I know Mastodon hates LLM's and AI.
-
I know Mastodon hates LLM's and AI. So here goes!
I recently got access to trusted access of cyber capabilities of both openai and anthropic, which also allows you to weaponize security vulnerabilities.
The speed at which these parrots can find bugs and be creative enough to exploit them is staggering.
I recently pointed an LLM at an kernel fix that was reachable by an unprivileged namespace on Debian and it fully weaponized it, without too much me prompting it in the right direction, in about 7-9 hours.
I don't think open-source and companies will know what's coming for them once these open-source weight models will have broader reach and get better at exploiting vulnerabilities on a massive scale as anyone can access them.
The bottom line I think is, you cannot patch faster than the attackers can easily chain all kinds of vulnerabilities together and just move laterally on an incredibly fast pace.
I've started reporting vulnerabilities to all kinds of projects and the majority have trouble or patching issues found. There's not enough maintainers, or there's simply none anymore.
I've been getting quite worried about what our future will look like for data privacy. I think outright not running an LLM over your codebase to find critical security vulnerabilities because of your moral stance will keep us more insecure.
Please run an LLM over your code base if it's internet facing or something critical, we thank you!
Can't wait for the discussions on this!
@drwhax the thesis here seems to be that a new threat vector – LLM-based bad actors – puts otherwise stable systems at risk. The recommendation appears to be to employ these same LLMs in an attempt out flank the bad actors.
While I am not entirely opposed to well reasoned application of LLMs and associated tooling and harnesses to a problem, I question whether a strategy based on matching rather than one-upping the bad actors is a viable one.
There is certainly value in adapting the security model of many projects, but it’s less clear to me that simply “running an LLM” over a codebase is the answer.
-
I know Mastodon hates LLM's and AI. So here goes!
I recently got access to trusted access of cyber capabilities of both openai and anthropic, which also allows you to weaponize security vulnerabilities.
The speed at which these parrots can find bugs and be creative enough to exploit them is staggering.
I recently pointed an LLM at an kernel fix that was reachable by an unprivileged namespace on Debian and it fully weaponized it, without too much me prompting it in the right direction, in about 7-9 hours.
I don't think open-source and companies will know what's coming for them once these open-source weight models will have broader reach and get better at exploiting vulnerabilities on a massive scale as anyone can access them.
The bottom line I think is, you cannot patch faster than the attackers can easily chain all kinds of vulnerabilities together and just move laterally on an incredibly fast pace.
I've started reporting vulnerabilities to all kinds of projects and the majority have trouble or patching issues found. There's not enough maintainers, or there's simply none anymore.
I've been getting quite worried about what our future will look like for data privacy. I think outright not running an LLM over your codebase to find critical security vulnerabilities because of your moral stance will keep us more insecure.
Please run an LLM over your code base if it's internet facing or something critical, we thank you!
Can't wait for the discussions on this!
@drwhax Beware the "if it's internet facing or something critical": this line of thinking will bite you sooner than you think
-
@drwhax Beware the "if it's internet facing or something critical": this line of thinking will bite you sooner than you think
@monnier Anything else is also fine, it's a good first step
-
@drwhax the thesis here seems to be that a new threat vector – LLM-based bad actors – puts otherwise stable systems at risk. The recommendation appears to be to employ these same LLMs in an attempt out flank the bad actors.
While I am not entirely opposed to well reasoned application of LLMs and associated tooling and harnesses to a problem, I question whether a strategy based on matching rather than one-upping the bad actors is a viable one.
There is certainly value in adapting the security model of many projects, but it’s less clear to me that simply “running an LLM” over a codebase is the answer.
@kaleb I think it's a decent first step beyond, ideally we remove a ton of bug classes ala snufflepagus.
-
@mweiss @buherator @drwhax Totally, I'm pretty sure that risks that "end/pause business" will be addressed soon-ish. However, risks that are... less so, e.g., data loss, data privacy stuff, ... we'll just get used to it. Or the many downtimes of GitHub.
@ljrk @buherator @drwhax something changed around 2020 when businesses "learned" that these events weren't ending companies. And cyber insurance made that particular problem worse.
-
@zimzat No one wants to fund it is what I think.
Suhosin did something like this for PHP, now it's just jvoisin maintaining snufflepagus: https://github.com/jvoisin/snuffleupagus
I don't remember if there was something similar for other languages. Grsecurity for the Linux Kernel, that's the three I know
-
@em_and_future_cats @zimzat unfortunately less cute than Mr Snufflepagus: https://en.wikipedia.org/wiki/Mr._Snuffleupagus
-
@em_and_future_cats @zimzat unfortunately less cute than Mr Snufflepagus: https://en.wikipedia.org/wiki/Mr._Snuffleupagus
-
@SDRHoernchen Yes, I think this is a huge problem and it shows a huge gap. Sadly, I don't think this will be fixed as the line between offence and defence is too thin these days.
@drwhax Every time we could have software security we look the other way and find a reason not to have it, and now we have to bet on China and Kimi 3 et al because the western frontier models are not seen as tools to be used but perceived as dangers to a world of shitty software.
Imagine getting on a plane with the assumption that the wings are gonna fall off if suicidal passengers discover the missing nuts and bolts! The whole notion of that line is the problem when talking about software.
-
I know Mastodon hates LLM's and AI. So here goes!
I recently got access to trusted access of cyber capabilities of both openai and anthropic, which also allows you to weaponize security vulnerabilities.
The speed at which these parrots can find bugs and be creative enough to exploit them is staggering.
I recently pointed an LLM at an kernel fix that was reachable by an unprivileged namespace on Debian and it fully weaponized it, without too much me prompting it in the right direction, in about 7-9 hours.
I don't think open-source and companies will know what's coming for them once these open-source weight models will have broader reach and get better at exploiting vulnerabilities on a massive scale as anyone can access them.
The bottom line I think is, you cannot patch faster than the attackers can easily chain all kinds of vulnerabilities together and just move laterally on an incredibly fast pace.
I've started reporting vulnerabilities to all kinds of projects and the majority have trouble or patching issues found. There's not enough maintainers, or there's simply none anymore.
I've been getting quite worried about what our future will look like for data privacy. I think outright not running an LLM over your codebase to find critical security vulnerabilities because of your moral stance will keep us more insecure.
Please run an LLM over your code base if it's internet facing or something critical, we thank you!
Can't wait for the discussions on this!
@drwhax Blue team can't just throw an agent at a codebase, right now that will get them a bunch of false positives. Eventually, that triage will also get automated up to a certain point, but you maybe shouldn't be waiting for that.
-
I know Mastodon hates LLM's and AI. So here goes!
I recently got access to trusted access of cyber capabilities of both openai and anthropic, which also allows you to weaponize security vulnerabilities.
The speed at which these parrots can find bugs and be creative enough to exploit them is staggering.
I recently pointed an LLM at an kernel fix that was reachable by an unprivileged namespace on Debian and it fully weaponized it, without too much me prompting it in the right direction, in about 7-9 hours.
I don't think open-source and companies will know what's coming for them once these open-source weight models will have broader reach and get better at exploiting vulnerabilities on a massive scale as anyone can access them.
The bottom line I think is, you cannot patch faster than the attackers can easily chain all kinds of vulnerabilities together and just move laterally on an incredibly fast pace.
I've started reporting vulnerabilities to all kinds of projects and the majority have trouble or patching issues found. There's not enough maintainers, or there's simply none anymore.
I've been getting quite worried about what our future will look like for data privacy. I think outright not running an LLM over your codebase to find critical security vulnerabilities because of your moral stance will keep us more insecure.
Please run an LLM over your code base if it's internet facing or something critical, we thank you!
Can't wait for the discussions on this!
@drwhax I see your point. We do need to use AI to check the security of our products, simple because there is nothing else can possibly keep up.
However - it does make me wonder if this will kill the internet. Because it is impossible to keep applications safe. Whatever we do, the internet is unsafe.
Secondly - it makes me worry that people will have to rely on AI for all security matters, and not learn or remember how to code securely. And so the older security problems will return, because we will not know how to avoid them, and not code sensibly.
I am getting out, but it still scares me.
-
I know Mastodon hates LLM's and AI. So here goes!
I recently got access to trusted access of cyber capabilities of both openai and anthropic, which also allows you to weaponize security vulnerabilities.
The speed at which these parrots can find bugs and be creative enough to exploit them is staggering.
I recently pointed an LLM at an kernel fix that was reachable by an unprivileged namespace on Debian and it fully weaponized it, without too much me prompting it in the right direction, in about 7-9 hours.
I don't think open-source and companies will know what's coming for them once these open-source weight models will have broader reach and get better at exploiting vulnerabilities on a massive scale as anyone can access them.
The bottom line I think is, you cannot patch faster than the attackers can easily chain all kinds of vulnerabilities together and just move laterally on an incredibly fast pace.
I've started reporting vulnerabilities to all kinds of projects and the majority have trouble or patching issues found. There's not enough maintainers, or there's simply none anymore.
I've been getting quite worried about what our future will look like for data privacy. I think outright not running an LLM over your codebase to find critical security vulnerabilities because of your moral stance will keep us more insecure.
Please run an LLM over your code base if it's internet facing or something critical, we thank you!
Can't wait for the discussions on this!
@drwhax I don't hate machine learning, I find it very fascinating. What I hate is capitalism. I don't like it when ML models, whether LLMs, diffusion models, pattern recognition, whatever, are proprietary pieces of software I can't just copy or modify as I see fit. I hate software as a service, and that includes AI. I want to be able to run stuff on my own machine. I want to be able to train LoRAs for a machine learning model in order to teach it new abilities. I want my AI to run without an Internet connection, without an external computing centre, without censorship. And I want to decide when and for what I want to use it, and I don't want AI to be put into everything regardless whether if makes sense or not.
-
@drwhax Blue team can't just throw an agent at a codebase, right now that will get them a bunch of false positives. Eventually, that triage will also get automated up to a certain point, but you maybe shouldn't be waiting for that.
@t_var_s these new models are pretty good at a self adversarial review and writing PoC's. They do tend to cheat and there need to be options to flag false positives using some kind of harness, but that can be done.
-
@drwhax I don't hate machine learning, I find it very fascinating. What I hate is capitalism. I don't like it when ML models, whether LLMs, diffusion models, pattern recognition, whatever, are proprietary pieces of software I can't just copy or modify as I see fit. I hate software as a service, and that includes AI. I want to be able to run stuff on my own machine. I want to be able to train LoRAs for a machine learning model in order to teach it new abilities. I want my AI to run without an Internet connection, without an external computing centre, without censorship. And I want to decide when and for what I want to use it, and I don't want AI to be put into everything regardless whether if makes sense or not.
@LordCaramac we both hate capitalism dont get me wrong
-
@drwhax I see your point. We do need to use AI to check the security of our products, simple because there is nothing else can possibly keep up.
However - it does make me wonder if this will kill the internet. Because it is impossible to keep applications safe. Whatever we do, the internet is unsafe.
Secondly - it makes me worry that people will have to rely on AI for all security matters, and not learn or remember how to code securely. And so the older security problems will return, because we will not know how to avoid them, and not code sensibly.
I am getting out, but it still scares me.
@SteveClough it's only downhill from here
-
@em_and_future_cats I'm also a huge bird admirer so this is more fun
wrt
> I’m not a coder or understand much about coding&
birdssee also
" a gentle and humorous introduction to combinatory logic and the associated metamathematics, built on an elaborate ornithological metaphor.."
https://en.wikipedia.org/wiki/To_Mock_a_Mockingbird
"Combinatory logic, functionally equivalent to the lambda calculus, is a branch of symbolic logic having the expressive power of set theory, and with deep connections to questions of computability and provability. "
-
I know Mastodon hates LLM's and AI. So here goes!
I recently got access to trusted access of cyber capabilities of both openai and anthropic, which also allows you to weaponize security vulnerabilities.
The speed at which these parrots can find bugs and be creative enough to exploit them is staggering.
I recently pointed an LLM at an kernel fix that was reachable by an unprivileged namespace on Debian and it fully weaponized it, without too much me prompting it in the right direction, in about 7-9 hours.
I don't think open-source and companies will know what's coming for them once these open-source weight models will have broader reach and get better at exploiting vulnerabilities on a massive scale as anyone can access them.
The bottom line I think is, you cannot patch faster than the attackers can easily chain all kinds of vulnerabilities together and just move laterally on an incredibly fast pace.
I've started reporting vulnerabilities to all kinds of projects and the majority have trouble or patching issues found. There's not enough maintainers, or there's simply none anymore.
I've been getting quite worried about what our future will look like for data privacy. I think outright not running an LLM over your codebase to find critical security vulnerabilities because of your moral stance will keep us more insecure.
Please run an LLM over your code base if it's internet facing or something critical, we thank you!
Can't wait for the discussions on this!
@drwhax Fuck. Off. You're trying to justify the unjustifiable. Stop using LLMs.
-
@drwhax Fuck. Off. You're trying to justify the unjustifiable. Stop using LLMs.
@pip ok doei
-
-
@drwhax One thing I don't see anyone addressing is how we got into this situation in the first place, or how we get out of it, and I'm not talking about the LLM or any of the already well known and discussed downsides of that.
How did the software get so insecure in the first place? How do we prevent security vulnerabilities before they occur? Most of the risks aren't unknown or even novel, so why haven't we prioritized the solutions?
>How did the software get so insecure
or put another way
Q) how did mathematics get so incomplete?
....
godel probably ?see also :
