you are viewing a single comment's thread
view the rest of the comments
[–] 11 points 1 week ago* (9 children)

You wouldn't want him using a local model unless he was running some fancy rig that could run a high end frontier model. He might not have such a thing laying around. Using the best out there for something like this is how you help avoid bugs.

  • source
  • parent
  • hideshow 9 child comments
  • [–] 17 points 1 week ago (4 children)

    He gets paid more than enough to afford high end hardware.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 6 points 1 week ago* (2 children)

    He definitely can afford it yes, but its still a big ask to want someone to spend 15-25k or whatever it would be (shits getting more expensive by the day) to use a tool that he can just do pay per use. The code is open source so its not like he'd be using a local llm to keep it private.

  • source
  • parent
  • hideshow 2 child comments
    • AMD Ryzen Threadripper 9960X

    • GIGABYTE TRX50 AERO D Motherboard

    • Samsung SSD 9100 PRO 2TB SSD

    • Noctua NH-U14S TR5-SP6 Cooler

    • Intel Arc B580 GPU

    • Fractal Design Torrent E-ATX Case

    • Seasonic PRIME TX-1600 1600W 80+

    • Titanium PSU

    • ASUS ProArt Display PA32QCV 31.5" 6K

    • HDR Monitor

  • source
  • parent
  • [–] 9 points 1 week ago (3 children)

    Honestly, his mind and the community is probably one of the best things out there at the moment. They live the Linux Kernel, while that thing he used does not think or understand anything. Eh, it would be better if they moved with care instead, as that is a good way to avoid bugs too. I don't have a lot of faith in gassed up LLMs.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 3 points 1 week ago* (2 children)

    He's doing it though. So that's kind or moot. Fable is out there finding bugs in these things, so seems like if he is going to do it, using the thing that's already making it more secure by finding multiple exploits is the right choice of what to use.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 5 points 1 week ago (1 child)

    Fable is out there finding bugs in these things

    Ehh, that's debatable. An LLM will gladly spit out a vulnerability report, but as LLMs lack any understanding or reasoning capability, there's literally nothing guaranteeing that it has any semblance in fact or reality. They are just random text generators after all.

    Going by Anthropic's own numbers for things like Mythos, it "found" 29,439 vulnerabilities, when a human actually checked if the reports made any sense (ignoring validity) that dropped to around 6,200 reports, when they were tested for validity that further dropped to around 1,300 reports, and when it came time to actually patch the issues only 516 made the cut (i.e. the rest might have been issues, but weren't considered exploitable, etc.).

    516 out of 29,439 is a 1.75% success rate, not exactly groundbreaking.

    Now to be fair, according to Greg KH at a recent talk, Mythos is seemingly improving. Of 79 vulnerabilities it reported, a solid 4 were real. That's a 5% success rate, though it performed much better when it simply reported other developers bug fixes, something it did 11 times.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 1 week ago* (last edited 1 week ago)

    And how many security vulnerabilities have you found? 516 is still a lot. One of those had been in the Linux kernal for decades.

    Edit: and many of those real ones from the 6000 group anthropic says the maintainers just didn't want to fix as it was outside their threat model. A vulnerability in the Linux kernal, is different than one on an alarm clock app or something less serious.

    Edit: And for people that don't know, this decades old linux exploit wasn't just a single bug it found. It was able to piece together multiple smaller exploits that it found, that led to being able to exploit this bigger bug.

  • source
  • parent