not even half-way through this #curl release cycle we are already at 11 confirmed vulnerabilities - and there are three left in the queue to assess and new reports keep arriving at a pace of more than one/day
11 CVEs announced in a single release is our record from 2016 after the first-ever security audit (by Cure 53).
None of these used Mythos. (except for that single issue Mythos found of course.)
@bagder Did they use any other LLM to assist in the bug-finding (not the writeup or some other subsequent task)?
@christopherkunz *everyone* is using AIs to various degrees now
@bagder that's why I specifically asked for the role in the finding process. It would also be interesting to know which LLM found those bugs.
one of these vulns to be announced is also the new record holder for the oldest vuln ever found in curl...
@bagder ... yet lots of people are clinging on to your "Mythos only found one security issue" as "LLMs suck at finding vulnerabilities it's all hype!!!11" :/
That's on them, of course, not you.
@troed @bagder wouldn't it be helpful to add resources used to get such high numbers? What I mean is that if radically more resources (energy, money, time, etc) was used to get to that result then it's important to mention it to get a realistic picture.
I think "lots of people" are simply tired of marketing pieces that say "it changes everything" rather than "it's an interesting new way to do this kind of work, it's not perfect or free but it can be useful in this specific context", basically balanced viewpoint rather than sensationalist sale pieces.
someone asked me yesterday and yeah, this is the most intense period in #curl that I can remember ever been through
Install bonfire.cafe
Get the full app experience
