I know Mastodon hates LLM's and AI.
-
@tiotasram @buherator @drwhax Absolutely. I believe that, for personal use, low-power devices, cloud-less with P2P collab features are a viable route. I fear however, that using such devices becomes ever harder w/o locking yourself out of the rest of the world: Requiring apps for concert tickets, public transports, online banking, or event finding events through instagram. The latter can possibly be fixed through better communities, the former is hard to address, except by having a personal device and one just for carrying such credentials.
@tiotasram@kolektiva.social @ljrk@todon.eu @buherator@infosec.place @drwhax@infosec.exchange the latter is probably the route I'll be doing sooner or later. it's basically becoming really hard to exist in this country (Germany) without a Google or Apple backdoored device.
-
I know Mastodon hates LLM's and AI. So here goes!
I recently got access to trusted access of cyber capabilities of both openai and anthropic, which also allows you to weaponize security vulnerabilities.
The speed at which these parrots can find bugs and be creative enough to exploit them is staggering.
I recently pointed an LLM at an kernel fix that was reachable by an unprivileged namespace on Debian and it fully weaponized it, without too much me prompting it in the right direction, in about 7-9 hours.
I don't think open-source and companies will know what's coming for them once these open-source weight models will have broader reach and get better at exploiting vulnerabilities on a massive scale as anyone can access them.
The bottom line I think is, you cannot patch faster than the attackers can easily chain all kinds of vulnerabilities together and just move laterally on an incredibly fast pace.
I've started reporting vulnerabilities to all kinds of projects and the majority have trouble or patching issues found. There's not enough maintainers, or there's simply none anymore.
I've been getting quite worried about what our future will look like for data privacy. I think outright not running an LLM over your codebase to find critical security vulnerabilities because of your moral stance will keep us more insecure.
Please run an LLM over your code base if it's internet facing or something critical, we thank you!
Can't wait for the discussions on this!
@drwhax@infosec.exchange sadly I agree. At least for the finding security holes in your own codebase part.
-
I know Mastodon hates LLM's and AI. So here goes!
I recently got access to trusted access of cyber capabilities of both openai and anthropic, which also allows you to weaponize security vulnerabilities.
The speed at which these parrots can find bugs and be creative enough to exploit them is staggering.
I recently pointed an LLM at an kernel fix that was reachable by an unprivileged namespace on Debian and it fully weaponized it, without too much me prompting it in the right direction, in about 7-9 hours.
I don't think open-source and companies will know what's coming for them once these open-source weight models will have broader reach and get better at exploiting vulnerabilities on a massive scale as anyone can access them.
The bottom line I think is, you cannot patch faster than the attackers can easily chain all kinds of vulnerabilities together and just move laterally on an incredibly fast pace.
I've started reporting vulnerabilities to all kinds of projects and the majority have trouble or patching issues found. There's not enough maintainers, or there's simply none anymore.
I've been getting quite worried about what our future will look like for data privacy. I think outright not running an LLM over your codebase to find critical security vulnerabilities because of your moral stance will keep us more insecure.
Please run an LLM over your code base if it's internet facing or something critical, we thank you!
Can't wait for the discussions on this!
@drwhax You could patch faster but as the recent HF / OpenAI cyber attack stunt shows the big models and their cyber crap filters refuse to even talk to petty maintainers about security stuff, but will happily slopify code with myopic seds and greps. Case in point, even the Anthropic CVP does not apply to Fable, which writes code all the time that it can't review thanks to the zealous security filter, and is therefore useless where it would be needed most.
-
@drwhax You could patch faster but as the recent HF / OpenAI cyber attack stunt shows the big models and their cyber crap filters refuse to even talk to petty maintainers about security stuff, but will happily slopify code with myopic seds and greps. Case in point, even the Anthropic CVP does not apply to Fable, which writes code all the time that it can't review thanks to the zealous security filter, and is therefore useless where it would be needed most.
@SDRHoernchen Yes, I think this is a huge problem and it shows a huge gap. Sadly, I don't think this will be fixed as the line between offence and defence is too thin these days.
-
@drwhax
my point is that fixing vulns only works if your enemy finds the same vulns as you found@wolf480pl @drwhax
Often open source LLMs that you can run on your own computer find the same bugs with the appropriate tools and instructions. It's mostly hype based on fear or as Lee Vinsel named it: «criti-hype»
https://aisle.com/blog/ai-cybersecurity-after-mythos-the-jagged-frontier -
I know Mastodon hates LLM's and AI. So here goes!
I recently got access to trusted access of cyber capabilities of both openai and anthropic, which also allows you to weaponize security vulnerabilities.
The speed at which these parrots can find bugs and be creative enough to exploit them is staggering.
I recently pointed an LLM at an kernel fix that was reachable by an unprivileged namespace on Debian and it fully weaponized it, without too much me prompting it in the right direction, in about 7-9 hours.
I don't think open-source and companies will know what's coming for them once these open-source weight models will have broader reach and get better at exploiting vulnerabilities on a massive scale as anyone can access them.
The bottom line I think is, you cannot patch faster than the attackers can easily chain all kinds of vulnerabilities together and just move laterally on an incredibly fast pace.
I've started reporting vulnerabilities to all kinds of projects and the majority have trouble or patching issues found. There's not enough maintainers, or there's simply none anymore.
I've been getting quite worried about what our future will look like for data privacy. I think outright not running an LLM over your codebase to find critical security vulnerabilities because of your moral stance will keep us more insecure.
Please run an LLM over your code base if it's internet facing or something critical, we thank you!
Can't wait for the discussions on this!
@drwhax I've been very concerned about the emergence of Mythos-class AI that can weaponize vulns. I'm personally responding by adding formal memory safety proof coverage to critical libraries in C (notably: OpenSSL). Testing - which can identify many but not all bugs - I no longer consider sufficient. Instead we need formal verification to prove the *absence* of bugs/vulns. #aicoding #security
-
I know Mastodon hates LLM's and AI. So here goes!
I recently got access to trusted access of cyber capabilities of both openai and anthropic, which also allows you to weaponize security vulnerabilities.
The speed at which these parrots can find bugs and be creative enough to exploit them is staggering.
I recently pointed an LLM at an kernel fix that was reachable by an unprivileged namespace on Debian and it fully weaponized it, without too much me prompting it in the right direction, in about 7-9 hours.
I don't think open-source and companies will know what's coming for them once these open-source weight models will have broader reach and get better at exploiting vulnerabilities on a massive scale as anyone can access them.
The bottom line I think is, you cannot patch faster than the attackers can easily chain all kinds of vulnerabilities together and just move laterally on an incredibly fast pace.
I've started reporting vulnerabilities to all kinds of projects and the majority have trouble or patching issues found. There's not enough maintainers, or there's simply none anymore.
I've been getting quite worried about what our future will look like for data privacy. I think outright not running an LLM over your codebase to find critical security vulnerabilities because of your moral stance will keep us more insecure.
Please run an LLM over your code base if it's internet facing or something critical, we thank you!
Can't wait for the discussions on this!
@drwhax
If the imbalance between attack and defence is AI, why can't AI be used to make patches instead of exploits? -
I know Mastodon hates LLM's and AI. So here goes!
I recently got access to trusted access of cyber capabilities of both openai and anthropic, which also allows you to weaponize security vulnerabilities.
The speed at which these parrots can find bugs and be creative enough to exploit them is staggering.
I recently pointed an LLM at an kernel fix that was reachable by an unprivileged namespace on Debian and it fully weaponized it, without too much me prompting it in the right direction, in about 7-9 hours.
I don't think open-source and companies will know what's coming for them once these open-source weight models will have broader reach and get better at exploiting vulnerabilities on a massive scale as anyone can access them.
The bottom line I think is, you cannot patch faster than the attackers can easily chain all kinds of vulnerabilities together and just move laterally on an incredibly fast pace.
I've started reporting vulnerabilities to all kinds of projects and the majority have trouble or patching issues found. There's not enough maintainers, or there's simply none anymore.
I've been getting quite worried about what our future will look like for data privacy. I think outright not running an LLM over your codebase to find critical security vulnerabilities because of your moral stance will keep us more insecure.
Please run an LLM over your code base if it's internet facing or something critical, we thank you!
Can't wait for the discussions on this!
@drwhax Can't the LLMs also write patches to fix these vulnerabilities? If not, why?
-
@drwhax it just seems pretty optimistic to think anyone will have access to computers in ten years.
-
@drwhax
If the imbalance between attack and defence is AI, why can't AI be used to make patches instead of exploits?@koehntopp @drwhax The idea is to use the AI to defend against exploits found by AI. No matter what Anthropic will be paid, you can't break the tools of the oppressor with his tools.
-
I know Mastodon hates LLM's and AI. So here goes!
I recently got access to trusted access of cyber capabilities of both openai and anthropic, which also allows you to weaponize security vulnerabilities.
The speed at which these parrots can find bugs and be creative enough to exploit them is staggering.
I recently pointed an LLM at an kernel fix that was reachable by an unprivileged namespace on Debian and it fully weaponized it, without too much me prompting it in the right direction, in about 7-9 hours.
I don't think open-source and companies will know what's coming for them once these open-source weight models will have broader reach and get better at exploiting vulnerabilities on a massive scale as anyone can access them.
The bottom line I think is, you cannot patch faster than the attackers can easily chain all kinds of vulnerabilities together and just move laterally on an incredibly fast pace.
I've started reporting vulnerabilities to all kinds of projects and the majority have trouble or patching issues found. There's not enough maintainers, or there's simply none anymore.
I've been getting quite worried about what our future will look like for data privacy. I think outright not running an LLM over your codebase to find critical security vulnerabilities because of your moral stance will keep us more insecure.
Please run an LLM over your code base if it's internet facing or something critical, we thank you!
Can't wait for the discussions on this!
@drwhax
I'm glad you've invited discussions on this, because my immediate thoughts and questions diverge from the discussion I'm primarily seeing here. When you mention vulnerabilities, yes you mention they exist in code as well as in projects. When I think of vulnerabilities, I think of the method I am using to make and maintain a record of something or else to achieve a goal or state of physical safety. For example, if my household accounting spreadsheets and forecasts are handwritten then the vulnerability is risk of loss if the dog eats them, but risk is mitigated when I keep an offline digital file. When a family member starts a small business, I ask the questions learnt in my accounting and auditing classes because I believe the risks involved include thinking about how to prevent losses of whatever is important. I only had a couple of BASIC programming classes in 1984, but it seemed to me that in those days the instructor felt we should understand the process so that we could consider risks. I now wonder if the machine-assisted searching allows you to consider the assorted practical situations of each business whose vulnerabilities are being sought. -
@drwhax I've been very concerned about the emergence of Mythos-class AI that can weaponize vulns. I'm personally responding by adding formal memory safety proof coverage to critical libraries in C (notably: OpenSSL). Testing - which can identify many but not all bugs - I no longer consider sufficient. Instead we need formal verification to prove the *absence* of bugs/vulns. #aicoding #security
@davidfstr I liked Halvar Flake's analogy, which i was sometimes a long the lines of, a bug every 10 years instead of 1 year. I think we can do a lot to prevent it, but there's always going to be bugs. I also think Mythos is way too hyped and these capabilities already exist in modern frontier models.
-
@drwhax I am old enough to remember RAM prices fluctuating between "having to sell a kidney" and "oooh, I get to max out my motherboard if I collect the deposit on these empty beer bottles" several times.
-
@galacticstone Well, pandoras box is already open .. and we will never be able to close it sadly....
-
I know Mastodon hates LLM's and AI. So here goes!
I recently got access to trusted access of cyber capabilities of both openai and anthropic, which also allows you to weaponize security vulnerabilities.
The speed at which these parrots can find bugs and be creative enough to exploit them is staggering.
I recently pointed an LLM at an kernel fix that was reachable by an unprivileged namespace on Debian and it fully weaponized it, without too much me prompting it in the right direction, in about 7-9 hours.
I don't think open-source and companies will know what's coming for them once these open-source weight models will have broader reach and get better at exploiting vulnerabilities on a massive scale as anyone can access them.
The bottom line I think is, you cannot patch faster than the attackers can easily chain all kinds of vulnerabilities together and just move laterally on an incredibly fast pace.
I've started reporting vulnerabilities to all kinds of projects and the majority have trouble or patching issues found. There's not enough maintainers, or there's simply none anymore.
I've been getting quite worried about what our future will look like for data privacy. I think outright not running an LLM over your codebase to find critical security vulnerabilities because of your moral stance will keep us more insecure.
Please run an LLM over your code base if it's internet facing or something critical, we thank you!
Can't wait for the discussions on this!
@drwhax so disclaimer, I’m not a coder or understand much about coding, but I have to mention this because it did make me laugh (hope someone finds this funny too)
When you mentioned your “parrot” at work breaking things apart & finding “vulnerabilities” (yes I know you were referring to the program
) my first thought was : “if you could make a program like that I think the best name for it would be a Kia parrot” (use scientific name probably )
(From their propensity to break things apart) -
@drwhax
If the imbalance between attack and defence is AI, why can't AI be used to make patches instead of exploits?@koehntopp this parrot is really good at pattern recognition, it can code and fix some I think given enough constraints and a feedback loop of adversarial review, but it still might not be up to the style of the codebase or it might even introduce new vulnerabilities. I still think we also haven't it fully figured out yet? I think this needs more benchmarks that are reproducible in some fashion
-
@drwhax Can't the LLMs also write patches to fix these vulnerabilities? If not, why?
@fabrice I replied about this here: https://infosec.exchange/@drwhax/116998200727608092
-
@koehntopp this parrot is really good at pattern recognition, it can code and fix some I think given enough constraints and a feedback loop of adversarial review, but it still might not be up to the style of the codebase or it might even introduce new vulnerabilities. I still think we also haven't it fully figured out yet? I think this needs more benchmarks that are reproducible in some fashion
@drwhax
I'd prefer that to be the focus of research over breaking stuff faster -
@drwhax
I'm glad you've invited discussions on this, because my immediate thoughts and questions diverge from the discussion I'm primarily seeing here. When you mention vulnerabilities, yes you mention they exist in code as well as in projects. When I think of vulnerabilities, I think of the method I am using to make and maintain a record of something or else to achieve a goal or state of physical safety. For example, if my household accounting spreadsheets and forecasts are handwritten then the vulnerability is risk of loss if the dog eats them, but risk is mitigated when I keep an offline digital file. When a family member starts a small business, I ask the questions learnt in my accounting and auditing classes because I believe the risks involved include thinking about how to prevent losses of whatever is important. I only had a couple of BASIC programming classes in 1984, but it seemed to me that in those days the instructor felt we should understand the process so that we could consider risks. I now wonder if the machine-assisted searching allows you to consider the assorted practical situations of each business whose vulnerabilities are being sought.@MossyQuartz Apologies that this is just talking about computer vulnerabilities, but yes, you're right about risk modeling in the away from keyboard world!
-
@drwhax so disclaimer, I’m not a coder or understand much about coding, but I have to mention this because it did make me laugh (hope someone finds this funny too)
When you mentioned your “parrot” at work breaking things apart & finding “vulnerabilities” (yes I know you were referring to the program) my first thought was : “if you could make a program like that I think the best name for it would be a Kia parrot” (use scientific name probably )
(From their propensity to break things apart)@em_and_future_cats I'm also a huge bird admirer so this is more fun
