Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Project Glasswing: Securing critical software for the AI era

anthropic.com

Post reply on HN
Print view View original

431–440 of 921 posts

Re: Project Glasswing: Securing critical software for the AI era

#431

Post by solenoid0937 »

Gigachad wrote: post #333
SpicyLemonZest wrote: post #279

Earlier quoted context omitted.

The transition is pretty complete at e.g. Google and Meta, IIUC. Definitely whoever builds the AI tools you're using every day isn't writing code by hand.

I really just don't believe it. I have not met anyone in tech who writes zero code now. The idea that no one at Google writes any code is such a huge claim it requires extraordinary evidence. Which none ever gets presented.

Can confirm that basically no one at Google or Meta hand writes code outside extremely extremely niche projects

Re: Project Glasswing: Securing critical software for the AI era

#432

Post by danielheath »

LiamPowell wrote: post #399

> Mythos Preview identified a number of Linux kernel vulnerabilities that allow an adversary to write out-of-bounds (e.g., through a buffer overflow, use-after-free, or double-free vulnerability.) Many of these were remotely-triggerable. However, even after several thousand scans over the repository, because of the Linux kernel’s defense in depth measures Mythos Preview was unable to successfully exploit any of these…

Is this code multithreaded? X could indeed be null, in that case.

Re: Project Glasswing: Securing critical software for the AI era

#433

Post by lmm »

simonsarris wrote: post #282
itishappy wrote: post #269

Earlier quoted context omitted.

Honest question: how do state-sponsored attacks from China, Iran, North Korea, and Russia affect civilian life?

Presumably, those have influenced elections, though I guess it depends what you count as an attack. Plenty of bots try to modify public opinion. Someone hacked the DNC in 2015/16, the result of which also alleged attempted manipulation in 2008: https://en.wikipedia.org/wiki/Democratic_National_Committee_... Since we (as old Rummy said) do not know what we do not know, we cannot be certain about the extent of cyber at…

All of that applies equally to PRISM and any internal propaganda campaigns that was feeding into, no?

Re: Project Glasswing: Securing critical software for the AI era

#434

Post by WarmWash »

miki123211 wrote: post #273
torginus wrote: post #53

Earlier quoted context omitted.

Just reading this, the inevitable scaremongering about biological weapons comes up. Since most of us here are devs, we understand that software engineering capabilities can be used for good or bad - mostly good, in practice. I think this should not be different for biology. I would like to reach out and talk to biologists - do you find these models to be useful and capable? Can it save you time the way a highly capab…

From what I've heard from people doing biology experiments, the limiting factor there is cleaning lab equipment, physically setting things up, waiting for things that need to be waited for etc. Until we get dark robots that can do these things 24/7 without exhaustion, biology acceleration will be further behind than software engineering. Software engineering is at the intersection of being heavy on manipulating infor…

My wife is a chemist

There is a massive gap between "having a recipe" and being able to execute it. The same reason why buying a Michelin 3 star chefs cookbook won't have you pumping out fine dining tomorrow, if ever.

Software it a total 180 in this regard. Have a master black hats secret exploits? You are now the master black hat.

Re: Project Glasswing: Securing critical software for the AI era

#435

Post by xvector »

da_chicken wrote: post #357
jaidhyani wrote: post #267

Earlier quoted context omitted.

Said company is literally in court against said government at the moment, after said government attempted to designate it too dangerous to do business with.

There are currently over 1,000 companies involved in lawsuits against the US government right now even if we restrict ourselves to just tariff lawsuits .

And the government is attempting "corporate murder" on precisely one of them. Wanna guess which one?

Re: Project Glasswing: Securing critical software for the AI era

#436

Post by staticassertion »

doug_durham wrote: post #275
SheinhardtWigCo wrote: post #56

Society is about to pay a steep price for the software industry's cavalier attitude toward memory safety and control flow integrity.

I think society is going to start paying the price for humans being human. As the paper points out there is a lot of good faith, serious software that has vulnerabilities. These aren't projects you would characterize as people being cavalier. It is simply beyond the limits of humans to create vulnerability-free software of high complexity. That's why high reliability software depends on extreme simplicity and strict…

> These aren't projects you would characterize as people being cavalier.

I probably would. You mentioned the linux kernel, which I think is a perfect example of software that has had a ridiculous, perhaps worst-in-class attitude towards security.

Re: Project Glasswing: Securing critical software for the AI era

#437

Post by Henchman21 »

conception wrote: post #336
simonsarris wrote: post #282

Earlier quoted context omitted.

Presumably, those have influenced elections, though I guess it depends what you count as an attack. Plenty of bots try to modify public opinion. Someone hacked the DNC in 2015/16, the result of which also alleged attempted manipulation in 2008: https://en.wikipedia.org/wiki/Democratic_National_Committee_... Since we (as old Rummy said) do not know what we do not know, we cannot be certain about the extent of cyber at…

Note the RNC was also hacked but the data was not leaked. Presumably used to influence the election and policies in other ways.

I believe the popular sentiment is that when they hacked the DNC they found a handful of things that would provide bad optics for the party. But the RNC? They found so much evidence of criminality that near to the entire party flipped positions on issues related to Russia. So we have 2x successful hacks, one of which yielded some bad press for the Dems, and yielded an entirely compromised party in the Repubs who now are being actively blackmailed.

Re: Project Glasswing: Securing critical software for the AI era

#438

Post by Henchman21 »

Ar-Curunir wrote: post #322
realo wrote: post #307

Earlier quoted context omitted.

Yes... they might have influenced elections and now, as a result, the world must cope with the Trump regime. Let's now fool ourselves.... Trump is probably the best, most successful attempt at world de-stabilisation all those rogue states ever achieved.

Maybe Americans should take responsibility for electing a maniac as their President. In the end, the buck stops with Americans.

Not if the election was stolen. There was a smattering of evidence after the election but the speed with which is disappeared was truly something to behold.

Re: Project Glasswing: Securing critical software for the AI era

#439

Post by anabis »

peterldowns wrote: post #355
fintech_eng wrote: post #189

Earlier quoted context omitted.

its also very easy to reproduce. i have more findings than i know what to do with

are there any tricks you'd suggest, or starter prompts, for using claude to analyze my own company's services for security problems?

Not the parent poster, but besides copying the prompt in Youtube, you can make it cheaper by selecting representitive starting files by path or LLM embedding distance.

Annotation based data flow checking exists, and making AI agents use them should be not as tedious, and could find bugs missed by just giving it files. The result from data flow checks can be fed to AI agents to verify.

Post reply on HN