Post #4161568
2026-07-28 10:56 UTC
Replies (27)
-
@buherator@infosec.place 2026-07-28 10:59
@drwhax@infosec.exchange Maybe the advice of the wiser among us will be heard after all these decades: focus on robust mitigations and attack surface reduction, because the moles can't be whacked anymore.
-
@can@haz.pink 2026-07-28 10:59
@drwhax@infosec.exchange do you have any pointers on *how* to run an LLM over the code base? Just tell Claude to "look for vulnerabilities" or is the process more elaborate?
-
@lain@lain.com 2026-07-28 11:23
@drwhax@infosec.exchange i have personally helped 3 different fediverse server projects by sharing exploits with them that LLMs found. Most software is full of holes. Running an LLM to hunt for bugs is good advice. If you're not doing it, someone else will.
-
@decapitae@mastodon.social 2026-07-28 11:27
@drwhax@infosec.exchange Using the stones to destroy the stones seems an unavoidable task
-
@hughsie@mastodon.social 2026-07-28 11:35
@drwhax@infosec.exchange a lot of us at Red Hat have been working at 100% for the last 6 months on basically this. I personally spend ~2h/day on AISLE and Mythos reports and getting fixes upstream.
-
@fnrd@toots.nu 2026-07-28 11:55
@drwhax@infosec.exchange It's not that you're wrong but you're not specific enough. Which AI, in what way? Plus, though I see you have enough technical expertise you come out with that OpenAI/Claude vibe that I detest. We should use LLMs, but in our own way, after stripping away the hype. All the LLM technobros have been stealing our code and other people's copyrighted work, and now want to sell it back to us with added bias, lack of provenance and old data. Excuse me if I'm not wildly enthusiastic about their for-profit products.
-
@whvholst@eupolicy.social 2026-07-28 12:13
@drwhax@infosec.exchange The laws of diminishing returns will kick in at some point. In the meantime, it is unlikely to be a smooth ride.
-
@glitchypixel@mastodon.gamedev.place 2026-07-28 12:15
@drwhax@infosec.exchange Look, many people have different reasons to be against AI. Mine is a very specific position against vibe coding, generative AI and ghoulish tech bros and their wannabes wanting to actively destroy excellence, art, nature and human work. If you have a tool that does not contradict these specifics, then I have no issue. A static analyser ML-like code tool that works on premises, doesn't make a tech bro richer and dry a lake? This is OK for me (and I suspect, the future or much of this)
-
@agowa338@chaos.social 2026-07-28 12:27
@drwhax@infosec.exchange > I think outright not running an LLM over your codebase to find critical security vulnerabilities because of your moral stance will keep us more insecure You're missing the point. Even strong "AI critics" have already been seen to use these tools for these scans themselves. Just like other static code analysis tools and so on. The main point and what people despise the most is when randoms use it and file bug reports they don't understand causing high workload validating their crap.
-
@png@yap.pony.biz 2026-07-28 11:17
@drwhax@infosec.exchange The bottleneck seems to be a lack of maintainers, so I don't really see how running LLMs on codebases will fix that. It'll take a maintainer to make the right decision based on LLM output and we're clearly running out of those :P
-
@gimulnautti@mastodon.green 2026-07-28 13:04
@drwhax@infosec.exchange Yes. As code robots LLM’s should not be underestimated. They lose to humans on depth, but beat us in breath, width and speed outright. They are weapons. First and foremost they should be thought of as weapons. 🤔
-
@failedLyndonLaRouchite@mas.to 2026-07-28 13:20
@drwhax@infosec.exchange the reality is that LLMs are incredibly powerful tools, but mastodon is so into reality denial and while denying reality, the same people make fun of Trump supporters for denying reality (eg vaccines don't cause autism) be funny it wasn't so sad
-
@edward@activitypub.ro 2026-07-28 13:14
@drwhax@infosec.exchange I think LLMs get the low hanging fruit of vulnerabilities, so you shouldn't trust an LLM's security audit as a definitive audit. As models get better, they'll catch higher up fruit, but still.
-
@macattackmicmac@mastodon.social 2026-07-28 13:19
@drwhax@infosec.exchange What would the estimated cost be for these 7-9 hours, assuming no more subsidies? Just looking for a rough ball park figure, as almost everything I've heard up till this point is that while the LLMs are effective, the cost is significant enough that you could be paying someone to do the work directly.
-
@atraidez@infosec.exchange 2026-07-28 13:50
@drwhax@infosec.exchange What will any of this matter when we have turned the planet into a desert and caused our own extinction level event? There is an assumption that we will have access to electricity for any of this conversation to matter; when every day people have to deal with over 100° hot weather, rolling black outs, and drinking water restricted for anyone not rich/wealthy? But let's keep protecting the people that made these problems and continue to make them worse. Justifying another technology built on theft and slave labor, I don't understand how anyone can be okay with that. We cannot separate the technology from its history, negative environmental impact, and that this technology is another scam to hoard even more wealth. The companies are using Enron's tactics for money and the packaging of debt into bad deals like 2008 in the USA is leading us to a very difficult time, where once again, these conversations will not matter as people will br trying to just survive.
-
@SDRHoernchen@chaos.social 2026-07-28 14:11
@drwhax@infosec.exchange You could patch faster but as the recent HF / OpenAI cyber attack stunt shows the big models and their cyber crap filters refuse to even talk to petty maintainers about security stuff, but will happily slopify code with myopic seds and greps. Case in point, even the Anthropic CVP does not apply to Fable, which writes code all the time that it can't review thanks to the zealous security filter, and is therefore useless where it would be needed most.
-
@davidfstr@mastodon.world 2026-07-28 14:39
@drwhax@infosec.exchange I've been very concerned about the emergence of Mythos-class AI that can weaponize vulns. I'm personally responding by adding formal memory safety proof coverage to critical libraries in C (notably: OpenSSL). Testing - which can identify many but not all bugs - I no longer consider sufficient. Instead we need formal verification to prove the *absence* of bugs/vulns. #aicoding #security
-
@koehntopp@infosec.exchange 2026-07-28 14:41
@drwhax@infosec.exchange If the imbalance between attack and defence is AI, why can't AI be used to make patches instead of exploits?
-
@MossyQuartz@social.vivaldi.net 2026-07-28 14:53
@drwhax@infosec.exchange I'm glad you've invited discussions on this, because my immediate thoughts and questions diverge from the discussion I'm primarily seeing here. When you mention vulnerabilities, yes you mention they exist in code as well as in projects. When I think of vulnerabilities, I think of the method I am using to make and maintain a record of something or else to achieve a goal or state of physical safety. For example, if my household accounting spreadsheets and forecasts are handwritten then the vulnerability is risk of loss if the dog eats them, but risk is mitigated when I keep an offline digital file. When a family member starts a small business, I ask the questions learnt in my accounting and auditing classes because I believe the risks involved include thinking about how to prevent losses of whatever is important. I only had a couple of classes in 1984, but it seemed to me that in those days the instructor felt we should understand the process so that we could consider risks. I now wonder if the machine-assisted searching allows you to consider the assorted practical situations of each business whose vulnerabilities are being sought.
-
@alice_pea_3526@mastodon.social 2026-07-28 15:47
@drwhax@infosec.exchange This may be one of the only niche use cases where LLM technology may actually be useful, and it may be what Linus Torvalds was talking about when it comes to AI and the Linux kernel. Directly deploying AI code in the kernel could violate the GPL. But as for auditing existing code for potential vulnerabilities, and the pen-testing stuff, this may be a viable use case. But that's not what the AI companies promote. They promote the AI-powered shovelware development use case instead.
-
@zimzat@mastodon.social 2026-07-28 16:05
@drwhax@infosec.exchange One thing I don't see anyone addressing is how we got into this situation in the first place, or how we get out of it, and I'm not talking about the LLM or any of the already well known and discussed downsides of that. How did the software get so insecure in the first place? How do we prevent security vulnerabilities before they occur? Most of the risks aren't unknown or even novel, so why haven't we prioritized the solutions?
-
@em_and_future_cats@mastodon.social 2026-07-28 17:36
@drwhax@infosec.exchange I also had a serious discussion with my husband this morning about llms and particularly genAi. What I took away from it was the data centers that we’re building now here are not efficient or ethical (imo) we need to make them efficient and ethical for security reasons. The vulnerability issue is immensely important here. While private companies are making Ai terrible and data centers by them are even worse, there needs to be more change in how it all works before we lose it altogether.
-
@LordCaramac@discordian.social 2026-07-28 20:14
@drwhax@infosec.exchange I don't hate machine learning, I find it very fascinating. What I hate is capitalism. I don't like it when ML models, whether LLMs, diffusion models, pattern recognition, whatever, are proprietary pieces of software I can't just copy or modify as I see fit. I hate software as a service, and that includes AI. I want to be able to run stuff on my own machine. I want to be able to train LoRAs for a machine learning model in order to teach it new abilities. I want my AI to run without an Internet connection, without an external computing centre, without censorship. And I want to decide when and for what I want to use it, and I don't want AI to be put into everything regardless whether if makes sense or not.
-
@pip@infosec.exchange 2026-07-28 20:51
@drwhax@infosec.exchange Fuck. Off. You're trying to justify the unjustifiable. Stop using LLMs.
-
@SpaceLifeForm@infosec.exchange 2026-07-28 22:45
@drwhax@infosec.exchange The smalker the codebase, and, the smaller the software stack, then fewer chaining exploit paths can posdibly exist. #KISS
-
@Netzblockierer@tech.lgbt 2026-07-28 23:50
@drwhax@infosec.exchange stop huffin' your own supply m8… https://infosec.exchange/@drwhax/116997238394916522
-
@castedo@mathstodon.xyz 2026-07-29 00:16
@drwhax@infosec.exchange > I've started reporting vulnerabilities to all kinds of projects and the majority have trouble or patching issues found. Is there a public example of such vulnerability you have reported that you can show us? I wonder if the majority of people reporting vulnerabilities by using Claude have trouble self-evaluating the quality of their reports.