#Mythos finds a #curl vulnerability

[0x0@hachyderm.io]

@quinn

Especially if it's subscription-based, as these models seem to be good at finding only specific sets of problems and then dry out, but even 10k per use is really gov or big corpo territory.

@kleisli @bagder

[redsakana@infosec.exchange]

@bagder This suggests a fun exercise for someone interested in messing around with LLMs:

1. Put back all the curl security issues previously found by LLM tools by dropping the fix commits from history or otherwise obfuscating the revert.

2. Feed the re-vulnerabilized repo to a selection of models and see what are the cheapest ones (by memory, time and/or monetary cost) that can find, say, 50%/75%/100% of the issues found by the warehouse-scale "foundation models".

Feels like a large part of the current results should be doable with significantly smaller resources, because being trained on every tweet and reddit post and libgen book ever is not obviously related to the task.

[eobet@oldbytes.space]

@bagder great, so even the Linux Foundation are naming things after the ultimate evil of a famous franchise? (Final Fantasy in this instance.)

[phl@mastodon.social]

@bagder “On average, every single production source code line of curl has been written (and then rewritten) 4.14 times.”

curl is the ship of Theseus not once, not twice, but four times

[4censord@unfug.social]

@gnirre @bagder with the most glancing of looks, looking at the 150 version of firefox (and some rounding),
curl: 200k lines of c
firefox:

• 5M lines of rust
• 9M lines of C and C++
• 200k lines of assembly
• 2M lines of python

so like, without looking at anything else, firefox is significantly bigger

[paco@infosec.exchange]

@km As far as I can tell:

• No one who has worked with raw Mythos output has ever written about it.
• No one who has written about it has ever used it.

They would much rather have @bagder writing about it because his opinion carries weight. That means he can’t have direct access. To give him access, they’d demand to gag him with an NDA, like everyone else who has access.

This technique of making readers mentally fill in the gaps between what is verifiable and what is claimed is genius marketing and really dishonest. But we have come to expect systematic and casual dishonesty from these companies.

[km@mastodon.babb.no]

@paco @bagder yeah, let me clarify: i talked with people who not themselves used mythos, but whose org was given access, so yeah, they just told something which they were told

[natanox@chaos.social]

@4censord @gnirre @bagder Also, didn't they intentionally disable all mitigations, sandboxing etc. in Firefox *and* include every teeny tiny bug it found (without mentioning the false-positives, which were probably a metric shit ton) to bolster those numbers?

There were lots of shenanigans afaik.

[paco@infosec.exchange]

@km Yeah. I didn’t mean it personally. I wasn’t criticising what you said, I’m sorry if I sounded that way.

I was just pointing out this constant theme. The only thing that ever is made public is the fully-polished, human-vetted final result. They carefully hide all other details and the press don’t care.

@bagder

[quinn@social.circl.lu]

@0x0 @kleisli @bagder to be clear i picked that number out of my butt, but it is clear to me that it's going to be very hard to make up their investment in it, much less than the min 10x (which would probably be a couple trillion dollars)

[rugk@chaos.social]

@das_robin @oots @bagder maybe @firefoxnightly can comment on that

[peteriskrisjanis@toot.lv]

@bagder ️this

[rootwyrm@weird.autos]

@bagder it's all marketing. And any improvements are completely moot, as the actual *costs* to find that single bug were in the tens of thousands of dollars minimum. That's the MINIMUM known cost.
It would not surprise me if finding that one bug cost $75k, $100k, $200k of compute time. It's a pile of shit, hilariously inefficient slop that sometimes behaves as a fuzzer that occasionally finds a crumb.

[totoroot@ibe.social]

@alterelefant@mastodontech.de @bagder@mastodon.social Are you a machine?
Classifying finding a single vulnerability (1) as success and 0 as failure sure seems like it
The world is not black and white and the usefulness of LLMs for finding vulnerabilities IMO isn't either

[alterelefant@mastodontech.de]

@totoroot
I admit it is very binary.
@bagder

[utf_7@mastodon.social]

@redsakana @bagder

llm tools found security issues in curl? doubt

[peteriskrisjanis@toot.lv]

@normis Normi, tu taču zini ka tas ir curl autors?

[uint8_t@chaos.social]

@das_robin @oots @bagder there was this blog post dismissing lots of the myth https://www.flyingpenguin.com/the-boy-that-cried-mythos-verification-is-collapsing-trust-in-anthropic/

[elgringomexicano@mastodon.social]

@bagder I picked 10 in the poll to play it safe, but 1 was my second choice and I'm not surprised at all. Long live #curl .

[mikemcquaid@mastodon.social]

@bagder This closely matches the experience Homebrew has also had with Mythos. Also one vulnerability found and in our case it was a pretty irrelevant one.