Microsoft Is Struggling to Fix Them Fast Enough.

Microsoft has always been struggling to fix their own bugs fast enough.

Yeah, I can already find more bugs than can be fixed on schedule just by looking in the Jira backlog.

The Open Source epidemic, people.

The Epsteins and their Corps seem to be organizing/manipulating the information sphere to create fear/hype around their top models. It seem to be centrally coordinated and different US tech Corps/players enters and leave. We keep getting either exaggerated/fake or ‘woopsie’ security narratives thrown at us.

The normal purpose is to create fear/anger before a false-flag operation, so we’ll likely see many claims about AI-hacking and a single great hit (the flag) against the Merican people, that will point towards one of the nations that the US/Epsteins have manufactured consent to attack - likely Iran. Old playbook stuff with a new topic…

Wild that so many people are still stuck believing the information from the Epstein class’ owned information sphere.

…on the other hand, I wouldn’t want to BE the Epstein class when ~250M Mericans finally discover they got mind-raped for their entire lives…

Can anybody help me understand the threat of these advanced models once the public and adversaries have access to them? I understand they can find software bugs and vulnerabilities and I get that US tech companies are using it to make their software more secure, but all of these companies have the benefit of their source code being available as an input to the model. Everybody else only has compiled binaries. Do the bad guys use the models to decompile or reverse engineer the code first?

Yes, and AI probably helps with that.

• There are common techniques that can be used broadly to get results with LLMs.
• Some source code is floating around out there, like it is mentioned in the article.
• Yes, decompilation techniques are something that cannot be prevented and are sped up by LLMs.
• There are only so many devs patching bugs, while there might be millions trying to break in - they mentioned the chaining of multiple “low"-priority bugs to escalate the severity, and if you need months to even get the really dangerous stuff fixed, it’s a free-for-all bonanza as soon as those models hit the public, and these people don’t even need to know anything about cybersecurity - Joe Shmoe can tell Mythos to “go hack Onedrive” and that’s all that is needed from Joe Shmoe.

One threat: people using the models are finding bugs and the more rare exploits at a much faster rate than before, perhaps 10x. This means that zero-day exploits are coming into the hands of the kinds of people who use them for bad purposes about 10x faster than they used to. It also means the white hats are creating these CVEs faster and people addressing the CVEs are able to do so faster, with the same manpower… so… if either side slows down, it will shift the balance we currently have toward their opponents.

That’s why you have AI to fix the bugs as soon as you find them. Unless those LLM are just not as good as advertised. Then it’s a strange message to put out there.

I’ve had a subscription to Anthropic/Claude for a bit over 8 months now, and I just added Google’s Gemini Pro - While Gemini today is a bit better than Claude was last November, it’s far far behind where Claude is now.

Aren’t microsoft products half vibe coded at this point anyway? Look at all these fires I put out, says fireman with trunk full of flares and gasoline.

Certainly seems that way.

There’s a new bug or eminently shitty feature almost every day, or at least it seems that way.

microsoft products half vibe coded

They have a long tradition of not mastering the huge complexity of their own software. Deep security flaws, broken updates, degrading performance etc. are well known companions on any M$ user’s journey.

The vibe coding has mostly added speed to the problem, but not changed the principle itself.

Tiny little example: Azure DevOps supports ssh key access, but only the old - now considered insecure/inadvisable for continued use - RSA ssh keys.

Their priorities for providing that kind of convenient secure access lie elsewhere, in activities that generate more revenue for them.

Fuck Anthropic. They buy used books and put them through a shredder to train Claude.

Aren’t they legally mandated to do that when they scan books? That way the amount of copies doesn’t go up technically.

Also unfortunately it’s easier to scan without the bindings.

I do hope the paper gets recycled at least.

Also unfortunately it’s easier to scan without the bindings.

We’re just a poor, nearly trillion dollar company! How can you possibly expect us to preserve these rare copies of culturally significant books when it’s slightly easier for us to just destroy them altogether? 🥺🥺🥺

I’m pretty sure they buy those books by the pound (or tonne), ain’t nobody giving them rare copies of culturally significant books to destroy lol

Yeah, sure. Everyone throwing out old books is knowledgeable enough to know and willing enough to check that the book they’re throwing isn’t rare or important.

You’d think people would check on the off chance it’s worth a bunch but you’d be surprised.

AI slop kettle calls AI slop pot black.

While these models can find more bugs, it seems that these bugs do not convert to exploits to a higher rate than before

It seems to me that they’re converting at about the same percentage rate bugs->exploits as before, they’re just getting a lot more press than the old bug reports did.

this type of thing really shows llm’s to me. its great at creating this busy work but not so much with fixing it. so it can find them and we know microsoft is all in on ai coding, but it does not seem to help fixing them quickly. they are spending so much money to muck things up more and make more expense.

That’s not what they’re saying. They’re saying llms are getting so good at revealing vulnerabilities that they have to put focus and effort on finding and fixing them before external malicious actors do.

Yeah it’s faster to find a bug than to refactor a whole codebase to fix it, they’re still using llms to speed up fixing the bugs. If you believe them, anyway.

I do. Their software stacks were so shit and bloated and had many owners with different visions and understanding of what code does what and why and they rely on being closed source to survive penetration, I do believe llms are finding vulnerabilities left and right, and focused refactoring to address legacy human slop can take time, even for a super competent llm that does it correctly in one shot.

they rely on being closed source to survive penetration

M$ always has.

But even open source relied a great deal on the volume and complexity of their code base to survive penetration… until now.

its great at creating this busy work but not so much with fixing it

Actually, if you know what needs fixing, LLMs can accelerate the fixing process quite a bit too.

The problem is: LLMs don’t know what they don’t know, so they’ll declare “good enough” and it’s up to the LLM operator to call BS and give them additional context to ensure they keep going until ALL the applicable concerns are addressed.

Finding the problems alone can be a hell of a useful tool. Doubly so when you have decades of tech debt and a mess of a project.

It’s also proving the point that a lot of people hate to admit is right. That if you just flag every bug in vulnerability out to everyone everywhere immediately and you don’t hide it behind bureaucracy in Goodwill.

Then it actually forces people to fix things. Cuz you either fix things or you go under.

Companies have gotten so used to scaring and threatening people into hiding vulnerabilities for so long that it’s become normalized. It lets bad practices and insecurities flourish and multiply.

You either fix your s*** or you don’t have problems in the first place. Those are your two options now. No more of this b******* hiding.

This whole software bug spiel is to convince everyone that it is unsafe to code without using an LLM. Effectively forcing companies to use LLMs.

It it is unsafe to code, full stop.

The things we’re expecting our code to handle, with the lack of formal verification testing we’re expecting our code to ship with, there’s no such thing as safe. It took 50 years to “build the stack” to where we’re at, and we did it fast and cheap. There’s so many bugs hiding in the lasagna it’s amazing it doesn’t eat itself.

If you re-build your system from first principles, open source silicon with peer review and constant scrutiny, then the BIOS, then the OS, then the application compilers, and the libraries, all open AND reviewed by multiple concerned parties with formal demonstration of correctness all the way up - the entrenched bug filled lasagna stack owners will smother you, they can’t withstand that kind of competition on an open playing field, your project will die of financial starvation, regulation, buyouts and treachery.

All the shortcut technical debt is coming due, especially now that there’s a tool able to undertake mass analysis with fairly general rules.

It’s getting bad out there, and it’s not visible on the surface but a tsunami of bug reports and patches has been sweeping the internet and drowning anything unable to swim.

For anything that sinks underwater, metaphorically, they’re getting grabbed by automated sharks that are now actively on the attack. If you’re not rapidly fixing everything and monitoring everything closely you’re probably being eaten alive without knowing.

My approach: I don’t expose anything (that can’t handle it) to the internet. So so many things are “out there” that don’t need to be, shouldn’t be…

Bragging about how product is at doing something is the easiest way to advertise product. No conspiracy theories needed.

They want you to use their LLM to screen your code for bugs. When you do that, you see how surprisingly well it works now and that leads to you wanting to also use it for generating code. That is when you realize that the 20 bucks starter subscription isn’t enough to actually use it professionally… which means, you upgrade and they get moar money.

Didn’t they use LLMs to code Win11 though?

No, win 11 development started before the slopification but at this point it does have a lot of ai work in it.

So you do still need to be rather specific to what parts your talking about.

Please, it’s windows 11, and I’m just some dude on the Internet - I can slander the shit out of that AI slop fest.

I’ve said this a million times. The llms are not better, than us they are infinatly faster. It’s like putting 1000 engineers full time on looking for vulnerabilities for 10 years. Sure you can do that. Or pay for the tokens instead and do the same effort overnight.

Yep and even 1000 engineers with 10 years of time is still going to be wrong a hell of a lot. But that doesn’t matter. Even a tiny fraction of the bugs found being being real is enough to over load and flood out most projects.

Llms don’t have to be 100% right, even at 10% right there’s still too many bugs to fix. Decades of tech debt is being called in. And ain’t no body is ready for it.

Sounds like Microsoft needs to hire some people…

In the end, LLM’s will find and fix those same bugs autonomously, people will do the final sign off and software will be simultaneously more secure and less secure as software continues to be tested worldwide wide

Microsoft being slow to fix bugs isn’t news.

remember when their servers were still vulnerable 20 years later… to a virus written in the 1990s/2000s all because they never updated their own systems?

We’re talking about Microsoft here so I think it’s probably found three bugs do which will already reported.

LLMs probably created a lot of these bugs in the first place.

Your giving microshit too much credit. Windows is a house of cards held together with duct tape.

It’s gotten worse with slop, but it was never great to start with.