Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Project Glasswing: what Mythos showed us

blog.cloudflare.com

Post reply on HN
Print view View original

31–40 of 152 posts

Re: Project Glasswing: what Mythos showed us

#31

Post by edu »

MattSayar wrote: post #13

> The loudest reaction to Mythos Preview from other security leaders has been about speed - scan faster, patch faster, compress the response cycle. More than one team we have spoken with is now operating under a two-hour SLA from CVE release to patch in production [...] If regression testing takes a day, you cannot get to a two-hour SLA without skipping it, and the bugs you ship when you skip regression testing tend…

Or they don’t, and they* sell access to Mythos and successors through their services company or network of partners and charge a premium.

* they, I mean all foundation models providers, as OpenAI seems to go in the same direction

Re: Project Glasswing: what Mythos showed us

#32

Post by adrianN »

Avicebron wrote: post #29
sulam wrote: post #22

Earlier quoted context omitted.

Sentence constructions like this definitely scream AI: "That's a reasonable bias for an exploratory tool. It's a ruinous one for a triage queue..." I will upgrade the "why it matters" to "and now AI output is part of the training data". A day is coming when the punched-up AI verbiage will be the norm and hard to distinguish unless you're from the previous generation. Sort of in the way that I miss some aspects of Use…

That's a scary thought, llm's training on llm output. People trained by default of ubiquity to think and read llm output produce their own llm-esque writing. Seems stifling. We'll need someway to reward human creativity and out-of-bounds thinking before our greatest corpus of human intellect is a bounded by whenever and whatever was trained on.

Writing and later the printing press have already considerably stifled human expressiveness. Language used to be noch more fragmented and diverse before mass media (or the Bible in every household). In my grandmother’s time you would have difficulty understanding people from three villages down the road.

Re: Project Glasswing: what Mythos showed us

#33

Post by adrian_b »

whizzter wrote: post #19
wnevets wrote: post #5

I can't wait to be told that Cloudflare is now part of "The Mythos FUD" campaign.

2 things can be true at the same time. I think the curl folks finding it underwhelming is more of a testament to their code being subjected to a lot of tests/attacks/auditing over the past years compared to many other codebases. It's not going to find magically insurmounable exploits on it's own and "pwn teh w0rld". At the same time, there is so much shitty non-memory safe code out there (C/C++ mainly) or logically w…

While it is true that C/C++ are prone to bugs when used by careless programmers, Cloudflare also said:

"We saw consistently more false positives from projects written in memory-unsafe languages."

So while there may be a greater probability to find bugs in C/C++ projects, there is also a greater probability that there will be more work that must be done by humans to verify that real bugs have been found.

Re: Project Glasswing: what Mythos showed us

#34

Post by add-sub-mul-div »

xnorswap wrote: post #3

The real question is whether it was Mythos or Opus that wrote this post. > "Why it matters" It doesn't, it's a corporate blog, they were rarely written in one-author's voice anyway, but it's interesting to see that even large organisations are outsourcing their blogs to LLMs.

Should that be surprising? Larger orgs are the ones more naturally associated with mediocrity and are most likely to want to reduce human labor hours.

Re: Project Glasswing: what Mythos showed us

#35

Post by stavros »

SpicyLemonZest wrote: post #24
estearum wrote: post #10

Earlier quoted context omitted.

It's fascinating seeing people think that if you're snarky enough about something, the substance of that thing actually ceases to be substantive. It's like staring down the barrel of a gun and taking the time to make quips about the type of paper the gun advertisement was printed on.

When writing is too heavily LLM-assisted, it does actually cease to be substantive, because it becomes impossible to know which parts of it represent actual claims which the author believes as stated and which are interpolations.

All of them represent claims which the author believes as stated, otherwise the author wouldn't put their name on them.

Re: Project Glasswing: what Mythos showed us

#36

Post by stavros »

estearum wrote: post #10
xnorswap wrote: post #3

The real question is whether it was Mythos or Opus that wrote this post. > "Why it matters" It doesn't, it's a corporate blog, they were rarely written in one-author's voice anyway, but it's interesting to see that even large organisations are outsourcing their blogs to LLMs.

It's fascinating seeing people think that if you're snarky enough about something, the substance of that thing actually ceases to be substantive. It's like staring down the barrel of a gun and taking the time to make quips about the type of paper the gun advertisement was printed on.

Eh, I still read all of it, but it grates that everything everywhere all the time now is written by one person.

Re: Project Glasswing: what Mythos showed us

#37

Post by gdulli »

Avicebron wrote: post #29
sulam wrote: post #22

Earlier quoted context omitted.

Sentence constructions like this definitely scream AI: "That's a reasonable bias for an exploratory tool. It's a ruinous one for a triage queue..." I will upgrade the "why it matters" to "and now AI output is part of the training data". A day is coming when the punched-up AI verbiage will be the norm and hard to distinguish unless you're from the previous generation. Sort of in the way that I miss some aspects of Use…

That's a scary thought, llm's training on llm output. People trained by default of ubiquity to think and read llm output produce their own llm-esque writing. Seems stifling. We'll need someway to reward human creativity and out-of-bounds thinking before our greatest corpus of human intellect is a bounded by whenever and whatever was trained on.

Human creativity is not only not being rewarded, but people are increasingly talking like consuming too few tokens is something that's actively used against them.

Re: Project Glasswing: what Mythos showed us

#38

Post by genxy »

sulam wrote: post #22
xnorswap wrote: post #3

The real question is whether it was Mythos or Opus that wrote this post. > "Why it matters" It doesn't, it's a corporate blog, they were rarely written in one-author's voice anyway, but it's interesting to see that even large organisations are outsourcing their blogs to LLMs.

Sentence constructions like this definitely scream AI: "That's a reasonable bias for an exploratory tool. It's a ruinous one for a triage queue..." I will upgrade the "why it matters" to "and now AI output is part of the training data". A day is coming when the punched-up AI verbiage will be the norm and hard to distinguish unless you're from the previous generation. Sort of in the way that I miss some aspects of Use…

I had a dude in a conversation non-ironically use "load-bearing."

I could only follow up with, "that is a genuine insight."

Not a single person visibly flinched in pain.

Re: Project Glasswing: what Mythos showed us

#39

Post by btown »

This is worth a read specifically for this section and the ones following it, re: custom vs. agentic-coding harnesses. https://blog.cloudflare.com/cyber-frontier-models/#why-point...

Claude Code's harness is remarkable for many use cases, particularly with 1M context sizes. But it's also limited when the scale of code or data to read becomes close to that, or exceeds it. The idea that a cluster of actors can work on a shared, structured set of context snippets, and have guidance around what is relevant to them, is an incredibly useful model outside of cybersecurity as well.

Re: Project Glasswing: what Mythos showed us

#40

Post by wslh »

sandeepkd wrote: post #25

I was expecting some more concrete numbers and surprises. It just seems like a balanced promotion article probably written using LLM itself.

In the last few days I was recommending to read the insights from XBOW [1], it's a competitor but it adds more information to the discussion.

[1] https://xbow.com/blog/mythos-offensive-security-xbow-evaluat...

Post reply on HN