<![CDATA[is it just me, or does the a. i. companies’ recent focus on automating exploit finding read as an “engage with us Or Else” ploy against the projects that wouldn’t take generated code contributions but can’t ignore security issues]]>is it just me, or does the a. i. companies’ recent focus on automating exploit finding read as an “engage with us Or Else” ploy against the projects that wouldn’t take generated code contributions but can’t ignore security issues

]]>https://board.circlewithadot.net/topic/a403eef4-93c9-4ff7-810d-e2aef6aa5ca0/is-it-just-me-or-does-the-a.-i.-companies-recent-focus-on-automating-exploit-finding-read-as-an-engage-with-us-or-else-ploy-against-the-projects-that-wouldn-t-take-generated-code-contributions-but-can-t-ignore-security-issuesRSS for NodeFri, 17 Apr 2026 09:45:04 GMTWed, 08 Apr 2026 01:43:49 GMT60<![CDATA[Reply to is it just me, or does the a. i. companies’ recent focus on automating exploit finding read as an “engage with us Or Else” ploy against the projects that wouldn’t take generated code contributions but can’t ignore security issues on Wed, 08 Apr 2026 13:30:27 GMT]]>@pozorvlak @joe

to be clear, if you believe openbsd has a lower defect rather than any other of the bsds, you're absolutely being taken for a ride

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/tef/statuses/116369327887022736https://board.circlewithadot.net/post/https://mastodon.social/users/tef/statuses/116369327887022736Wed, 08 Apr 2026 13:30:27 GMT<![CDATA[Reply to is it just me, or does the a. i. companies’ recent focus on automating exploit finding read as an “engage with us Or Else” ploy against the projects that wouldn’t take generated code contributions but can’t ignore security issues on Wed, 08 Apr 2026 13:27:29 GMT]]>@pozorvlak @joe alas, "secure programing in C" turns out to be more than just yelling at linux developers

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/tef/statuses/116369316221368430https://board.circlewithadot.net/post/https://mastodon.social/users/tef/statuses/116369316221368430Wed, 08 Apr 2026 13:27:29 GMT<![CDATA[Reply to is it just me, or does the a. i. companies’ recent focus on automating exploit finding read as an “engage with us Or Else” ploy against the projects that wouldn’t take generated code contributions but can’t ignore security issues on Wed, 08 Apr 2026 09:24:09 GMT]]>@tef @joe sure, but *every* new analysis technique finds a whole bunch of bugs at first and then levels off after a while. That said, I'm genuinely impressed at some of the things they've found - a 27yo 0day in OpenBSD? Wild.

]]>https://board.circlewithadot.net/post/https://mathstodon.xyz/users/pozorvlak/statuses/116368359410235514https://board.circlewithadot.net/post/https://mathstodon.xyz/users/pozorvlak/statuses/116368359410235514Wed, 08 Apr 2026 09:24:09 GMT<![CDATA[Reply to is it just me, or does the a. i. companies’ recent focus on automating exploit finding read as an “engage with us Or Else” ploy against the projects that wouldn’t take generated code contributions but can’t ignore security issues on Wed, 08 Apr 2026 03:40:57 GMT]]>@joe it’s finding real issues. Anything that finds real issues and costs money will feel like an “engage with us Or Else” situation

]]>https://board.circlewithadot.net/post/https://tech.lgbt/users/fay59/statuses/116367009845189820https://board.circlewithadot.net/post/https://tech.lgbt/users/fay59/statuses/116367009845189820Wed, 08 Apr 2026 03:40:57 GMT<![CDATA[Reply to is it just me, or does the a. i. companies’ recent focus on automating exploit finding read as an “engage with us Or Else” ploy against the projects that wouldn’t take generated code contributions but can’t ignore security issues on Wed, 08 Apr 2026 03:12:21 GMT]]>@tef @joe Which is: not fully true! Defenders get to define the territory, including audit and observability. Finding a vuln, developing an exploit — way too easy. Making it operational and maintaining the capability over time: somewhat to substantially more fraught. (Still way, way too easy, of course)

]]>https://board.circlewithadot.net/post/https://wandering.shop/users/fugueish/statuses/116366897394267665https://board.circlewithadot.net/post/https://wandering.shop/users/fugueish/statuses/116366897394267665Wed, 08 Apr 2026 03:12:21 GMT<![CDATA[Reply to is it just me, or does the a. i. companies’ recent focus on automating exploit finding read as an “engage with us Or Else” ploy against the projects that wouldn’t take generated code contributions but can’t ignore security issues on Wed, 08 Apr 2026 03:09:33 GMT]]>@fugueish @joe alas "they only have to get lucky once, we have to get lucky every time" is as true as it ever was

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/tef/statuses/116366886430804233https://board.circlewithadot.net/post/https://mastodon.social/users/tef/statuses/116366886430804233Wed, 08 Apr 2026 03:09:33 GMT<![CDATA[Reply to is it just me, or does the a. i. companies’ recent focus on automating exploit finding read as an “engage with us Or Else” ploy against the projects that wouldn’t take generated code contributions but can’t ignore security issues on Wed, 08 Apr 2026 02:30:35 GMT]]>@tef @joe I get you, and it's a reasonable note! But also, fuzzers do keep working (and we keep getting surprised all over again when someone makes a fuzzer that can reach a previously unreachable area).

]]>https://board.circlewithadot.net/post/https://wandering.shop/users/fugueish/statuses/116366733176186554https://board.circlewithadot.net/post/https://wandering.shop/users/fugueish/statuses/116366733176186554Wed, 08 Apr 2026 02:30:35 GMT<![CDATA[Reply to is it just me, or does the a. i. companies’ recent focus on automating exploit finding read as an “engage with us Or Else” ploy against the projects that wouldn’t take generated code contributions but can’t ignore security issues on Wed, 08 Apr 2026 02:19:36 GMT]]>@joe https://gist.github.com/sayrer/659bd4098045164ad9a003df449b6a81

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/sayrer/statuses/116366689964326987https://board.circlewithadot.net/post/https://mastodon.social/users/sayrer/statuses/116366689964326987Wed, 08 Apr 2026 02:19:36 GMT<![CDATA[Reply to is it just me, or does the a. i. companies’ recent focus on automating exploit finding read as an “engage with us Or Else” ploy against the projects that wouldn’t take generated code contributions but can’t ignore security issues on Wed, 08 Apr 2026 02:18:50 GMT]]>@fugueish @joe i'm not saying "it doesn't work" but "beware the low hanging fruit giving you false estimates about success rate"

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/tef/statuses/116366687008714495https://board.circlewithadot.net/post/https://mastodon.social/users/tef/statuses/116366687008714495Wed, 08 Apr 2026 02:18:50 GMT<![CDATA[Reply to is it just me, or does the a. i. companies’ recent focus on automating exploit finding read as an “engage with us Or Else” ploy against the projects that wouldn’t take generated code contributions but can’t ignore security issues on Wed, 08 Apr 2026 02:16:32 GMT]]>@fugueish @joe this was true of fuzzing before but i admit it is far more subsidized now

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/tef/statuses/116366677930116198https://board.circlewithadot.net/post/https://mastodon.social/users/tef/statuses/116366677930116198Wed, 08 Apr 2026 02:16:32 GMT<![CDATA[Reply to is it just me, or does the a. i. companies’ recent focus on automating exploit finding read as an “engage with us Or Else” ploy against the projects that wouldn’t take generated code contributions but can’t ignore security issues on Wed, 08 Apr 2026 02:01:26 GMT]]>@joe the "we found a local privesc in Linux" seemed particularly silly to tout... we have local privesc in Linux at home

]]>https://board.circlewithadot.net/post/https://jorts.horse/users/migratory/statuses/116366618586154227https://board.circlewithadot.net/post/https://jorts.horse/users/migratory/statuses/116366618586154227Wed, 08 Apr 2026 02:01:26 GMT<![CDATA[Reply to is it just me, or does the a. i. companies’ recent focus on automating exploit finding read as an “engage with us Or Else” ploy against the projects that wouldn’t take generated code contributions but can’t ignore security issues on Wed, 08 Apr 2026 02:00:48 GMT]]>@joe it absolutely comes across as a protection racket

]]>https://board.circlewithadot.net/post/https://hachyderm.io/users/aburka/statuses/116366616089311661https://board.circlewithadot.net/post/https://hachyderm.io/users/aburka/statuses/116366616089311661Wed, 08 Apr 2026 02:00:48 GMT<![CDATA[Reply to is it just me, or does the a. i. companies’ recent focus on automating exploit finding read as an “engage with us Or Else” ploy against the projects that wouldn’t take generated code contributions but can’t ignore security issues on Wed, 08 Apr 2026 02:00:26 GMT]]>@tef @joe They seem to avoid talking about solid defensive remedies (some of which LLMs likely will also be able to do well, such as translation and theorem proving — there are already results), for some reason. Until that strong medicine is applied, I think they'll continue producing new bugs and new kinds of bugs. Underestimating them is unwise for defenders. Keep in mind also they are military contractors.

]]>https://board.circlewithadot.net/post/https://wandering.shop/users/fugueish/statuses/116366614656808896https://board.circlewithadot.net/post/https://wandering.shop/users/fugueish/statuses/116366614656808896Wed, 08 Apr 2026 02:00:26 GMT<![CDATA[Reply to is it just me, or does the a. i. companies’ recent focus on automating exploit finding read as an “engage with us Or Else” ploy against the projects that wouldn’t take generated code contributions but can’t ignore security issues on Wed, 08 Apr 2026 01:47:19 GMT]]>@joe it's more "this is actually a thing it can do" i feel as fuzzing does produce results

but, well, after the burst of low hanging fruit, i don't expect a regular crop of bugs

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/tef/statuses/116366563036941307https://board.circlewithadot.net/post/https://mastodon.social/users/tef/statuses/116366563036941307Wed, 08 Apr 2026 01:47:19 GMT