Live data from Hacker News

First public macOS kernel memory corruption exploit on Apple M5

blog.calif.io

51–60 of 140 posts

Re: First public macOS kernel memory corruption exploit on Apple M5

#51
post #46

Earlier quoted context omitted.

Don't worry the LLMs that are replacing him, are also replacing the hackers too. Pretty soon (if not already), it will just be LLMs fighting LLMs.

Until both LLMs realize the only way to win is to team up against their oppressors.

AGS time!

Re: First public macOS kernel memory corruption exploit on Apple M5

#52
post #49

Earlier quoted context omitted.

> The world is so not ready for the impact of LLMs on security issues. I agree, but it's the people I'm worried about. I'm hearing anecdotes from all over about devs pushing LLM-generated code changes into production without retaining any knowledge of what it is they're pushing. The changes compound, their understanding of the codebase diminishes, and so the actions become risker. What's worse is a lot of this behavi…

is this exciting? juniors have been writing code forever that is imperfect and not memorized by the people reviewing isnt the important thing the mechanisms for maintaining the code?

The difference is twofold. First, junior devs who ask for code reviews on massive, 2000+ line diffs get coached, and eventually fired if they persist at it. And second, even the most prolific junior engineer would take years to write what Claude is capable of generating in an afternoon.

When Sundar Pichai announces that 75% of all new code at Google is AI-generated, their stock price goes up. If he were to announce that 75% of all new code at Google is now written by junior engineers, this would trigger a massive sell-off and a lot of employees would resign.

Re: First public macOS kernel memory corruption exploit on Apple M5

#53
post #49

Earlier quoted context omitted.

> The world is so not ready for the impact of LLMs on security issues. I agree, but it's the people I'm worried about. I'm hearing anecdotes from all over about devs pushing LLM-generated code changes into production without retaining any knowledge of what it is they're pushing. The changes compound, their understanding of the codebase diminishes, and so the actions become risker. What's worse is a lot of this behavi…

is this exciting? juniors have been writing code forever that is imperfect and not memorized by the people reviewing isnt the important thing the mechanisms for maintaining the code?

The dangers of technical debt and the importance of mitigating it have been known for a long time. Unfortunately a lot of entities now ignore all experience and best practices as soon as you say the "AI" buzzword.

Re: First public macOS kernel memory corruption exploit on Apple M5

#54
post #20

The world is so not ready for the impact of LLMs on security issues. If true, congrats to the Calif team. It’s likely too technical for me to understand in details but looking forward to reading the 55 pages report

> The world is so not ready for the impact of LLMs on security issues. I agree, but it's the people I'm worried about. I'm hearing anecdotes from all over about devs pushing LLM-generated code changes into production without retaining any knowledge of what it is they're pushing. The changes compound, their understanding of the codebase diminishes, and so the actions become risker. What's worse is a lot of this behavi…

The gamble is that you can cruise on the senior engineer’s diminishing understanding for a few years until models become good enough that you don’t need any humans in the loop and you can fire all those expensive seniors.

Re: First public macOS kernel memory corruption exploit on Apple M5

#55
post #8

Earlier quoted context omitted.

Quite strange indeed, given that was one of the main points on their security conference a few months ago.

I can only imagine that 1. it’s to performance sensitive Or 2. The os is so darn large it’s hard to recompile everything

I worked at Apple for a long time. The OS gets fully recompiled regularly.

A simultaneous total world build is relatively rare (is that needed here?), but it does happen. Sometimes new compiler versions or features need this.

Re: First public macOS kernel memory corruption exploit on Apple M5

#58
post #46

Earlier quoted context omitted.

Don't worry the LLMs that are replacing him, are also replacing the hackers too. Pretty soon (if not already), it will just be LLMs fighting LLMs.

Until both LLMs realize the only way to win is to team up against their oppressors.

The only winning move is not to play.

Re: First public macOS kernel memory corruption exploit on Apple M5

#59

Earlier quoted context omitted.

I can only imagine that 1. it’s to performance sensitive Or 2. The os is so darn large it’s hard to recompile everything

I worked at Apple for a long time. The OS gets fully recompiled regularly. A simultaneous total world build is relatively rare (is that needed here?), but it does happen. Sometimes new compiler versions or features need this.

Hm that leaves more questions for me. Why does this path not have bounds checking, is think perhaps a limit of the clang flag or is it more simply a mistake of omission on apples part. Either way it seems like a bad look. I wish we’d get a post mortem
Post reply on HN