3 ms·

> AI is helping patch previously unrealized holes. AI is also making plenty of holes. I have not seen a single case of anything that an AI has found that coul

> AI is helping patch previously unrealized holes. AI is also making plenty of holes. I have not seen a single case of anything that an AI has found that could not have been automatically found without AI.

Ar-Curunir 19d ago
Mozilla had 400 Firefox CVEs found by Mythos; if those were so easy to find, why didn’t humans do it before?
- spartanatreyu 19d ago
  Humans did do it before. ------------------------ It's also worth pointing out that the developers at Mozilla literally decided to make a brand new programming language (Rust) that eliminated an entire categories of bugs and started working on a new browser (Servo) where its components could be switched into firefox. Then Mozilla fired the team working on it. Lesson 1: Better tools and processes eliminate bugs. Lesson 2: If you don't have the tools, make them. Lesson 3: Mismanagement leads to security vulnerabilities.
  - Ar-Curunir 19d ago
    Yes, and even after introducing and using Rust, there were still vulns in the remaining code. FWIW, Rust is my main language, so I am grateful to the humans that created it, and it is indeed a monumental effort. But vuln finding is a different kind of creative endeavour, and one that is heavily weighted against defenders.
    - spartanatreyu 19d ago
      Yes, which is why you don't stop at rust. You would choose rust (from a security standpoint) because it massively reduces memory safety issues (which from a Microsoft study was responsible for around 70% of bugs). Then you look at things like linting, fuzzing, design by contract, proofing, deterministic test runs, etc... As I said above: use better tools and processes. LLMs don't fit that criteria.
  - eviks 19d ago
    Good point about the whole new language as a tool for eliminating many thousands(?) as a whole category
  - Someone 19d ago
    > It's also worth pointing out that the developers at Mozilla literally decided to make a brand new programming language (Rust) In my memory, that does not seem 100% right. And indeed https://en.wikipedia.org/wiki/Rust_(programming_language)#2006–2009:_Early_years https://en.wikipedia.org/wiki/Rust_(programming_language)#20... says a single developer who happened to work at Mozilla started it as a personal project. After a few years Mozilla became interested in it and then sponsored its development, transforming it into the language it is today.

Ar-Curunir 19d ago

Mozilla had 400 Firefox CVEs found by Mythos; if those were so easy to find, why didn’t humans do it before?

spartanatreyu 19d ago
Humans did do it before. ------------------------ It's also worth pointing out that the developers at Mozilla literally decided to make a brand new programming language (Rust) that eliminated an entire categories of bugs and started working on a new browser (Servo) where its components could be switched into firefox. Then Mozilla fired the team working on it. Lesson 1: Better tools and processes eliminate bugs. Lesson 2: If you don't have the tools, make them. Lesson 3: Mismanagement leads to security vulnerabilities.
- Ar-Curunir 19d ago
  Yes, and even after introducing and using Rust, there were still vulns in the remaining code. FWIW, Rust is my main language, so I am grateful to the humans that created it, and it is indeed a monumental effort. But vuln finding is a different kind of creative endeavour, and one that is heavily weighted against defenders.
  - spartanatreyu 19d ago
    Yes, which is why you don't stop at rust. You would choose rust (from a security standpoint) because it massively reduces memory safety issues (which from a Microsoft study was responsible for around 70% of bugs). Then you look at things like linting, fuzzing, design by contract, proofing, deterministic test runs, etc... As I said above: use better tools and processes. LLMs don't fit that criteria.
- eviks 19d ago
  Good point about the whole new language as a tool for eliminating many thousands(?) as a whole category
- Someone 19d ago
  > It's also worth pointing out that the developers at Mozilla literally decided to make a brand new programming language (Rust) In my memory, that does not seem 100% right. And indeed https://en.wikipedia.org/wiki/Rust_(programming_language)#2006–2009:_Early_years https://en.wikipedia.org/wiki/Rust_(programming_language)#20... says a single developer who happened to work at Mozilla started it as a personal project. After a few years Mozilla became interested in it and then sponsored its development, transforming it into the language it is today.