I know Mastodon hates LLM's and AI.
-
@Netzblockierer if your data leaks on a next LLM powered leak you can't cry!
@drwhax It won't because I know how to properly airgap my shit…
-
@drwhax
> I've started reporting vulnerabilities to all kinds of projects and the majority have trouble or patching issues found.Is there a public example of such vulnerability you have reported that you can show us?
I wonder if the majority of people reporting vulnerabilities by using Claude have trouble self-evaluating the quality of their reports.
@castedo yes, some of these got an CVE assigned here: https://github.com/tuxera/ntfs-3g/security
As these are reported privately, there's no open issue. I could however make these findings open-source in a git repo if that's useful?
-
@drwhax It won't because I know how to properly airgap my shit…
@Netzblockierer tell me you dont understand it, wihtout saying you dont understand it
-
@castedo yes, some of these got an CVE assigned here: https://github.com/tuxera/ntfs-3g/security
As these are reported privately, there's no open issue. I could however make these findings open-source in a git repo if that's useful?
@drwhax I imagine anything that helps novices appreciate what kind of LLM-generated security vulnerability reports are NOT helpful. Perhaps your reports are good examples of thoughtful self-reviewed non-slop. Your news of success might encourage Claude novices to report unhelpful slop they can't self-evaluate.
-
I know Mastodon hates LLM's and AI. So here goes!
I recently got access to trusted access of cyber capabilities of both openai and anthropic, which also allows you to weaponize security vulnerabilities.
The speed at which these parrots can find bugs and be creative enough to exploit them is staggering.
I recently pointed an LLM at an kernel fix that was reachable by an unprivileged namespace on Debian and it fully weaponized it, without too much me prompting it in the right direction, in about 7-9 hours.
I don't think open-source and companies will know what's coming for them once these open-source weight models will have broader reach and get better at exploiting vulnerabilities on a massive scale as anyone can access them.
The bottom line I think is, you cannot patch faster than the attackers can easily chain all kinds of vulnerabilities together and just move laterally on an incredibly fast pace.
I've started reporting vulnerabilities to all kinds of projects and the majority have trouble or patching issues found. There's not enough maintainers, or there's simply none anymore.
I've been getting quite worried about what our future will look like for data privacy. I think outright not running an LLM over your codebase to find critical security vulnerabilities because of your moral stance will keep us more insecure.
Please run an LLM over your code base if it's internet facing or something critical, we thank you!
Can't wait for the discussions on this!
@drwhax This is the crux of the problem countering russian disinformation too. Computers are fast. We are slow. We MUST have our good ones to counter the adversarial bad ones. There is no other answer. I'd like to speak with you at greater length privately about what something like that might look like.
https://mastodon.social/@Beggarmidas/116682187638404935 -
wrt
> needed to be confirmed as accurate before we could trust
https://www.youtube.com/watch?v=mccoBBf0VDM
"we're assuming is consistent, doesn't have contradictions, but we're having to make that assumption."
"one of Gödel's conclusions is that
we cannot prove that mathematics does not have contradictions in it."🫠
@pt_ickle
I watched the video you've referenced, but the accounting data we were required to review against the annual reports was historic data and, by being so, the data was a finite set of data which either could be traced to original receipts and verified, or could be reviewed and found inaccurate. I'm not a mathematician, but the video seems to be talking about the unknown and unknowable rather than the recorded transactions within a set timeframe, inclusive of numbers such as monetary units. Oh, Bertrand Russell did write some good stuff. I like his writing style. -
@ljrk @buherator @drwhax The defense sector cares less than they really should.
@drwho @buherator @drwhax True! And yet more than most corps. Or rather: It's a mixed bag and the orgs that do care most are often situated within defense, while other defense orgs care least.
-
@t_var_s these new models are pretty good at a self adversarial review and writing PoC's. They do tend to cheat and there need to be options to flag false positives using some kind of harness, but that can be done.
@drwhax Yes, I've had some success focusing on getting a PoC. Just saying that right now you can't just hold your nose, press a button and walk away. You can think about waiting until there's something like that.
-
@drwhax Yes, I've had some success focusing on getting a PoC. Just saying that right now you can't just hold your nose, press a button and walk away. You can think about waiting until there's something like that.
@t_var_s
it's not like that yet -
@drwho @buherator @drwhax True! And yet more than most corps. Or rather: It's a mixed bag and the orgs that do care most are often situated within defense, while other defense orgs care least.
@ljrk @buherator @drwhax That's pretty accurate, in my experience.
-
I know Mastodon hates LLM's and AI. So here goes!
I recently got access to trusted access of cyber capabilities of both openai and anthropic, which also allows you to weaponize security vulnerabilities.
The speed at which these parrots can find bugs and be creative enough to exploit them is staggering.
I recently pointed an LLM at an kernel fix that was reachable by an unprivileged namespace on Debian and it fully weaponized it, without too much me prompting it in the right direction, in about 7-9 hours.
I don't think open-source and companies will know what's coming for them once these open-source weight models will have broader reach and get better at exploiting vulnerabilities on a massive scale as anyone can access them.
The bottom line I think is, you cannot patch faster than the attackers can easily chain all kinds of vulnerabilities together and just move laterally on an incredibly fast pace.
I've started reporting vulnerabilities to all kinds of projects and the majority have trouble or patching issues found. There's not enough maintainers, or there's simply none anymore.
I've been getting quite worried about what our future will look like for data privacy. I think outright not running an LLM over your codebase to find critical security vulnerabilities because of your moral stance will keep us more insecure.
Please run an LLM over your code base if it's internet facing or something critical, we thank you!
Can't wait for the discussions on this!
@FreakyFwoof @drwhax Microsoft July 2026 Patch contains 622 vulnerability fixes! Wonder how?
-
@FreakyFwoof @drwhax Microsoft July 2026 Patch contains 622 vulnerability fixes! Wonder how?
@FreakyFwoof @drwhax Also iOS 26.6 has almost 90 security vulnerability fixes, and macOS 26.6 has more than 130 vulnerability fixes.
-
K kramse@helvede.net shared this topic
