<unnamed>

Public Key

npub1q3nt0h5c99cdlwckxl7xc7u8lrgkzxhnwv48mffm85yky8cp4xwqrp4s72

Profile Code

nprofile1qqsqge4hm6vzjuxlhvtr0lrv0wrl35tprtehx2na55an6ztzruq6n8qpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0ds26n9j5

Publishing to

relay.damus.io

nos.lol

Last Notes

2026-04-21 11:21:34 CEST

I keep seeing bad takes that express hostility towards security bug finding whether by Project Zero or by LLMs.
It’s as if folks with these takes are ignoring two basic things:
1) Google and Anthropic didn’t put the bugs in your code. The known risks of memory-unsafe programming languages are hitting the fan.
2) Attacks that exploit memory-unsafety hurt _users_.
(Take an ffmpeg vulnerability: Chances are that YouTube’s back end is already isolated but VLC users could have a very bad time.)

2026-04-13 22:08:24 CEST

- reply

Also, it looks to me that fuzzing requires more human setup of what part of code to fuzz and how to deal with stuff like checksums whereas reportedly LLMs can deal with less specific harnesses and figure out how to fill in checksums.

2026-04-13 19:24:56 CEST

- reply

Then there’s the dismissal that, yes, LLMs now find security bugs, but the bugs could have been found by other methods. But evidently defenders hadn’t actually found them by other methods. (Unknown what attackers had already found.)
Or folks find it objectionable that the new capability has been made available to attackers and the proposed cure is to pay for access to the same LLM. But that does make the existence of the capability untrue.

2026-04-13 19:24:28 CEST

- reply

And, yes, the Anthropic Mythos post fits a previously-seen pattern of “AI” companies marketing by danger, but saying that it’s marketing does not refute what the models that are already generally offered can do.
And people act like their own conjecture is more informative than what people from multiple projects that deal with security bug reports say. See e.g. https://mastodon.social/@bagder/116363034479757682 .