Hacker News Reader

Comment by ares623 | Hacker News Reader

Alternate headline: AI discovering so many exploits that cybersecurity can't keep up

Am I doing this right?

There is a difference between AI discovering real vulnerabilities (e.g. the ffmpeg situation), and AI being used to spam fake vulnerabilities

> the ffmpeg situation

How do you know that?

Because the vulnerability was published and it appeared real.

I’m sure AI also found real vulnerabilities on cURL.

My question is why you know cURL is being “spammed” but that FFMPEG is just getting legitimate problems.

> I’m sure AI also found real vulnerabilities on cURL.

The curl maintainer published the reports and they were very clearly not security vulnerabilities in curl.

> My question is why you know cURL is being “spammed” but that FFMPEG is just getting legitimate problems.

To put it bluntly, because i can read. Did you actually read the reports in question?

> because i can read

So you looked their the bug list and then the source code and found which issues were legitimate or someone did so on your behalf?

I read the specific examples that the maintainers of each project gave. The ones the ffmpeg maintainers complained about appeared to be real bugs. In fact i dont think the ffmpeg maintainers even dispute that. The ffmpeg maintainers after all fixed the issue in question. The ones the curl maintainers gave were clearly nonsense. The curl maintainers did not fix the issue because there was nothing to fix because the report didn't actually report anything that could be fixed because it made no sense.

Can you acknowledge you have limited information about the contents and quality of another projects bug reports?

It's easy to discover an exploit when you're hallucinating:)

Heh.

Lots of folks not getting the joke in this thread.

Perhaps i'm dense, what is the joke here?

Thank you

Is that the case?

The LLM models give the most likely respond to a prompt. So if you prompt it with "find security bugs from this code" it will respond with "This may be a security bug" than you "you fucking donkey this curl code has already been eyeballed by hundreds of people, you think a statistic model will find something new?"

Reply on news.ycombinator.com