3 ms·
Not symmetric at all. There are countless bugs to fund. If the offender runs these tools, then any bug they find becomes a cyberweapon. If the defender runs
by pizlonator 9mo ago
Not symmetric at all.
There are countless bugs to fund.
If the offender runs these tools, then any bug they find becomes a cyberweapon.
If the defender runs these tools, they will not thwart the offender unless they find and fix all of the bugs.
Any vs all is not symmetric
- 0xDEAFBEAD 9mo agoHow do bug bounties change the calculus? Assuming rational white hats who will report every bug which costs fewer LLM tokens than the bounty, on expectation.
- pizlonator 9mo agoThey don’t. For the calculus to change, anyone running an LLM to find bugs would have to be able to find all of the bugs that anyone else running an LLM could ever find. That’s not going to happen.
- 0xDEAFBEAD 9mo agoCorrect me if I'm wrong, but I think a better mental model would be something like: Take the union of all bugs found by all white hats, fix all of those, then check if any black hat has found sufficient unfixed bugs to construct an exploit chain?
- saagarjha 9mo agoHow do you check this?
- 0xDEAFBEAD 9mo agoI meant in the sense that this algorithm will tell you if your software is vulnerable in the abstract. It's not a procedure you could actually follow.
- pizlonator 9mo agoThe black hat has to find a handful of bugs. Sometimes one bug is enough.
- energy123 9mo agoLLMs effectively move us from A to B: A) 1 cyber security employee, 1 determined attacker B) 100 cyber security employees, 100 determined attackers Which is better for defender?
- pizlonator 9mo agoNeither