Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I used o3 to find a remote zeroday in the Linux SMB implementation

sean.heelan.io

Post reply on HN
Print view View original

211–220 of 232 posts

Re: I used o3 to find a remote zeroday in the Linux SMB implementation

#211

Post by th0ma5 »

bredren wrote: post #116
th0ma5 wrote: post #84

Earlier quoted context omitted.

But the threshold between correct and incorrect inference is dependent on an intersection of the model and the document so far. That is not manageable by definition, I mean... It is a chaotic system.

Is this dissimilar to what the human brain produces? Are we not producing chaos controlled by wanting to give the right answer?

Yes it is very dissimilar. Life isn't a sum of the discrete inputs. I mean maybe it is at times but the context is several orders of magnitude greater, the inputs several orders of magnitude input, etc but the theory that it can be quantified like this is unproven let alone a good basis for an artificial system.

Re: I used o3 to find a remote zeroday in the Linux SMB implementation

#212

Post by sothatsit »

gizmodo59 wrote: post #157
dieortin wrote: post #148

Earlier quoted context omitted.

All your content threads from the past months consist on you saying how much better OpenAI products are than the competition, so that doesn’t inspire a ton of trust.

Because in my use cases they are? Coding and math, science research are my primary use cases and codex with o3 and o3 consistently outperforms others in complex tasks for me. I can’t say a model is better just to appeal to HN. If another model is as good as o3 id use that in a second.

I also feel similarly. o3 feels quite distinct in what it is good at compared to other models.

For example, I think 2.5 Pro and Claude 4 are probably better at programming. But, for debugging, or not-super-well-defined reasoning tasks, or even just as a better search, o3 is in a league of its own. It feels like it can do a wider breadth of tasks than other models.

Re: I used o3 to find a remote zeroday in the Linux SMB implementation

#213

Post by skydhash »

avianlyric wrote: post #207
skydhash wrote: post #195

Earlier quoted context omitted.

> I didn’t realise you’re an individual capable of designing and building complex systems made of multiple interconnected novel modules using only wireframes, and having all that work without any prior experimentation. Not really. It's just that there's a lot of prior works out there, so I don't need to do experimentation when someone has already done it and describe the lessons learned. Then you do requirement analy…

How do you handle work that involves building novel systems, where good prior art simply doesn’t exist? I’m currently dealing with a project that involves developing systems where the existing prior art is either completely proprietary and inaccessible, or public, but extremely nacient and thus documented learnings are less developed than our own learnings and designs. Many projects may have the primary objective of…

Maybe the main problem is not solved yet, but I highly doubt that the subproblems are not. Because that would be cutting edge domain, which is very much an outlier.

Re: I used o3 to find a remote zeroday in the Linux SMB implementation

#214

Post by remram »

ramy_d wrote: post #170
seanheelan wrote: post #143

Earlier quoted context omitted.

I realised I didn't mention it in the article, so in case you're curious it cost about $116 to run the 100k token version 100 times.

thank you, I was going to ask about this. It's not a crazy amount...

It sounds like a crazy amount to me. I can run code analyzers/sanitizers/fuzzers on every commit to my repo at virtually no cost. Would they have caught a problem like this? Maybe not, certainly not without some amount of false positives. Still this LLM approach costs many millions of times more than previous tooling, and might still have brought up nothing (we just don't read the blog posts about those attempts).

Re: I used o3 to find a remote zeroday in the Linux SMB implementation

#215

Post by sadeshmukh »

topaz0 wrote: post #206
sadeshmukh wrote: post #118

Earlier quoted context omitted.

What exactly is disingenuous about it?

It reduces the value of a human life to the incremental rate at which they produce some concrete product. It is absurd.

Or, it elevates the tasks artificial intelligence produces to the actual difficulty of them - the human effort.

Re: I used o3 to find a remote zeroday in the Linux SMB implementation

#216

Post by shakna »

jcims wrote: post #177
shakna wrote: post #135

Earlier quoted context omitted.

Using predictable systems. If your C compiler invents a new function call for a non-existent function while generating code, that's usually a bug. If an LLM does, that's... Normal. And a non-event.

And? What other engineering domain operates on a fundamentally predictable substrate? Even computer science at any appreciable scale or complexity becomes unpredictable.

Every engineering domain operates within "known bounds". That makes it dependable.

An engineer doesn't just shrug and pick up slag because it contains the same materials as the original bauxite.

Re: I used o3 to find a remote zeroday in the Linux SMB implementation

#217

Post by egorfine »

seanheelan wrote: post #143
iandanforth wrote: post #15

The most interesting and significant bit of this article for me was that the author ran this search for vulnerabilities 100 times for each of the models. That's significantly more computation than I've historically been willing to expend on most of the problems that I try with large language models, but maybe I should let the models go brrrrr!

I realised I didn't mention it in the article, so in case you're curious it cost about $116 to run the 100k token version 100 times.

So, half that for batch processing [1], which presumably would be just fine for this task?

[1] https://platform.openai.com/docs/guides/batch

Re: I used o3 to find a remote zeroday in the Linux SMB implementation

#218

Post by jcims »

shakna wrote: post #216
jcims wrote: post #177

Earlier quoted context omitted.

And? What other engineering domain operates on a fundamentally predictable substrate? Even computer science at any appreciable scale or complexity becomes unpredictable.

Every engineering domain operates within "known bounds". That makes it dependable. An engineer doesn't just shrug and pick up slag because it contains the same materials as the original bauxite.

Of course not, but how did we get to that point with materials science and chemistry?

We’re basically in the stone ages of understanding how to interact with synthetic intelligence.

Re: I used o3 to find a remote zeroday in the Linux SMB implementation

#219

Post by jp0001 »

bandrami wrote: post #159
jp0001 wrote: post #149

We followed a very similar approach at work, created a test harness and tested all the models available in AWS bedrock and the OpenAI. We created our own code challenges not available on the Internet for training with vulnerable and non-vulnerable inline snippets and more contextual multi-file bugs. We also used 100 tests per challenge - I wanted to do 1000 test per challenge but realized that these models are not ev…

The blinders give you a problem in that a lot of security issues aren't at a single point in the code but at where two remote points in the code interact.

Correct. Dynamic runtime interactions will always be a hard problem as it’s hard to see in static code even for humans.

Re: I used o3 to find a remote zeroday in the Linux SMB implementation

#220

Post by avianlyric »

skydhash wrote: post #213
avianlyric wrote: post #207

Earlier quoted context omitted.

How do you handle work that involves building novel systems, where good prior art simply doesn’t exist? I’m currently dealing with a project that involves developing systems where the existing prior art is either completely proprietary and inaccessible, or public, but extremely nacient and thus documented learnings are less developed than our own learnings and designs. Many projects may have the primary objective of…

Maybe the main problem is not solved yet, but I highly doubt that the subproblems are not. Because that would be cutting edge domain, which is very much an outlier.

Ah so what exactly do you mean when you say

> Most of my coding is fully planned to get to the end. The experiment part is on a much smaller scale (module level).

I would seem that these statements taken together mean you don’t experiment at all?

Post reply on HN