I'm a little concerned about the general tech attitude towards the Mozilla bug findings.
-
@Tock Ontario isn't that different from Texas though. It's right on the ID border from Boise.
@cR0w Ah, good point. I'd be trading mosquitoes for "insert local pest here", but because of Idaho, same MAGA neighbors, I'd take it?
-
@cR0w Ah, good point. I'd be trading mosquitoes for "insert local pest here", but because of Idaho, same MAGA neighbors, I'd take it?
@Tock That's the spirit. It's also home to Ore-Ida potatoes.
-
@troed The fact that they're tricky bugs to find supports my point that they should be using the findings to adjust engineering and dev efforts, not just bragging about their fancy new safety net.
@cR0w The only way to write software without security holes is to do formal proofs. When we design software that way, human coders will also be completely out of the loop.
I believe some industries will need to go in that direction, likely forced by laws, but the costs will be staggering compared to today.
-
I'm a little concerned about the general tech attitude towards the Mozilla bug findings. Yes, I'm an AI hater, so add that to the biases, but that's not really the point here.
People seem excited about the fact that Mythos was used to find a bunch of security bugs in Firefox, which is cool:
Behind the Scenes Hardening Firefox with Claude Mythos Preview – Mozilla Hacks - the Web developer blog
New details about what we found, and how agentic harnesses are now able to reproduce real bugs and dismiss false positives.
Mozilla Hacks – the Web developer blog (hacks.mozilla.org)
However, the general attitude seems to be that devs can keep pushing for more new things because some AI system will catch the bugs for them. But to me, there should be more concern about how there were so many previously unknown unfixed bugs in Firefox to begin with. These findings should be a cause for concern and give pause to evaluate how so many security bugs make it to prod. And I'm not just talking about Firefox, everyone should be learning from each other in this space.
If nothing else, people celebrating the LLM-fueled bug findings should be recognizing just how much harm the whole Move Fast and Break Shit approach really creates rather than allowing the LLMs to be the excuse to move faster and break more shit.
@cR0w And, of course, don't forget that bad actors have exactly the same access to exactly the same tools. To be secure, the devs need to find and patch every single bug. To perform bad actions, a blackhat only needs to discover one or two bugs. I consider the ability to quickly find a lot of bugs to be a net negative since patching them takes a lot longer than exploiting them.
-
R relay@relay.mycrowd.ca shared this topic
-
I'm a little concerned about the general tech attitude towards the Mozilla bug findings. Yes, I'm an AI hater, so add that to the biases, but that's not really the point here.
People seem excited about the fact that Mythos was used to find a bunch of security bugs in Firefox, which is cool:
Behind the Scenes Hardening Firefox with Claude Mythos Preview – Mozilla Hacks - the Web developer blog
New details about what we found, and how agentic harnesses are now able to reproduce real bugs and dismiss false positives.
Mozilla Hacks – the Web developer blog (hacks.mozilla.org)
However, the general attitude seems to be that devs can keep pushing for more new things because some AI system will catch the bugs for them. But to me, there should be more concern about how there were so many previously unknown unfixed bugs in Firefox to begin with. These findings should be a cause for concern and give pause to evaluate how so many security bugs make it to prod. And I'm not just talking about Firefox, everyone should be learning from each other in this space.
If nothing else, people celebrating the LLM-fueled bug findings should be recognizing just how much harm the whole Move Fast and Break Shit approach really creates rather than allowing the LLMs to be the excuse to move faster and break more shit.
@cR0w I see the analogy with road networks, and the cycle of building freeways to ease traffic followed by building far away developments causing more traffic. There is always a pressure to develop more software faster, tempered by the need to fix bugs and avoid catastrophic issues. If it becomes easier to root out bugs, more software gets done faster, for an increased supply of bug. Quasi-equilibrium.
-
@cR0w I see the analogy with road networks, and the cycle of building freeways to ease traffic followed by building far away developments causing more traffic. There is always a pressure to develop more software faster, tempered by the need to fix bugs and avoid catastrophic issues. If it becomes easier to root out bugs, more software gets done faster, for an increased supply of bug. Quasi-equilibrium.
@huitema Just like the road infra in the US, we're reaching the point where a lot of software is nearing a disaster in the near term.
-
@FritzAdalis @cR0w @en3py I can’t use Thunderbird (or any IMAP client) for email at work because Security hasn’t done an eval. But we can enable every MCP in sight.
-
@FritzAdalis @cR0w @en3py I can’t use Thunderbird (or any IMAP client) for email at work because Security hasn’t done an eval. But we can enable every MCP in sight.
-
@FritzAdalis @cR0w @en3py I love it, that’s terrible
-
R relay@relay.publicsquare.global shared this topic
-
@mahryekuh @cR0w this is also the canonical “trans women are so resilient!” picture btw
@crowbriarhexe @mahryekuh @cR0w Damn, this hit me hard.
-
I'm a little concerned about the general tech attitude towards the Mozilla bug findings. Yes, I'm an AI hater, so add that to the biases, but that's not really the point here.
People seem excited about the fact that Mythos was used to find a bunch of security bugs in Firefox, which is cool:
Behind the Scenes Hardening Firefox with Claude Mythos Preview – Mozilla Hacks - the Web developer blog
New details about what we found, and how agentic harnesses are now able to reproduce real bugs and dismiss false positives.
Mozilla Hacks – the Web developer blog (hacks.mozilla.org)
However, the general attitude seems to be that devs can keep pushing for more new things because some AI system will catch the bugs for them. But to me, there should be more concern about how there were so many previously unknown unfixed bugs in Firefox to begin with. These findings should be a cause for concern and give pause to evaluate how so many security bugs make it to prod. And I'm not just talking about Firefox, everyone should be learning from each other in this space.
If nothing else, people celebrating the LLM-fueled bug findings should be recognizing just how much harm the whole Move Fast and Break Shit approach really creates rather than allowing the LLMs to be the excuse to move faster and break more shit.
@cR0w LLM chatbots are not fit for this purpose, or any purpose; if this was being done with purpose-built ML tools thatd be a different story, but all i see is an overblowing of hype around a horribly unethical “tool” that ensnares developers that have no ethics and additionally voids their qualifications to use their brains
-
I'm a little concerned about the general tech attitude towards the Mozilla bug findings. Yes, I'm an AI hater, so add that to the biases, but that's not really the point here.
People seem excited about the fact that Mythos was used to find a bunch of security bugs in Firefox, which is cool:
Behind the Scenes Hardening Firefox with Claude Mythos Preview – Mozilla Hacks - the Web developer blog
New details about what we found, and how agentic harnesses are now able to reproduce real bugs and dismiss false positives.
Mozilla Hacks – the Web developer blog (hacks.mozilla.org)
However, the general attitude seems to be that devs can keep pushing for more new things because some AI system will catch the bugs for them. But to me, there should be more concern about how there were so many previously unknown unfixed bugs in Firefox to begin with. These findings should be a cause for concern and give pause to evaluate how so many security bugs make it to prod. And I'm not just talking about Firefox, everyone should be learning from each other in this space.
If nothing else, people celebrating the LLM-fueled bug findings should be recognizing just how much harm the whole Move Fast and Break Shit approach really creates rather than allowing the LLMs to be the excuse to move faster and break more shit.
@cR0w Browsers are a bit interesting in terms of defining what actually is a security vulnerability. A modern browser's job is to download untrusted code from probably malicious people, run it, and not let them gain access to the host system. As a result, browsers (Firefox was late to the party by a very long time here, but they've done some very interesting work recently in this space) are some of the most aggressively compartmentalised software that exists. This means that most vulnerabilities in a browser are not exploitable by themselves, you need to chain a bunch of them together.
I suspect there's some psychological effect here, that when you're writing code that you know runs sandboxed, you aren't quite as careful as you would normally be. But there's also a real effect that a lot of the vulnerabilities matter only as step 1 in a chain of several to get to any real kind of compromise that a user would care about.
-
@cR0w Browsers are a bit interesting in terms of defining what actually is a security vulnerability. A modern browser's job is to download untrusted code from probably malicious people, run it, and not let them gain access to the host system. As a result, browsers (Firefox was late to the party by a very long time here, but they've done some very interesting work recently in this space) are some of the most aggressively compartmentalised software that exists. This means that most vulnerabilities in a browser are not exploitable by themselves, you need to chain a bunch of them together.
I suspect there's some psychological effect here, that when you're writing code that you know runs sandboxed, you aren't quite as careful as you would normally be. But there's also a real effect that a lot of the vulnerabilities matter only as step 1 in a chain of several to get to any real kind of compromise that a user would care about.
@david_chisnall That's fair, but to my point, it seems like if there is awareness of that whole idea that the main issue is dev attitude, finding out that a bunch of vulns made it to prod seems like the perfect opportunity to address that rather than just be happy there's a new bug finder that will very quickly hit a wall in its effectiveness.
-
@david_chisnall That's fair, but to my point, it seems like if there is awareness of that whole idea that the main issue is dev attitude, finding out that a bunch of vulns made it to prod seems like the perfect opportunity to address that rather than just be happy there's a new bug finder that will very quickly hit a wall in its effectiveness.
@cR0w For comparison, Chromium averages one vulnerability every 1.5 days. The Linux kernel is similar.
So, yes, I think this is a problem, but it's far from specific to Firefox. Most programming practices came from a time when most software never operated on untrusted data. People are still taught to program as if that were true today.
-
@cR0w For comparison, Chromium averages one vulnerability every 1.5 days. The Linux kernel is similar.
So, yes, I think this is a problem, but it's far from specific to Firefox. Most programming practices came from a time when most software never operated on untrusted data. People are still taught to program as if that were true today.
@david_chisnall Oh I don't mean to imply it's a Firefox-specific issue. Firefox happened to be the one in the article but it absolutely should be an example for all projects to take a step back and reevaluate rather than keep pushing forward and hoping the AI saves them. I don't know the internal discussions around Firefox but the way it's been portrayed in the articles I've read has been that devs can now lean harder on LLMs finding their bugs after the fact rather than preventing them in the first place.
-
I'm a little concerned about the general tech attitude towards the Mozilla bug findings. Yes, I'm an AI hater, so add that to the biases, but that's not really the point here.
People seem excited about the fact that Mythos was used to find a bunch of security bugs in Firefox, which is cool:
Behind the Scenes Hardening Firefox with Claude Mythos Preview – Mozilla Hacks - the Web developer blog
New details about what we found, and how agentic harnesses are now able to reproduce real bugs and dismiss false positives.
Mozilla Hacks – the Web developer blog (hacks.mozilla.org)
However, the general attitude seems to be that devs can keep pushing for more new things because some AI system will catch the bugs for them. But to me, there should be more concern about how there were so many previously unknown unfixed bugs in Firefox to begin with. These findings should be a cause for concern and give pause to evaluate how so many security bugs make it to prod. And I'm not just talking about Firefox, everyone should be learning from each other in this space.
If nothing else, people celebrating the LLM-fueled bug findings should be recognizing just how much harm the whole Move Fast and Break Shit approach really creates rather than allowing the LLMs to be the excuse to move faster and break more shit.
@cR0w modern browsers are too complex (literally more so than some entire operating systems) and are becoming essentially unmaintainable and unsafe as they are pushing more and more features over security. browsers are generally the biggest attack surface for the vast majority of users, so security should be the number 1 priority and it isn't and hasn't been for a while.
-
@cR0w modern browsers are too complex (literally more so than some entire operating systems) and are becoming essentially unmaintainable and unsafe as they are pushing more and more features over security. browsers are generally the biggest attack surface for the vast majority of users, so security should be the number 1 priority and it isn't and hasn't been for a while.
@cR0w we don't need browsers to be the everything application with 50 million features and they should stop trying to be that. we also don't need operating systems to be as bloated and buggy as they are getting but that's another conversation.
-
@cR0w modern browsers are too complex (literally more so than some entire operating systems) and are becoming essentially unmaintainable and unsafe as they are pushing more and more features over security. browsers are generally the biggest attack surface for the vast majority of users, so security should be the number 1 priority and it isn't and hasn't been for a while.
-
I'm a little concerned about the general tech attitude towards the Mozilla bug findings. Yes, I'm an AI hater, so add that to the biases, but that's not really the point here.
People seem excited about the fact that Mythos was used to find a bunch of security bugs in Firefox, which is cool:
Behind the Scenes Hardening Firefox with Claude Mythos Preview – Mozilla Hacks - the Web developer blog
New details about what we found, and how agentic harnesses are now able to reproduce real bugs and dismiss false positives.
Mozilla Hacks – the Web developer blog (hacks.mozilla.org)
However, the general attitude seems to be that devs can keep pushing for more new things because some AI system will catch the bugs for them. But to me, there should be more concern about how there were so many previously unknown unfixed bugs in Firefox to begin with. These findings should be a cause for concern and give pause to evaluate how so many security bugs make it to prod. And I'm not just talking about Firefox, everyone should be learning from each other in this space.
If nothing else, people celebrating the LLM-fueled bug findings should be recognizing just how much harm the whole Move Fast and Break Shit approach really creates rather than allowing the LLMs to be the excuse to move faster and break more shit.
@cR0w Looking at *what* the LLM found, I think it shows they actually were on the right path already.
Many of these are memory corruption problems, which are eliminated by migrating to Rust, and can be mitigated by using established hardening techniques, both of which they have already been doing for a long time.
It's a codebase with a 30 year history and a limited set of people who dare understand it enough to do security audits. These LLMs are basically fresh eyes.
-
@cR0w Looking at *what* the LLM found, I think it shows they actually were on the right path already.
Many of these are memory corruption problems, which are eliminated by migrating to Rust, and can be mitigated by using established hardening techniques, both of which they have already been doing for a long time.
It's a codebase with a 30 year history and a limited set of people who dare understand it enough to do security audits. These LLMs are basically fresh eyes.
@cR0w Most old/large codebase will now get audits they didn't get before, resulting in a wave of bugs found by AI. But any code base can only contain a limited number of bugs.
