Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Project Glasswing: An Initial Update

anthropic.com

Post reply on HN
Print view View original

311–320 of 345 posts

Re: Project Glasswing: An Initial Update

#311

Post by FergusArgyll »

mukmuk wrote: post #122

I’m not sure how to reconcile anthropic’s update / some of the exuberant comments here with recent feedback like the following from curl maintainer Daniel Steinberg: “I see no evidence that this setup [Mythos] finds issues to any particular higher or more advanced degree than the other tools have done before Mythos. Maybe this model is a little bit better, but even if it is, it is not better to a degree that seems to…

I'll say it. From the language of his post it doesn't seem like he was using Mythos with the correct harness / the way you're supposed to. A friend lent (?) it to him.

Yes, moving the goalposts, holding it wrong, yes that's what I believe

Re: Project Glasswing: An Initial Update

#312

Post by vlunkr »

sandeepkd wrote: post #87
ygjb wrote: post #67

Earlier quoted context omitted.

Yeah, with a budget assigned. This is actually just software development and security right? Developers create software, which has bugs. Users (including bad guys, pen testers, QA folks, automated scans etc, etc, etc) find bugs, including security bugs, Developers fix bugs and maybe make more. It's an OODA loop, and continues until the developers decide to stop supporting the software. Whether that fits into the busi…

Somehow this reminded me of the historical efforts of some government bounty collections for mouse tails which were discontinued due to fraud (such as hunters breeding mice to collect the reward). There is a reason why/how devs and QA keep each other in check. Guess in case of LLM writing code, one has to use different models for dev and security checks. On other hand, in real world, the developers learn from mistake…

Great analogy. The problem is the incentive structure. Anthropic would nothing nothing more than for all of us to write big sprawling slop codebases so we can spend endless tokens reading, rereading, fixing, refixing forever.

Re: Project Glasswing: An Initial Update

#313

Post by joquarky »

winstonwinston wrote: post #54
mdeeks wrote: post #34

You can get a taste of this today yourself with Codex Security. I turned it on just as an experiment and in less than a week it has now become essential to all of us. I was shocked how accurate it is, how many security issues it found in existing code, how it continually finds them as we commit, and how NO ONE is immune from making these mistakes. I'd say it is about 90% accurate for us. Often even the "Low" findings…

> I expect tools like this to be a regular part of the development lifecycle from here on. We code with AI, we review with AI, we search for vulns with AI. Even if it isn't perfect, it is easily worth the cost IMHO. So, how is that supposed to work? Claude Code generates security bugs, then Claude Security finds them, then Claude Code generate fix, spend tokens, profit?

I'm starting to think that those who are most aggressively expressive about low quality from these tools are the same who expect everything to be a one shot.

Re: Project Glasswing: An Initial Update

#314

Post by joquarky »

sandeepkd wrote: post #87
ygjb wrote: post #67

Earlier quoted context omitted.

Yeah, with a budget assigned. This is actually just software development and security right? Developers create software, which has bugs. Users (including bad guys, pen testers, QA folks, automated scans etc, etc, etc) find bugs, including security bugs, Developers fix bugs and maybe make more. It's an OODA loop, and continues until the developers decide to stop supporting the software. Whether that fits into the busi…

Somehow this reminded me of the historical efforts of some government bounty collections for mouse tails which were discontinued due to fraud (such as hunters breeding mice to collect the reward). There is a reason why/how devs and QA keep each other in check. Guess in case of LLM writing code, one has to use different models for dev and security checks. On other hand, in real world, the developers learn from mistake…

You don't need different models, just different contexts (optimally with different personas).

Re: Project Glasswing: An Initial Update

#315

Post by wslh »

mukmuk wrote: post #122

I’m not sure how to reconcile anthropic’s update / some of the exuberant comments here with recent feedback like the following from curl maintainer Daniel Steinberg: “I see no evidence that this setup [Mythos] finds issues to any particular higher or more advanced degree than the other tools have done before Mythos. Maybe this model is a little bit better, but even if it is, it is not better to a degree that seems to…

Again, the XBOW article is pretty relevant: https://xbow.com/blog/mythos-offensive-security-xbow-evaluat...

Re: Project Glasswing: An Initial Update

#317

Post by joquarky »

OtomotO wrote: post #128
flir wrote: post #66

Earlier quoted context omitted.

Jesus, dude. There are managers reading this.

Take them out of the loop. Unless they are not human.

They became obsolete when they stopped clearing obstacles, stopped masking politics, and started acting as a proxy for JIRA.

But it's just they way it has always been done, so they get paid to meddle.

Re: Project Glasswing: An Initial Update

#318

Post by fortzi »

cold_harbor wrote: post #278
fortzi wrote: post #274

> Progress on software security used to be limited by how quickly we could find new vulnerabilities And so was malicious vulnerability research.

the asymmetry stays the same though — defenders must find everything, attackers need one. LLMs accelerate both sides equally but that gap doesnt close

[dead]

Re: Project Glasswing: An Initial Update

#319

Post by joquarky »

teiferer wrote: post #241
winstonwinston wrote: post #54

Earlier quoted context omitted.

> I expect tools like this to be a regular part of the development lifecycle from here on. We code with AI, we review with AI, we search for vulns with AI. Even if it isn't perfect, it is easily worth the cost IMHO. So, how is that supposed to work? Claude Code generates security bugs, then Claude Security finds them, then Claude Code generate fix, spend tokens, profit?

All my sibling comments are missing the message here which is that if Claude can find security issues then it can avoid them right when writing the code, so it could just never commit anything containing a security issue.

You're assigning human capabilities to fancy linear algebra.
Post reply on HN