I used o3 to find a remote zeroday in the Linux SMB implementation

Post by zavec » Tue, Jun 03, 2025, 2:54 PM UTC

epolanski wrote: post #74

nxobject wrote: post #33

A small thing, but I found the author's project-organization practices useful – creating individual .prompt files for system prompt, background information, and auxiliary instructions [1], and then running it through `llm`. It reveals how good LLM use, like any other engineering tool, requires good engineering thinking – methodical, and oriented around thoughtful specifications that balance design constraints – for b…

I find your take amusing considering that's literally the only part of the post he admits to just vibing it: > In fact my entire system prompt is speculative so consider it equivalent to me saying a prayer, rather than anything resembling science or engineering

He admits the contents of the prompt is vibing, but I think what the parent comment was admiring was the structure of breaking it down into separate files each with a single responsibility so that you could swap them out more easily. Or at least, that's what I took away from it.

Post by zavec » Tue, Jun 03, 2025, 2:57 PM UTC

pixl97 wrote: post #181

0points wrote: post #158

Earlier quoted context omitted.

Author seems to downplay their own expertise and attribute it to the LLM, while at the same time admitting he's vibe prompting the LLM and dismissing wrong results while hyping the ones that happen to work out for him. This seems more like wishful thinking and fringe stuff than CS.

Science starts at the fringe with a "that's interesting" The interesting thing here is the LLM can come to very complex correct answers some of the time. The problem space of understanding and finding bugs is so large that this isn't just by chance, it's not like flipping a coin. The issue for any particular user is the amount of testing required to make this into science is really massive.

What would be really interesting is if the LLM has the ability to write a proof of concept that actually exploits the vulnerability. Then you could filter for false positives by asking it to write a PoC and running the PoC with asan or similar to get a deterministic crash. Sort of like what google was doing with the theorem proving stuff where it had a llm come up with potential proofs, but then evaluated the potential proofs in a deterministic checker to see if they were actually valid.

Of course, if you try to do that for all of the potential false positives that's going to take a _lot_ of tokens, but then we already spend a lot of CPU cycles on fuzzing so depending on how long you let the LLM churn on trying to get a PoC maybe it's still reasonable.

Re: I used o3 to find a remote zeroday in the Linux SMB implementation

Re: I used o3 to find a remote zeroday in the Linux SMB implementation