The problem is that I do not believe a word that anthropic says. They say this is only 1%, but do they have any proof to back it up? I am also sceptical of the claim that it can "look at the entire repo and how it all works together". It can produce an approximation which could give it an advantage over more traditional fuzzers, but most reported bugs are still very local(and/or non-existant) and easily ruled out if it could actually model the naur theory behind the code.
anise
joined 5 months ago
The problem is that not "many actors" are able to attack at this scale, because running a scan at this scale is extremely expensive. If I were to run a thousand fuzzers on a piece of code I will almost certainly find a vulnerability, but I can't do that because of the prohibitive cost. Anthropic is essentially buying marketing by doing this to make their product seem more useful than it is.
It's really not. Out of the 23 000 something vulnerabilities claude claims to have discovered in open-source projects only 3-500 have been reported to repo owners,, only 65 have been confirmed and given any rating at all. This is not any more efficient than any other form of fuzzing, they just did a whole lot of it.
I love Asbestos, very gender design
though if a shop is high-effort enough this might make it interesting again, whereas ai-generated content is always low-effort
god has a type and that type perfectly matches the racist and sexist preferences of the modern age
around and about sorta. still no javascript tho
I do use links2 sometimes for looking things up on wikipedia or reading blogs or something like that, easier than starting a gui browser. but the usecase is a tad niche
no, that is exactly the issue. The fact that Andreas Kling is willing to interact with lunduke, dhh, and similar people on a semi-regular basis is not a great look.
hey, links2 is still alive and well, and there are now terminal browsers like chawan that can render images mostly correctly. There's also a few that are actually either chromium or gecko. avoid those.
doxxed by autocorrect
what word that fits would get corrected to aandrijving?
I'll see when these hashes materialise, until then I have to assume LLM companies are lying always about everything.
See, the problem is that I am not talking about human researchers, I am talking about other methods of automated fuzzing. I believe mozilla is overstating how useful the LLM has actually been. This has many reasons, one of them being that their main source of income is trying to become an LLM company. If that project fails said company might have to make some unfortunate cuts.