4 ms·
It cost me ~$750 to find a tricky privilege escalation bug in a complex codebase where I knew the rough specs but didn't have the exploit. There are certainly s
by lebovic 6mo ago
It cost me ~$750 to find a tricky privilege escalation bug in a complex codebase where I knew the rough specs but didn't have the exploit. There are certainly still many other bugs like that in the codebase, and it would cost $100k-$1MM to explore the rest of the system that deeply with models at or above the capability of Opus 4.6.
It's definitely possible to do a basic pass for much less (I do this with autopen.dev), but it is still very expensive to exhaustively find the harder vulnerabilities.
- christophilus 6mo agoThis is where the Codex and Claude Code Pro/Max plans are excellent. I rarely run into the limits of Codex. If I do, I wait and come back and have it resume once the window has expired.
- Jcampuzano2 6mo agoClaude and Codex pro/max subs aren't supposed to be used for commercial/enterprise development so its not really an option for execs in enterprise. They need to take into account API costs. At my F500 company execs are very wary of the costs of most of these tools and its always top of mind. We have dashboards and gather tons of internal metrics on which tools devs are using and how much they are costing.
- petesergeant 6mo ago> Claude and Codex pro/max subs aren't supposed to be used for commercial/enterprise development lolwut?
- blks 6mo agoRead ToS.
- monocularvision 6mo agoI just did. Tell me where it states what you are claiming. Neither my reading (IANAL) nor ChatGPT’s reading could find such a blanket ban: https://www.anthropic.com/legal/consumer-terms https://www.anthropic.com/legal/consumer-terms
- watermelon0 6mo agoFrom your link: > Non-commercial use only. You agree that you will not use our Services for any commercial or business purposes and we and our Providers have no liability to you for any loss of profit, loss of business, business interruption, or loss of business opportunity. There are separate commercial terms for Team/Enterprise/API usage: https://www.anthropic.com/legal/commercial-terms https://www.anthropic.com/legal/commercial-terms
- fasterik 6mo agoI suspect you are accessing their website from a European IP address. The clause you quoted is not present for users outside of the EU/UK. https://news.ycombinator.com/item?id=47590473 https://news.ycombinator.com/item?id=47590473
- monocularvision 6mo agoThat explains it. I don’t see it from my US IP address.
- otterley 6mo agoAre they also measuring productivity? Measuring only token costs is like looking only at grocery spend but not the full receipt: you don’t know whether you fed your family for a week or for only a day.
- batshit_beaver 6mo agoFirst you have to figure out HOW to measure productivity.
- otterley 6mo ago(Output / input), both of which are usually measured in money. If you can measure both of those things--and you have bigger problems if your finance department can't--it logically follows that you can measure productivity.
- Jcampuzano2 6mo agoMeasuring strictly in terms of money per unit time over a small enough timeframe is difficult because not all tasks directly result in immediately observed results. There are tasks worked on at large enterprises that have 5+ year horizons, and those can't all immediately be tracked in terms of monetary gain that can be correlated with AI usage. We've barely even had AI as a daily tool used for development for a few years.
- Jcampuzano2 6mo agoI'm not one of those execs, I'm just echoing what they tell us from those I've talked to who manage these dashboards and worry about this. I do think measuring productivity is not very clear-cut especially with these tools. They do "attempt" to measure productivity. But they also just see large dollar amounts on AI costs and get wary. My company is also wary of going all in with any one tool or company due to how quickly stuff changes. So far they've been trying to pool our costs across all tools together and give us an "honor system" limit we should try not to go above per month until we do commit to one suite of tools.
- christophilus 6mo agoNo, I think that’s wrong. They aren’t supposed to be put behind a service, but they can certainly be used to write professional products/ products for the enterprise.
- deleted 6mo ago[deleted]
- otterley 6mo agoHow much would it have cost a human to do the same work? The question isn’t how much tokens cost; the question is how much money is saved by using AI to do it.
- skeledrew 6mo agoCompare to the cost when said vulnerabilities are exploited by bad actors in critical systems. Worth it yet?