Oh, maybe that's why "Claude" was substituted with "I", because Claude wrote this blog post from a first person perspective.
Research taste, among other things are still abilities that differentiate among humans.
In fact, I expect the elimination of other limiting factors by AI to lead to those becoming more important. By the same mechanism that make ugly hedge fund managers more performant.
The problem then is that composition of the top performers will change. Which is problematic since being a top performer ( ‘artist’, ‘researcher’, ‘writer’,..) is often an identity which ‘we often create to protect ourselves: the strong one who never breaks, the intelligent one who is always certain... The mask that once protected you can eventually become the cage that prevents you from changing’
You can hardly blame anyone for avoiding a clickthrough into an auth-walled, user-hostile site to read the point the headline made in an attempt to "gotcha"
I do have to send input to the thing to get a response, no?
What is your point?
No thank you says pretty much everyone.
Ah, but are you a member of the wondrous, gifted class? Right now, I have to do two things to get access to front line models, with any ability to look at code vulnerabilities. I have to fill out an application, and I have to give my ID to a US firm, Persona, which I will never do, for identity verification.
If you don't do these two things, you cannot use Claude to find that $90k bug.
And it got me to thinking, what might this pattern look like in a decade? Will there be two classes of people? Those that have access to certain types of LLMs, and therefore, are well-to-do? And, what if being well-to-do, makes it more likely you can get access to those certain LLMs?
I agree effort and prior knowledge are required, but a few magic words is like 80% of the effort.
This is the typical "ugh that's just rsync" when Dropbox was announced, but for a new LLM age.
_If it's so easy, do it_. Don't post about it. Do it. Fix these bugs at scale. Charge people money for it once you've built up a reputation. Get your own bug bounties.
Same old tired complaining about people not using technology correctly, or the way a _real_ coder would do it.
I also am wondering if Claude will proceed on a prompt which is about finding a bug like that? I am not sure, has anyone tried?
The cookie contained a pickle-serialized payload, "which was bad enough on its own." maybe not best practice but not bad on it's own
Flask session cookies are signed", not encrypted," so the... LLMs love to tell you what things aren't, as an emphasis on what they are
Pickle payload is a red flag precisely because pickle is not a safe serialisation format format when taken as untrusted input, here the input was trusted but it's still giving someone en easy escalation path (exactly what happened)
And most people would assume the whole cookie payload would be encrypted if they saw just a binary blob, and not realise you can fully read it if it's just signed
But, yes, the post was probably edited by an LLM, as is pretty much everything else you read online these days.
;)