I'm a little concerned about the general tech attitude towards the Mozilla bug findings.
-
I'm a little concerned about the general tech attitude towards the Mozilla bug findings. Yes, I'm an AI hater, so add that to the biases, but that's not really the point here.
People seem excited about the fact that Mythos was used to find a bunch of security bugs in Firefox, which is cool:
Behind the Scenes Hardening Firefox with Claude Mythos Preview – Mozilla Hacks - the Web developer blog
New details about what we found, and how agentic harnesses are now able to reproduce real bugs and dismiss false positives.
Mozilla Hacks – the Web developer blog (hacks.mozilla.org)
However, the general attitude seems to be that devs can keep pushing for more new things because some AI system will catch the bugs for them. But to me, there should be more concern about how there were so many previously unknown unfixed bugs in Firefox to begin with. These findings should be a cause for concern and give pause to evaluate how so many security bugs make it to prod. And I'm not just talking about Firefox, everyone should be learning from each other in this space.
If nothing else, people celebrating the LLM-fueled bug findings should be recognizing just how much harm the whole Move Fast and Break Shit approach really creates rather than allowing the LLMs to be the excuse to move faster and break more shit.
My hunch is that most of the bugs are/were only possible via specially crafted HTML that confused the parser.
-
I'm a little concerned about the general tech attitude towards the Mozilla bug findings. Yes, I'm an AI hater, so add that to the biases, but that's not really the point here.
People seem excited about the fact that Mythos was used to find a bunch of security bugs in Firefox, which is cool:
Behind the Scenes Hardening Firefox with Claude Mythos Preview – Mozilla Hacks - the Web developer blog
New details about what we found, and how agentic harnesses are now able to reproduce real bugs and dismiss false positives.
Mozilla Hacks – the Web developer blog (hacks.mozilla.org)
However, the general attitude seems to be that devs can keep pushing for more new things because some AI system will catch the bugs for them. But to me, there should be more concern about how there were so many previously unknown unfixed bugs in Firefox to begin with. These findings should be a cause for concern and give pause to evaluate how so many security bugs make it to prod. And I'm not just talking about Firefox, everyone should be learning from each other in this space.
If nothing else, people celebrating the LLM-fueled bug findings should be recognizing just how much harm the whole Move Fast and Break Shit approach really creates rather than allowing the LLMs to be the excuse to move faster and break more shit.
@cR0w The same thing is happening in the non-code space, with documents at work. People are generating reams of text and throwing it at colleagues, and a lot of it is wrong, but it takes more time to mark it wrong than it did to conjure up.
...and a lot of people are having trouble seeing why it's a problem.
It's allowing some people to pour champagne on themselves while externalizing the hard work to others.
-
@cR0w The same thing is happening in the non-code space, with documents at work. People are generating reams of text and throwing it at colleagues, and a lot of it is wrong, but it takes more time to mark it wrong than it did to conjure up.
...and a lot of people are having trouble seeing why it's a problem.
It's allowing some people to pour champagne on themselves while externalizing the hard work to others.
@DarcMoughty Yes! That's so maddening.
-
I'm a little concerned about the general tech attitude towards the Mozilla bug findings. Yes, I'm an AI hater, so add that to the biases, but that's not really the point here.
People seem excited about the fact that Mythos was used to find a bunch of security bugs in Firefox, which is cool:
Behind the Scenes Hardening Firefox with Claude Mythos Preview – Mozilla Hacks - the Web developer blog
New details about what we found, and how agentic harnesses are now able to reproduce real bugs and dismiss false positives.
Mozilla Hacks – the Web developer blog (hacks.mozilla.org)
However, the general attitude seems to be that devs can keep pushing for more new things because some AI system will catch the bugs for them. But to me, there should be more concern about how there were so many previously unknown unfixed bugs in Firefox to begin with. These findings should be a cause for concern and give pause to evaluate how so many security bugs make it to prod. And I'm not just talking about Firefox, everyone should be learning from each other in this space.
If nothing else, people celebrating the LLM-fueled bug findings should be recognizing just how much harm the whole Move Fast and Break Shit approach really creates rather than allowing the LLMs to be the excuse to move faster and break more shit.
@cR0w Usual Disclaimer: IANAP (Programming hobbyist at best, not a pro or an expert)
1.) Stands to reason that if the prior technique of "fuzzing" (another automated way of discovering bugs) has false positives, so will AI. In fact, I'd be surprised that it isn't a statistically significant number of false positives.
2.) Since Mozilla is all-in for AI and no longer interested in customers (except as cattle), Firefox's days are likely.longer behind it than ahead before it becomes an AI client for them. The brand is all they care about, not the users.
-
@cR0w Usual Disclaimer: IANAP (Programming hobbyist at best, not a pro or an expert)
1.) Stands to reason that if the prior technique of "fuzzing" (another automated way of discovering bugs) has false positives, so will AI. In fact, I'd be surprised that it isn't a statistically significant number of false positives.
2.) Since Mozilla is all-in for AI and no longer interested in customers (except as cattle), Firefox's days are likely.longer behind it than ahead before it becomes an AI client for them. The brand is all they care about, not the users.
@Tock Fuzzing is deterministic predictable, and reproducible. But yeah, I think there is a lot in tech ( and elsewhere ) that's about to come crumbling down.
-
@cR0w and burning down the engineering folks for the benefit of the sales and marketing folks.
in 2002 when i worked at websense, the sales department would often sell shit that didnt exist, and tech support got stuck being the folks to tell the people they were lied to, when they went searching for the features that didnt exist.
this is exactly the same thing, but a larger scale
-
@Tock Fuzzing is deterministic predictable, and reproducible. But yeah, I think there is a lot in tech ( and elsewhere ) that's about to come crumbling down.
@cR0w I'll testify.
-
@cR0w I'll testify.
@Tock I saw the URL and thought you were a chukar for a second. Treasure Valley Community College in OR uses the same acronym.
-
@Tock I saw the URL and thought you were a chukar for a second. Treasure Valley Community College in OR uses the same acronym.
@cR0w I wish. I'd love to be in Oregon.
-
@cR0w I wish. I'd love to be in Oregon.
@Tock Ontario isn't that different from Texas though. It's right on the ID border from Boise.
-
@Tock Ontario isn't that different from Texas though. It's right on the ID border from Boise.
@cR0w Ah, good point. I'd be trading mosquitoes for "insert local pest here", but because of Idaho, same MAGA neighbors, I'd take it?
-
@cR0w Ah, good point. I'd be trading mosquitoes for "insert local pest here", but because of Idaho, same MAGA neighbors, I'd take it?
@Tock That's the spirit. It's also home to Ore-Ida potatoes.
-
@troed The fact that they're tricky bugs to find supports my point that they should be using the findings to adjust engineering and dev efforts, not just bragging about their fancy new safety net.
@cR0w The only way to write software without security holes is to do formal proofs. When we design software that way, human coders will also be completely out of the loop.
I believe some industries will need to go in that direction, likely forced by laws, but the costs will be staggering compared to today.
-
I'm a little concerned about the general tech attitude towards the Mozilla bug findings. Yes, I'm an AI hater, so add that to the biases, but that's not really the point here.
People seem excited about the fact that Mythos was used to find a bunch of security bugs in Firefox, which is cool:
Behind the Scenes Hardening Firefox with Claude Mythos Preview – Mozilla Hacks - the Web developer blog
New details about what we found, and how agentic harnesses are now able to reproduce real bugs and dismiss false positives.
Mozilla Hacks – the Web developer blog (hacks.mozilla.org)
However, the general attitude seems to be that devs can keep pushing for more new things because some AI system will catch the bugs for them. But to me, there should be more concern about how there were so many previously unknown unfixed bugs in Firefox to begin with. These findings should be a cause for concern and give pause to evaluate how so many security bugs make it to prod. And I'm not just talking about Firefox, everyone should be learning from each other in this space.
If nothing else, people celebrating the LLM-fueled bug findings should be recognizing just how much harm the whole Move Fast and Break Shit approach really creates rather than allowing the LLMs to be the excuse to move faster and break more shit.
@cR0w And, of course, don't forget that bad actors have exactly the same access to exactly the same tools. To be secure, the devs need to find and patch every single bug. To perform bad actions, a blackhat only needs to discover one or two bugs. I consider the ability to quickly find a lot of bugs to be a net negative since patching them takes a lot longer than exploiting them.
-
R relay@relay.mycrowd.ca shared this topic
-
I'm a little concerned about the general tech attitude towards the Mozilla bug findings. Yes, I'm an AI hater, so add that to the biases, but that's not really the point here.
People seem excited about the fact that Mythos was used to find a bunch of security bugs in Firefox, which is cool:
Behind the Scenes Hardening Firefox with Claude Mythos Preview – Mozilla Hacks - the Web developer blog
New details about what we found, and how agentic harnesses are now able to reproduce real bugs and dismiss false positives.
Mozilla Hacks – the Web developer blog (hacks.mozilla.org)
However, the general attitude seems to be that devs can keep pushing for more new things because some AI system will catch the bugs for them. But to me, there should be more concern about how there were so many previously unknown unfixed bugs in Firefox to begin with. These findings should be a cause for concern and give pause to evaluate how so many security bugs make it to prod. And I'm not just talking about Firefox, everyone should be learning from each other in this space.
If nothing else, people celebrating the LLM-fueled bug findings should be recognizing just how much harm the whole Move Fast and Break Shit approach really creates rather than allowing the LLMs to be the excuse to move faster and break more shit.
@cR0w I see the analogy with road networks, and the cycle of building freeways to ease traffic followed by building far away developments causing more traffic. There is always a pressure to develop more software faster, tempered by the need to fix bugs and avoid catastrophic issues. If it becomes easier to root out bugs, more software gets done faster, for an increased supply of bug. Quasi-equilibrium.
-
@cR0w I see the analogy with road networks, and the cycle of building freeways to ease traffic followed by building far away developments causing more traffic. There is always a pressure to develop more software faster, tempered by the need to fix bugs and avoid catastrophic issues. If it becomes easier to root out bugs, more software gets done faster, for an increased supply of bug. Quasi-equilibrium.
@huitema Just like the road infra in the US, we're reaching the point where a lot of software is nearing a disaster in the near term.
-
@FritzAdalis @cR0w @en3py I can’t use Thunderbird (or any IMAP client) for email at work because Security hasn’t done an eval. But we can enable every MCP in sight.
-
@FritzAdalis @cR0w @en3py I can’t use Thunderbird (or any IMAP client) for email at work because Security hasn’t done an eval. But we can enable every MCP in sight.
-
@FritzAdalis @cR0w @en3py I love it, that’s terrible
-
R relay@relay.publicsquare.global shared this topic
-
@mahryekuh @cR0w this is also the canonical “trans women are so resilient!” picture btw
@crowbriarhexe @mahryekuh @cR0w Damn, this hit me hard.
