3 ms·

There are over 200 security patches in the newest versions of macOS. AI is helping patch previously unrealized holes.

spartanatreyu 12d ago
> AI is helping patch previously unrealized holes. AI is also making plenty of holes. I have not seen a single case of anything that an AI has found that could not have been automatically found without AI.
- Ar-Curunir 12d ago
  Mozilla had 400 Firefox CVEs found by Mythos; if those were so easy to find, why didn’t humans do it before?
  - spartanatreyu 12d ago
    Humans did do it before. ------------------------ It's also worth pointing out that the developers at Mozilla literally decided to make a brand new programming language (Rust) that eliminated an entire categories of bugs and started working on a new browser (Servo) where its components could be switched into firefox. Then Mozilla fired the team working on it. Lesson 1: Better tools and processes eliminate bugs. Lesson 2: If you don't have the tools, make them. Lesson 3: Mismanagement leads to security vulnerabilities.
    - Ar-Curunir 12d ago
      Yes, and even after introducing and using Rust, there were still vulns in the remaining code. FWIW, Rust is my main language, so I am grateful to the humans that created it, and it is indeed a monumental effort. But vuln finding is a different kind of creative endeavour, and one that is heavily weighted against defenders.
      - spartanatreyu 11d ago
        Yes, which is why you don't stop at rust. You would choose rust (from a security standpoint) because it massively reduces memory safety issues (which from a Microsoft study was responsible for around 70% of bugs). Then you look at things like linting, fuzzing, design by contract, proofing, deterministic test runs, etc... As I said above: use better tools and processes. LLMs don't fit that criteria.
    - eviks 11d ago
      Good point about the whole new language as a tool for eliminating many thousands(?) as a whole category
    - Someone 11d ago
      > It's also worth pointing out that the developers at Mozilla literally decided to make a brand new programming language (Rust) In my memory, that does not seem 100% right. And indeed https://en.wikipedia.org/wiki/Rust_(programming_language)#2006–2009:_Early_years https://en.wikipedia.org/wiki/Rust_(programming_language)#20... says a single developer who happened to work at Mozilla started it as a personal project. After a few years Mozilla became interested in it and then sponsored its development, transforming it into the language it is today.
pvab3 12d ago
i'm sure most of those patches will keep coming to Sequoia over the coming years
- eviks 11d ago
  They've already come?15.8 has a long list of vulns fixed
eviks 11d ago
You have the same long list for Sequoia 15.8, so how is that better? Besides, newer OSes are also more likely to have uniquely knew bugs from both AI slop and in general all the shiny new broken features
avazhi 11d ago
Yes, I should have been clear - I don't mind AI working on patches or vuln-hunting; my issue with MacOS 27 is the amount of AI included in the OS that is not opt-in. I use Claude Code everyday - but it doesn't run locally on my main production machines.
usern20260720 11d ago
If Apple wanted to make the OS more secure, they would make the OS more modular, allowing users to reduce the surface risk by not installing bloated components

> AI is helping patch previously unrealized holes. AI is also making plenty of holes. I have not seen a single case of anything that an AI has found that could not have been automatically found without AI.

Ar-Curunir 12d ago
Mozilla had 400 Firefox CVEs found by Mythos; if those were so easy to find, why didn’t humans do it before?
- spartanatreyu 12d ago
  Humans did do it before. ------------------------ It's also worth pointing out that the developers at Mozilla literally decided to make a brand new programming language (Rust) that eliminated an entire categories of bugs and started working on a new browser (Servo) where its components could be switched into firefox. Then Mozilla fired the team working on it. Lesson 1: Better tools and processes eliminate bugs. Lesson 2: If you don't have the tools, make them. Lesson 3: Mismanagement leads to security vulnerabilities.
  - Ar-Curunir 12d ago
    Yes, and even after introducing and using Rust, there were still vulns in the remaining code. FWIW, Rust is my main language, so I am grateful to the humans that created it, and it is indeed a monumental effort. But vuln finding is a different kind of creative endeavour, and one that is heavily weighted against defenders.
    - spartanatreyu 11d ago
      Yes, which is why you don't stop at rust. You would choose rust (from a security standpoint) because it massively reduces memory safety issues (which from a Microsoft study was responsible for around 70% of bugs). Then you look at things like linting, fuzzing, design by contract, proofing, deterministic test runs, etc... As I said above: use better tools and processes. LLMs don't fit that criteria.
  - eviks 11d ago
    Good point about the whole new language as a tool for eliminating many thousands(?) as a whole category
  - Someone 11d ago
    > It's also worth pointing out that the developers at Mozilla literally decided to make a brand new programming language (Rust) In my memory, that does not seem 100% right. And indeed https://en.wikipedia.org/wiki/Rust_(programming_language)#2006–2009:_Early_years https://en.wikipedia.org/wiki/Rust_(programming_language)#20... says a single developer who happened to work at Mozilla started it as a personal project. After a few years Mozilla became interested in it and then sponsored its development, transforming it into the language it is today.

pvab3 12d ago

i'm sure most of those patches will keep coming to Sequoia over the coming years

eviks 11d ago
They've already come?15.8 has a long list of vulns fixed

eviks 11d ago

You have the same long list for Sequoia 15.8, so how is that better? Besides, newer OSes are also more likely to have uniquely knew bugs from both AI slop and in general all the shiny new broken features

avazhi 11d ago

Yes, I should have been clear - I don't mind AI working on patches or vuln-hunting; my issue with MacOS 27 is the amount of AI included in the OS that is not opt-in. I use Claude Code everyday - but it doesn't run locally on my main production machines.

usern20260720 11d ago

If Apple wanted to make the OS more secure, they would make the OS more modular, allowing users to reduce the surface risk by not installing bloated components