201–210 of 274 posts
Earlier quoted context omitted.
Absolutely not. By most accounts they're terrible at fixing anything other than trivial bugs in complex codebases e.g. Linux kernel, but they're much better at finding them.
So you put it in a loop and tell it to find the bugs in the code it wrote. What's the issue?
Earlier quoted context omitted.
Oddly enough I can’t access that site, it just heats up my phone solving hashes. Gave up after about a minute and anubis had only made it less than halfway through. I doubt the real bots have any trouble bypassing it.
It's puzzling how mild the reactions are to Anubis compared to the people reacting to seeing one singular Cloudflare captcha checkbox. I'd much rather a checkbox than a brief CPU-intensive hashing session.
Earlier quoted context omitted.
A.I. is useful for this. But it would be even more useful if all new code were written in Rust or some other memory-safe language. A.I. could also be used to port C/C++ codebases to Rust, which isn't economically feasible at the moment.
I mean I get the sentiment but Rust won't save you against division by zero, it'll just panic at runtime like every other language.
let foo = NonZero::new(unvalidated_input).unwrap();
Earlier quoted context omitted.
Oddly enough I can’t access that site, it just heats up my phone solving hashes. Gave up after about a minute and anubis had only made it less than halfway through. I doubt the real bots have any trouble bypassing it.
It's puzzling how mild the reactions are to Anubis compared to the people reacting to seeing one singular Cloudflare captcha checkbox. I'd much rather a checkbox than a brief CPU-intensive hashing session.
I am sure the fuzzer is interesting. But this bug feels like something an LLM would flag as a major finding but turns out to be completely benign. Update: I tried to look into the fuzzer but it is hard to get past the AI blabb. Can someone please explain to me what it does beside being structure aware?
Earlier quoted context omitted.
Not custom. It's an existing module for a format called VPK. It's a quite trivial bug though, not exploitable apart from DOS and won't ever happen in a real file.
I thought you meant Disk Operating System until I realized you probably meant DoS
Earlier quoted context omitted.
I assume you're offering to pay for the increased server costs? I had some git hosting up for a while, and was serving hundreds of qps and several terabytes per month. I can only imagine want significant sites are serving.
> I assume you're offering to pay for the increased server costs? Such a non-argument. I'm expecting people to create better, more effective, and less intrusive anti-bot measures. Measures that accurately detect bots but don't exclude real people from the web simply because of the browser they're using, or the country they either appear to be in or are in fact in, for example.
I am sure the fuzzer is interesting. But this bug feels like something an LLM would flag as a major finding but turns out to be completely benign. Update: I tried to look into the fuzzer but it is hard to get past the AI blabb. Can someone please explain to me what it does beside being structure aware?
It crashes because of input that should have been rejected for being invalid. How could that be construed as being benign?
It is not enabled by default. It is used only in video games, which input files are fixed set of asset that came with the game.
It can be a crash, yes. but the typical user of this codec won't care.
I am sure the fuzzer is interesting. But this bug feels like something an LLM would flag as a major finding but turns out to be completely benign. Update: I tried to look into the fuzzer but it is hard to get past the AI blabb. Can someone please explain to me what it does beside being structure aware?
It crashes because of input that should have been rejected for being invalid. How could that be construed as being benign?
Earlier quoted context omitted.
> I assume you're offering to pay for the increased server costs? Such a non-argument. I'm expecting people to create better, more effective, and less intrusive anti-bot measures. Measures that accurately detect bots but don't exclude real people from the web simply because of the browser they're using, or the country they either appear to be in or are in fact in, for example.
I am expecting a unicorn.