DrWhax

@zimzat No one wants to fund it is what I think.

Suhosin did something like this for PHP, now it's just jvoisin maintaining snufflepagus: https://github.com/jvoisin/snuffleupagus

I don't remember if there was something similar for other languages. Grsecurity for the Linux Kernel, that's the three I know :/

@alice_pea_3526 the parrots are pretty good at pattern recognition which is where I think they shine. Some smaller projects as well, but architecture wise, you'll have to handhold them a lot. Its almost like having a junior that's good in some incredibly niche things, but you'll be iterating a lot over code.

I think curl maintainer said something similar, the reports used to be bad from LLM's and they suddenly got a lot better. It still requires a pair of human eyes to understand if its not hallucinating.

I wish it was better at eliminating whole bug classes tho, that'd be the ideal situation?

@MossyQuartz I still think thats a good idea to this day :)

@em_and_future_cats I'm also a huge bird admirer so this is more fun :)

@MossyQuartz Apologies that this is just talking about computer vulnerabilities, but yes, you're right about risk modeling in the away from keyboard world!

@fabrice I replied about this here: https://infosec.exchange/@drwhax/116998200727608092

@koehntopp this parrot is really good at pattern recognition, it can code and fix some I think given enough constraints and a feedback loop of adversarial review, but it still might not be up to the style of the codebase or it might even introduce new vulnerabilities. I still think we also haven't it fully figured out yet? I think this needs more benchmarks that are reproducible in some fashion

@davidfstr I liked Halvar Flake's analogy, which i was sometimes a long the lines of, a bug every 10 years instead of 1 year. I think we can do a lot to prevent it, but there's always going to be bugs. I also think Mythos is way too hyped and these capabilities already exist in modern frontier models.

@SDRHoernchen Yes, I think this is a huge problem and it shows a huge gap. Sadly, I don't think this will be fixed as the line between offence and defence is too thin these days.

@Netraven I like Cloud Nothings - No Future, No Past song on this

@hajovonta Fair! I was just reading about a benchmark for this: https://www.scbench.ai/

@atraidez I think you're missing the point of my post, your anger is right and it's only downhill from here on out. It's also not going away, while people will also getting hurt with it if we don't find ways to patch whole classes of vulnerabilities. It's a perfect storm

@macattackmicmac yeah, it's pretty wild at the cost to be honest.

@edward I do think that's the case at the moment, cross-file vulnerabilities are sometimes not found. What I feel they're mostly good at is, pattern recognition, e.g, there's a specific bug class fixed from past git history that it found repeated or as a variant. After all, LLM's is just a stochastic parrot and it shows

@chroma yeah i'd also like a farm!

@failedLyndonLaRouchite They are, but they have flaws and the way these models are created is quite shit and there's a lot of things to say about that. It's not that I say, anthropic good, or openai good. It's more to say, we're entering an era with a lot of shit going to be thrown at people, companies and maintainers and I don't think people realize what's about to hit them!

@macattackmicmac for that particular session it was roughly 122 USD in API costs, but since it was subsidized, it was only $20 in a subscription: https://gist.github.com/DrWhax/465da154f2ac1575cfc72aa71aa979e6

@gimulnautti I think they already classify themselves as dual-use. which yes, I think is the right distinction

@catileptic No, I only pay a subscription myself and filled out two forms giving me access to a lessened guard rail LLM.

https://chatgpt.com/cyber?refresh_account=true

https://portal.anthropic.com/programs/cvp

I wanted access as at times I was hindered in reversing certain things on the non-cyber approved models. E.g forensic tooling :)

@rysiek once subsidy is gone, I don't think it makes a whole lot of sense, but, there might be advancements that tinnier models possible that are good enough at X or Y and then it's just hardware+electricity cost.