Project Glasswing: Securing critical software for the AI era

Post by [deleted] » Wed, Apr 08, 2026, 1:07 AM UTC

torginus wrote: post #81

SheinhardtWigCo wrote: post #56

Society is about to pay a steep price for the software industry's cavalier attitude toward memory safety and control flow integrity.

Thank god, finally someone said it. I don't know the first thing about cybersecurity, but in my experience all these sandbox-break RCEs involve a step of highjacking the control flow. There were attempts to prevent various flavors of this, but imo, as long as dynamic branches exist in some form, like dlsym(), function pointers, or vtables, we will not be rid of this class of exploit entirely. The latter one is the mo…

Post by rishabhaiover » Wed, Apr 08, 2026, 1:07 AM UTC

conradkay wrote: post #148

rishabhaiover wrote: post #118

Earlier quoted context omitted.

I would have not believed your argument 3 months ago but I strongly suspect Anthropic actively engages in model quality throttling due to their compute constraints. Their recent deal for multi GWs worth of data center might help them correct their approach.

For what it's worth Anthropic explicity denies that. "To state it plainly: We never reduce model quality due to demand, time of day, or server load" Also can see https://marginlab.ai/trackers/claude-code/ It's very interesting to me how widespread this conception is. Maybe it's as simple as LLM productivity degrading over time within a project, as slop compounds. Or more recently since they added a 1m context window,…

Post by [deleted] » Wed, Apr 08, 2026, 1:11 AM UTC

enraged_camel wrote: post #255

lanternfish wrote: post #242

Earlier quoted context omitted.

10 Axios's within 5 days.

Yeah, I'm unsure why the OP thinks that massive chaos would somehow be "better for the public."

Post by Forgeties79 » Wed, Apr 08, 2026, 1:14 AM UTC

philipwhiuk wrote: post #349

Forgeties79 wrote: post #346

Earlier quoted context omitted.

~1/3rd of US citizens voted for him. Don’t lump us all in.

Some of you are just guilty of negligence yes.

Post by QuiEgo » Wed, Apr 08, 2026, 1:15 AM UTC

LiamPowell wrote: post #399

> Mythos Preview identified a number of Linux kernel vulnerabilities that allow an adversary to write out-of-bounds (e.g., through a buffer overflow, use-after-free, or double-free vulnerability.) Many of these were remotely-triggerable. However, even after several thousand scans over the repository, because of the Linux kernel’s defense in depth measures Mythos Preview was unable to successfully exploit any of these…

  bool silly_mistake = false;
  
  //... lots of lines of code

  free(x);

  //... lots of lines of code

  if (silly_mistake) { // silly_mistake shown to be false at this point in the program in all testing, so far
     free(x);
  }