'd be very surprised if it accounted for this huge disparity.

Re: Hardening Firefox with Claude Mythos Preview

#168

Post by jeffparsons »

freedomben wrote: post #99
jeffparsons wrote: post #94

Earlier quoted context omitted.

It may be worth noting that Claude can and will (if it believes you own the code, at least) produce PoC exploits for exploitable bugs that it finds. My only source for this is personal experience, and no, I can't share any evidence of it.

Are you certified for high risk cyber uses? If so then you're correct. If not, then it does not match my experience

I don't have any special certification or arrangement with Anthropic; this is vanilla Opus 4.x via Claude Code.

Re: Hardening Firefox with Claude Mythos Preview

#169

Post by uecker »

tialaramex wrote: post #167
uecker wrote: post #163

Earlier quoted context omitted.

It is impossible to interpret this number (271) without looking into details. People certainly found plenty of memory safety and others bugs in Rust projects in the past, so I do not understand you claim that there too few to find any. Curl reported 40% and more recently it dropped to about 20% of issues caused by their use of C. And this even with the requirement to stick to old C89. OpenBSD reported 30%. I assume t…

> I assume the 70% either have to do with C++ or - more likely - there is a huge selection bias. Daniel admits that he "might" just be counting differently. I expect some of it is C++ because there sure is plenty of additional complexity to fit in the same size brain and yet you retain the same absolute requirement to juggle everything at all times or the software blows up but I'd be very surprised if it accounted fo…

Well, I would say google "might" be counting differently or have huge bias.

Re: Hardening Firefox with Claude Mythos Preview

#170

Post by cassianoleal »

sfink wrote: post #143
hedgehog wrote: post #141

Earlier quoted context omitted.

I did some experiments and Opus seemed pretty able to wire up a harness to find bugs and write PoC + patch for each. It's still a lot of work to get fixes upstreamed from outside so I think even if outsiders have better tools (Mythos etc) it won't change the report rate much, people may find more bugs but they won't report them. I suspect that's part of the calculation of the phased rollout for Mythos, finding bugs i…

> It's still a lot of work to get fixes upstreamed from outside I'm going to disagree in the specific case of Firefox. First, although it has diverged a long way from its roots, Mozilla still has the community project ideal in its DNA. Enough, at least, that I stumbled while reading the clause "from outside" -- if you're finding and reporting actual relevant security bugs, you're already on the inside. SpiderMonkey i…

Hi! First of all, thanks for your incredibly thoughtful and enlightening answers, and most of all for helping keep Firefox alive.

You said:

> Still, some people would still be disclosing, and not many were filing quality bugs pre-Mythos. Some were, but it was a trickle compared to post-Mythos.

How much of this could be just due to focus? i.e. prior to the partnership with Anthropic to test Mythos Preview, has there ever been a similarly focused project, specifically trying to find security bugs in Firefox?

Post reply on HN