Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Expanding Project Glasswing

anthropic.com

Post reply on HN
Print view View original

201–210 of 261 posts

Re: Expanding Project Glasswing

#201

Post by pixl97 »

0x000xca0xfe wrote: post #184
ianm218 wrote: post #173

Earlier quoted context omitted.

Hmm I view open source as purely positive sum. Valkey was forked from Redis in the first place. But this is more about memory safety - you can have immense respect for the giants who built these tools but also be worried that memory safety might become an even bigger deal. If someone found a memory zero day in nginx or openSSL for example that is a very big deal! I think this is one strategy we should look into, hope…

And what if someone gets pwned by a bog standard logic or input validation bug in your slopped together "nginx" that is not present in the original?

And what if they get owned by a memory safety issue that's in the original and not the rewrite?

I know many of these projects have been around for years but it's time for developers to put on their big boy panties and start taking memory safe languages seriously. Watching the same attacks again and again for 30 years is getting droll.

Re: Expanding Project Glasswing

#202

Post by pixl97 »

alasano wrote: post #26
yanis_t wrote: post #20

Is there any evidence Mythos is qualitatively better than the Opus 4.x? I'm afraid that the usual mantra that "we just need more scale" that worked well for attracting investments, is not working anymore - bigger models provide marginal improvements while naturally get much more expensive to run. Is this why both Anthropic and OpenAI are rushing for IPOs this year?

From what I've read so far it's less about Mythos being much better at tasks in isolation. Security wise, it's about being able to find and chain multiple vulnerabilities to actually create viable exploits. So I would imagine that if you were using it for regular software development you may not feel that it's that different unless used in a particular way?

There seems to be some number of people here on HN that make their money in old style cyber security that seem to be under the delusion that LLMs are just going to go away and it's going to go back to business as usual for their cash cow.

I work with a number of people in security that have come around, and while they still think LLMs are rather garbage at architecture, they see how well current models we can access now are at finding security issues. They can chain together wildly different concepts and turn them into working exploits.

Re: Expanding Project Glasswing

#203

Post by fn-mote »

sbayg wrote: post #197
airstrike wrote: post #126

I'll share the first-hand account I recently got from someone else. > We've used it at work > it is... not as hype as everyone is concerned about > I'd argue the framework around it for security scanning is the arguably more useful side of the tool, definitely doesnt take a huge model to get all the issues it flagged on our systems > For us, it absolutely flooded us with noise > I mean hundreds if not thousands of fa…

In other words it creates work. In other words Jevons paradox. I can’t wait for the first court case where an LLM surfaces a vuln, lazy devs ignore it, and someone later sues the company into oblivion for liability.

When was the last time you remember a company being sued into oblivion for a security breach?

The cost in the US is more like “one year of credit monitoring”.

Re: Expanding Project Glasswing

#204

Post by deet »

bgilroy26 wrote: post #147
airstrike wrote: post #126

I'll share the first-hand account I recently got from someone else. > We've used it at work > it is... not as hype as everyone is concerned about > I'd argue the framework around it for security scanning is the arguably more useful side of the tool, definitely doesnt take a huge model to get all the issues it flagged on our systems > For us, it absolutely flooded us with noise > I mean hundreds if not thousands of fa…

It seems like there is a genuine communication breakdown between management and engineering. Engineers know that there are vulnerabilities all over the place and that there have been for ages and that where the rubber hits the road every vulnerability does not represent a successful exploit by some nefarious actor. Management can often treat cybersecurity like a black box that represents millions upon millions in lia…

To be fair though, models might be changing the calculus for what constitutes a vulnerability that is too small / too obscure to care about.

If AI is reducing the cost of using the long tail of small vulnerabilities or is making possible chaining them together into something more profound, then those small, less-concerning issues might requiring addressing in a way that was previously not required.

Re: Expanding Project Glasswing

#205

Post by airstrike »

mofeien wrote: post #167
mekpro wrote: post #40

It’s clear that Anthropic has run out of the compute capacity needed to serve Mythos publicly. They’re using security concerns to mask their inability to deliver the model at scale, while still trying to maintain their lead over OpenAI. As a result, they’ve chosen to release it privately under the banner of an “ethical” rollout.

Jack Clark, co-founder of Anthropic said the following at an Oxford lecture last week ([0], at around 10 and 12 mins): "It's a technology that we do not fully understand because it's more grown than made. And it is a technology that you can concoct plausible scenarios where it could kill every single person on the planet. So to think building this technology is without risk would be an act of hubris or insanity. [...…

It's worth remembering that people do not always say what they believe. Instead, they often say that which benefits them the most.

Re: Expanding Project Glasswing

#206

Post by chillfox »

torginus wrote: post #190
bgilroy26 wrote: post #147

Earlier quoted context omitted.

It seems like there is a genuine communication breakdown between management and engineering. Engineers know that there are vulnerabilities all over the place and that there have been for ages and that where the rubber hits the road every vulnerability does not represent a successful exploit by some nefarious actor. Management can often treat cybersecurity like a black box that represents millions upon millions in lia…

I had a geniunely surreal conversation with the security team the past week, it went like: 'Hi, we are reaching out to you because our tool flagged a large data transfer between such and such services' 'Wait, the source endpoint is an internal service, the target endpoint is an internal S3 bucket (I was doing a routine DB backup) Neither are reachable from the internet. How is it a security issue?' 'Our tool has flag…

Almost all the corporate security professionals I have dealt with have been tool runners with no more than Helpdesk level skills.

Re: Expanding Project Glasswing

#207

Post by Escapade5160 »

airstrike wrote: post #126

I'll share the first-hand account I recently got from someone else. > We've used it at work > it is... not as hype as everyone is concerned about > I'd argue the framework around it for security scanning is the arguably more useful side of the tool, definitely doesnt take a huge model to get all the issues it flagged on our systems > For us, it absolutely flooded us with noise > I mean hundreds if not thousands of fa…

This is the same gripe I have over any LLM vulnerability tooling. 95% of what gets flagged is something that if taken by itself could be a vulnerability. However, the path to execute that specific vuln, in that specific function, is impossible in that particular code base and it just makes noise.

Re: Expanding Project Glasswing

#208

Post by WatchDog »

rxhampton wrote: post #87
ianm218 wrote: post #33

In case the topic of memory safety is interesting to anyone I've been experimenting with using AI agents to port common web infra projects to safe/ performant Rust. Somewhat inspired by the Bun port - was thinking that at some point memory safety might be such a big deal that people just need drop in replacements. - Valkey/ Redis port here https://github.com/ianm199/valdr (passes ~99% of single node test suite, real…

If someone is porting such disparate projects as Valkey and Lua it is just for show and will be pre-alpha forever. No one wants Bun in Rust, no one wants the rsync vibe code additions. This is just the only pro-AI comment, so the AI people voted it to the top.

> disparate projects as Valkey and Lua

Lua is often heavily used in Redis/Valkey, if you are interested in porting Valkey, it makes sense to also port Lua, they aren't "disparate".

Re: Expanding Project Glasswing

#209

Post by void-star »

chillfox wrote: post #206
torginus wrote: post #190

Earlier quoted context omitted.

I had a geniunely surreal conversation with the security team the past week, it went like: 'Hi, we are reaching out to you because our tool flagged a large data transfer between such and such services' 'Wait, the source endpoint is an internal service, the target endpoint is an internal S3 bucket (I was doing a routine DB backup) Neither are reachable from the internet. How is it a security issue?' 'Our tool has flag…

Almost all the corporate security professionals I have dealt with have been tool runners with no more than Helpdesk level skills.

As someone with over 30 years experience in computer security, both in corporate as well as boutique security and startup shops, who has been consistently fighting this trend, and recently bearing witness to and engaging in the current AI surge: I can say with absolute confidence that it is only getting and going to get even worse yet.

People like me who know there is a better way are getting pushed harder to lean on AI tooling even though we know that it is making things worse. This isn’t just because our founder/funding overlords are pressing us to do it. The sheer volume of new mission critical code being pumped out enabled by vibe coding is also leaving us little choice but to lean in too just to try and keep up.

We can all see it as clear as day: The tech isn’t ready for any of this. But nobody wants to hear that and everyone is marching off the cliff together anyway. We’re all going to land in the same waste pit together. Raise a glass and whimper.

Re: Expanding Project Glasswing

#210

Post by [deleted] »

chillfox wrote: post #206
torginus wrote: post #190

Earlier quoted context omitted.

I had a geniunely surreal conversation with the security team the past week, it went like: 'Hi, we are reaching out to you because our tool flagged a large data transfer between such and such services' 'Wait, the source endpoint is an internal service, the target endpoint is an internal S3 bucket (I was doing a routine DB backup) Neither are reachable from the internet. How is it a security issue?' 'Our tool has flag…

Almost all the corporate security professionals I have dealt with have been tool runners with no more than Helpdesk level skills.

[deleted]
Post reply on HN