Henri Sivonen

Making Firefox load about:blank correctly

Web site: https://hsivonen.fi/
Twitter: https://twitter.com/hsivonen

Last Notes

2026-04-21 11:21:34 CEST

I keep seeing bad takes that express hostility towards security bug finding whether by Project Zero or by LLMs.
It’s as if folks with these takes are ignoring two basic things:
1) Google and Anthropic didn’t put the bugs in your code. The known risks of memory-unsafe programming languages are hitting the fan.
2) Attacks that exploit memory-unsafety hurt _users_.
(Take an ffmpeg vulnerability: Chances are that YouTube’s back end is already isolated but VLC users could have a very bad time.)

2026-04-13 22:08:24 CEST

- reply

Also, it looks to me that fuzzing requires more human setup of what part of code to fuzz and how to deal with stuff like checksums whereas reportedly LLMs can deal with less specific harnesses and figure out how to fill in checksums.

2026-04-13 19:24:28 CEST

- reply

And, yes, the Anthropic Mythos post fits a previously-seen pattern of “AI” companies marketing by danger, but saying that it’s marketing does not refute what the models that are already generally offered can do.
And people act like their own conjecture is more informative than what people from multiple projects that deal with security bug reports say. See e.g. https://mastodon.social/@bagder/116363034479757682 .

2025-02-24 14:33:15 CET

ISO isn’t that different from Elsevier: Others do the work without funding from them and then they put the result behind a paywall.
https://meshed.cloud/@webmink/114058954485365970

2025-01-17 21:33:45 CET

Our team (DOM Core) has an open position: https://www.mozilla.org/en-US/careers/position/gh/6527472/
Remote in any of Finland, Sweden, Denmark, Poland, Spain, Belgium, Netherlands, France, Germany, UK, Canada, or US.