3 ms·
Alternate headline: AI discovering so many exploits that cybersecurity can't keep up Am I doing this right?
by ares623 9mo ago
Alternate headline: AI discovering so many exploits that cybersecurity can't keep up
Am I doing this right?
- bawolff 9mo agoThere is a difference between AI discovering real vulnerabilities (e.g. the ffmpeg situation), and AI being used to spam fake vulnerabilities
- groundzeros2015 9mo ago> the ffmpeg situation How do you know that?
- bawolff 9mo agoBecause the vulnerability was published and it appeared real.
- groundzeros2015 9mo agoI’m sure AI also found real vulnerabilities on cURL. My question is why you know cURL is being “spammed” but that FFMPEG is just getting legitimate problems.
- bawolff 9mo ago> I’m sure AI also found real vulnerabilities on cURL. The curl maintainer published the reports and they were very clearly not security vulnerabilities in curl. > My question is why you know cURL is being “spammed” but that FFMPEG is just getting legitimate problems. To put it bluntly, because i can read. Did you actually read the reports in question?
- groundzeros2015 9mo ago> because i can read So you looked their the bug list and then the source code and found which issues were legitimate or someone did so on your behalf?
- bawolff 9mo agoI read the specific examples that the maintainers of each project gave. The ones the ffmpeg maintainers complained about appeared to be real bugs. In fact i dont think the ffmpeg maintainers even dispute that. The ffmpeg maintainers after all fixed the issue in question. The ones the curl maintainers gave were clearly nonsense. The curl maintainers did not fix the issue because there was nothing to fix because the report didn't actually report anything that could be fixed because it made no sense.
- groundzeros2015 9mo agoCan you acknowledge you have limited information about the contents and quality of another projects bug reports?
- potatoproduct 9mo agoIt's easy to discover an exploit when you're hallucinating:)
- catlifeonmars 9mo agoIs that the case?
- happosai 9mo agoThe LLM models give the most likely respond to a prompt. So if you prompt it with "find security bugs from this code" it will respond with "This may be a security bug" than you "you fucking donkey this curl code has already been eyeballed by hundreds of people, you think a statistic model will find something new?"
- ryukoposting 9mo agoHeh. Lots of folks not getting the joke in this thread.