Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hardening Firefox with Anthropic's Red Team

anthropic.com

Post reply on HN
Print view View original

171–180 of 188 posts

Re: Hardening Firefox with Anthropic's Red Team

#171

Post by staticassertion »

tabbott wrote: post #107

I recommend that anyone who is responsible for maintaining the security of an open-source software project that they maintain ask Claude Code to do a security audit of it. I imagine that might not work that well for Firefox without a lot of care, because it's a huge project. But for most other projects, it probably only costs $3 worth of tokens. So you should assume the bad guys have already done it to your project l…

I have a few skills for this that I plug into `cargo-vet`. The idea is straightforward - where possible, I rely on a few trusted reviewers (Google, Mozilla), but for new deps that don't fall into the "reviewed by humans" that I don't want to rewrite, I have a bunch of Claude reviewers go at it before making the dependency available to my project.

Re: Hardening Firefox with Anthropic's Red Team

#173

Post by staticassertion »

delaminator wrote: post #112
staticassertion wrote: post #17

I've had mixed results. I find that agents can be great for: 1. Producing new tests to increase coverage. Migrating you to property testing. Setting up fuzzing. Setting up more static analysis tooling. All of that would normally take "time" but now it's a background task. 2. They can find some vulnerabilities. They are "okay" at this, but if you are willing to burn tokens then it's fine. 3. They are absolutely wrong…

But you're not a member of Anthropic's Red Team, with access to a specialist version of Claude.

I don't think that matters at all.

Re: Hardening Firefox with Anthropic's Red Team

#174

Post by maipen »

swordsith wrote: post #166

"But it was still unclear how much we should trust this result because it was possible that at least some of those historical CVEs were already in Claude’s training data." I feel like they could know this if they truly wanted to. It's honestly unnerving that an AI company cant say for certain if their models were trained on something.

Most people no longer read code, ai results or even watches full length videos anymore.

AI provides the same experience that you get when watching short videos.

You watch and you forget.

These models are being trained by just increasing quantity. Nobody cares anymore. It’s a race for AGI before money runs out.

Re: Hardening Firefox with Anthropic's Red Team

#175

Post by kwanbix »

janpio wrote: post #167
kwanbix wrote: post #130

Earlier quoted context omitted.

Please, implement "name window" natively in Firefox. I have to use chrome because the lack of it.

https://addons.mozilla.org/en-GB/firefox/addon/window-titler... works great.

Sort of. It won't be save between machines, for example, as chrome's implementation does. If Firefox crashes, most of th time it is lost. It is also not as clean as chrome's native implementation. I have tried it.

This has been requested since 2022: https://connect.mozilla.org/t5/ideas/user-defined-name-for-e...

Re: Hardening Firefox with Anthropic's Red Team

#176

Post by LamaOfRuin »

nl wrote: post #136
Groxx wrote: post #134

Earlier quoted context omitted.

[claimed common problem exists, try X to find it] -> [Q about how to best do that] -> "the best way to do it is to do it yourself" Surely people have found patterns that work reasonably well, and it's not "everyone is completely on their own"? I get that the scene is changing fast, but that's ridiculous.

/security-review really is pretty good. But your codebase is unique. Slop in one codebase is very dangerous in another.

For those not aware, this is a specific feature available in Claude Code.

https://support.claude.com/en/articles/11932705-automated-se...

Re: Hardening Firefox with Anthropic's Red Team

#177

Post by fulafel »

stuxf wrote: post #11

It's interesting that they counted these as security vulnerabilities (from the linked Anthropic article) > “Crude” is an important caveat here. The exploits Claude wrote only worked on our testing environment, which intentionally removed some of the security features found in modern browsers. This includes, most importantly, the sandbox, the purpose of which is to reduce the impact of these types of vulnerabilities.…

Requiring exploits is not how vulnerability research works, with or without AI. Vulnerability discovery and exploit development / weaponizing them are different things. Vendors have long since learned to take vuln reports, with our without demo exploits, seriously.

Re: Hardening Firefox with Anthropic's Red Team

#178

Post by neobrain »

suddenlybananas wrote: post #52
est31 wrote: post #51

I suppose eventually we'll see something like Google's OSS-Fuzz for core open source projects, maybe replacing bug bounty programs a bit. Anthropic already hands out Claude access for free to OSS maintainers. LLMs made it harder to run bug bounty programs where anyone can submit stuff, and where a lot of people flooded them with seemingly well-written but ultimately wrong reports. On the other hand, the newest genera…

> Anthropic already hands out Claude access for free to OSS maintainers. Free for 6 months after which it auto-renews if I recall correctly.

> Free for 6 months after which it auto-renews if I recall correctly.

They don't ask for credit card information when signing up this way, so even if true you won't be charged if you forget canceling.

Re: Hardening Firefox with Anthropic's Red Team

#179

Post by Groxx »

nl wrote: post #136
Groxx wrote: post #134

Earlier quoted context omitted.

[claimed common problem exists, try X to find it] -> [Q about how to best do that] -> "the best way to do it is to do it yourself" Surely people have found patterns that work reasonably well, and it's not "everyone is completely on their own"? I get that the scene is changing fast, but that's ridiculous.

/security-review really is pretty good. But your codebase is unique. Slop in one codebase is very dangerous in another.

that's kinda what I was looking for tbh. I didn't know that was an option, and nothing in the thread (or article) seemed to imply it was.

I was mostly working off "well I could ask claude to look at my code for security problems, i.e. 'plz check for security holes kthx', but is that really going to be the best option?". if "yes", then it would kinda imply that all the customization and prompt-fiddling people do is useless, which seems rather unlikely. a premade tool is a reasonable starting point.

Re: Hardening Firefox with Anthropic's Red Team

#180

Post by nitwit005 »

staticassertion wrote: post #170
nitwit005 wrote: post #109

Earlier quoted context omitted.

I've seen fairly poor results from people asking AI agents to fill in coverage holes. Too many tests that either don't make sense, or add coverage without meaningfully testing anything. If you're already at a very high coverage, the remaining bits are presumably just inherently difficult.

I suppose it's mixed results but a coverage report should give you "these exact lines are uncovered" and it becomes pretty straightforward to see "ah yeah that error condition isn't tracked, the behavior should be X, go write that test".

That's what people tried right? It'd be great if the AI never failed at tasks, but they clearly do sometimes.
Post reply on HN