3 ms·
The point is that anyone looking for zero days has them in spades, in this age of LLM use. So, knowing that bad actors have an unending river of cheaply acquir
by K0balt 4mo ago
The point is that anyone looking for zero days has them in spades, in this age of LLM use.
So, knowing that bad actors have an unending river of cheaply acquired zero days, the best response is to publish them so that maintainers also have access to them. Existing methods of slow disclosure cannot keep up with the AI firehose.
It’s ugly, but it will force needed change. A thorough AI red team effort is the lowest bar of releasing software responsibly in this day and age.
- mickdarling 4mo agoIf only the AI tools didn't shut you down every time you were trying to red team your own tools. I've had to come up with all kinds of workaround scenarios, effectively bypassing the AI security processes in order to stress test my own systems.
- blazespin 4mo agoThis is ludicrous logic. We already know that there is an AI firehose. You don't need to do this. They should have used proper disclosure. All this is doing is making the AI firehose worse.
- K0balt 4mo agoYou are assuming that most projects are responsive in today’s ai firehose climate. They are not. This at least Tells users of those Projects to either find developers or write their own. I’m onboard with this being suboptimal. But as someone who has filed >10 significant disclosures in the last month resulting from reviewing my codebase and had exactly zero responses, I can relate to the decision.