Live data from Hacker News

Project Glasswing: Securing critical software for the AI era

anthropic.com

331–340 of 921 posts

Re: Project Glasswing: Securing critical software for the AI era

#331

Must be nice to be in a position to sell both disease and cure.

Yeah, I'd pretty pissed at my doctor for finding cancerous cells that probably wouldn't have been a problem for quite some time, either. Ignorance is bliss, security through obscurity, whatever.

The doctor analogy is more like you're grateful that your doctor found cancerous cells before they became a problem, but at the same time his other business is selling cigarettes.

Re: Project Glasswing: Securing critical software for the AI era

#332

Earlier quoted context omitted.

They were right, it's hit 100% at a number of large tech companies. (They missed their initial prediction of 90% 6 months ago, because the models then available publicly weren't capable enough.)

So why aren’t they laying people off and pumping the extra money towards research efforts associated with Llm’s? Lmao. They should all cut down their labour input right now if what you claim is true.

At many of the best tech companies, the conventional wisdom has always been that there's a huge backlog of stuff to be done. They don't want to deliver 100% of their roadmap with 50% of their employees, they want to deliver 200% of their roadmap with 100% of their employees. (And the speedup is not as high as these numbers imply for many kinds of performance, security, or correctness-critical software.)

Some companies like Block, Oracle, and Atlassian have indeed been laying people off.

Re: Project Glasswing: Securing critical software for the AI era

#333

Earlier quoted context omitted.

Please tell me those companies so I can find alternatives. I'm using AI every day and there's no way I would trust it do that.

The transition is pretty complete at e.g. Google and Meta, IIUC. Definitely whoever builds the AI tools you're using every day isn't writing code by hand.

I really just don't believe it. I have not met anyone in tech who writes zero code now. The idea that no one at Google writes any code is such a huge claim it requires extraordinary evidence. Which none ever gets presented.

Re: Project Glasswing: Securing critical software for the AI era

#334

Earlier quoted context omitted.

So why aren’t they laying people off and pumping the extra money towards research efforts associated with Llm’s? Lmao. They should all cut down their labour input right now if what you claim is true.

At many of the best tech companies, the conventional wisdom has always been that there's a huge backlog of stuff to be done. They don't want to deliver 100% of their roadmap with 50% of their employees, they want to deliver 200% of their roadmap with 100% of their employees. (And the speedup is not as high as these numbers imply for many kinds of performance, security, or correctness-critical software.) Some companie…

Lmao man this is absolute nonsense.

Google has done nothing but destroy value with many of its ‘bets’. Your roadmap stuff is irrelevant - if you don’t have value creating projects in the pipeline and/or labour is augmented you should be laying off - period. Sundar’s job is to maximise the stock price.

So once again - nonsense. Now stop spreading crap that clearly fills people with fear. I can tell you have no understanding of corporate finance and how the management of tech firms actually think these things through.

Re: Project Glasswing: Securing critical software for the AI era

#335

Now, its very possible that this is Anthropic marketing puffery, but even if it is half true it still represents an incredible advancement in hunting vulnerabilities. It will be interesting to see where this goes. If its actually this good, and Apple and Google apply it to their mobile OS codebases, it could wipe out the commercial spyware industry, forcing them to rely more on hacking humans rather than hacking mobi…

Apple has already largely crushed hacking with memory tagging on the iPhone 17 and lockdown mode. Architectural changes, safer languages, and sandboxing have done more for security than just fixing bugs when you find them.

As I understood it, Memory Integrity Enforcement adds an additional check on heap dereferences (and it doesn’t apply to every process for performance reasons). Why does it crush hacking rather than just adding another incremental roadblock like many other mitigations before?

Re: Project Glasswing: Securing critical software for the AI era

#336

Earlier quoted context omitted.

Honest question: how do state-sponsored attacks from China, Iran, North Korea, and Russia affect civilian life?

Presumably, those have influenced elections, though I guess it depends what you count as an attack. Plenty of bots try to modify public opinion. Someone hacked the DNC in 2015/16, the result of which also alleged attempted manipulation in 2008: https://en.wikipedia.org/wiki/Democratic_National_Committee_... Since we (as old Rummy said) do not know what we do not know, we cannot be certain about the extent of cyber at…

Note the RNC was also hacked but the data was not leaked. Presumably used to influence the election and policies in other ways.

Re: Project Glasswing: Securing critical software for the AI era

#337

Earlier quoted context omitted.

The transition is pretty complete at e.g. Google and Meta, IIUC. Definitely whoever builds the AI tools you're using every day isn't writing code by hand.

I really just don't believe it. I have not met anyone in tech who writes zero code now. The idea that no one at Google writes any code is such a huge claim it requires extraordinary evidence. Which none ever gets presented.

I'm surprised to hear that. One of us is in a bubble, and I'm genuinely not sure who. I have not met anyone in tech (including multiple people at Google) who does still write code. I've been recreationally interested in AI for a long time, which is a potential source of skew I suppose, but I do not and most people in my circles do not work on anything directly related to AI.

Re: Project Glasswing: Securing critical software for the AI era

#338

[flagged]

This was the top comment and it is suddenly flagged for no reason at all. It looks like meta-flagging, where people just want to hide replies to the comment they do not want you to read.

The amount of astroturfing and astroflagging in Anthropic threads is insane.

Re: Project Glasswing: Securing critical software for the AI era

#339
post #335

Earlier quoted context omitted.

Apple has already largely crushed hacking with memory tagging on the iPhone 17 and lockdown mode. Architectural changes, safer languages, and sandboxing have done more for security than just fixing bugs when you find them.

As I understood it, Memory Integrity Enforcement adds an additional check on heap dereferences (and it doesn’t apply to every process for performance reasons). Why does it crush hacking rather than just adding another incremental roadblock like many other mitigations before?

I'm not certain there is a performance hit since there is dedicated silicon on the chip for it. I believe the checks can also be done async which reduces the performance issues.

It also doesn't matter that it isn't running by default in apps since the processes you really care about are the OS ones. If someone finds an exploit in tiktok, it doesn't matter all that much unless they find a way to elevate to an exploit on an OS process with higher permissions.

MTE (Memory Tagging Extension) is also has a double purpose, it blocks memory exploits as they happen, but it also detects and reports them back to Apple. So even if you have a phone before the 17 series, if any phone with MTE hardware gets hit, the bug is immediately made known to Apple and fixed in code.

Post reply on HN