all 3 comments

sorted by: hot top controversial new old
[–] 20 points 3 months ago

One slide in that day’s presentation showed that in April alone, Mythos had uncovered 90 “critical” bugs and 141 “important” ones in SharePoint, Microsoft’s widely used collaboration software. In the first half of May it found even more.

If an organization the size of Microsoft is struggling to fix 231 bugs in a month, that's an indictment of Microsoft, not an example of some impossible task. Tech companies have been laying off people left and right and this is a threat to their core business. Most of these shouldn't be more than adding some input checking.

  • source
  • [–] 10 points 3 months ago

    Microsoft: "Why is our AI so inferior? We trained it on the entire private code base for Windows and Teams!"

  • source
  • [–] 6 points 3 months ago

    But.. but... I thought closed source was more secure!

  • source
  • 26 comments in c/technology@lemmy.world view that post
    [–] 62 points 3 months ago (1 child)

    Aren't microsoft products half vibe coded at this point anyway? Look at all these fires I put out, says fireman with trunk full of flares and gasoline.

  • source
  • hideshow 1 child comment
  • [–] 22 points 3 months ago (5 children)

    This whole software bug spiel is to convince everyone that it is unsafe to code without using an LLM. Effectively forcing companies to use LLMs.

  • source
  • hideshow 5 child comments
  • [+] 9 points 3 months ago
    [removed by mod]
  • source
  • parent
  • [–] 1 point 3 months ago (-1 children)

    All the shortcut technical debt is coming due, especially now that there's a tool able to undertake mass analysis with fairly general rules.

    It's getting bad out there, and it's not visible on the surface but a tsunami of bug reports and patches has been sweeping the internet and drowning anything unable to swim.

    For anything that sinks underwater, metaphorically, they're getting grabbed by automated sharks that are now actively on the attack. If you're not rapidly fixing everything and monitoring everything closely you're probably being eaten alive without knowing.

  • source
  • parent
  • hideshow -1 child comments
  • load more comments (-1 replies)
  • [–] 3 points 3 months ago

    Bragging about how product is at doing something is the easiest way to advertise product. No conspiracy theories needed.

    They want you to use their LLM to screen your code for bugs. When you do that, you see how surprisingly well it works now and that leads to you wanting to also use it for generating code. That is when you realize that the 20 bucks starter subscription isn't enough to actually use it professionally... which means, you upgrade and they get moar money.

  • source
  • parent
  • [–] 1 point 3 months ago (2 children)

    Didn't they use LLMs to code Win11 though?

  • source
  • parent
  • hideshow 2 child comments
  • load more comments (-2 replies)
    [–] 21 points 3 months ago (-1 children)

    That's why you have AI to fix the bugs as soon as you find them. Unless those LLM are just not as good as advertised. Then it's a strange message to put out there.

  • source
  • hideshow -1 child comments
  • load more comments (-1 replies)
    [–] 20 points 3 months ago (4 children)

    Fuck Anthropic. They buy used books and put them through a shredder to train Claude.

  • source
  • hideshow 4 child comments
  • [–] 3 points 3 months ago (3 children)

    Aren't they legally mandated to do that when they scan books? That way the amount of copies doesn't go up technically.

    Also unfortunately it's easier to scan without the bindings.

    I do hope the paper gets recycled at least.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 3 points 3 months ago (2 children)

    Also unfortunately it's easier to scan without the bindings.

    We're just a poor, nearly trillion dollar company! How can you possibly expect us to preserve these rare copies of culturally significant books when it's slightly easier for us to just destroy them altogether? 🥺🥺🥺

  • source
  • parent
  • hideshow 2 child comments
  • [–] 2 points 3 months ago (1 child)

    I'm pretty sure they buy those books by the pound (or tonne), ain't nobody giving them rare copies of culturally significant books to destroy lol

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 3 months ago

    Yeah, sure. Everyone throwing out old books is knowledgeable enough to know and willing enough to check that the book they're throwing isn't rare or important.

    You'd think people would check on the off chance it's worth a bunch but you'd be surprised.

  • source
  • parent
  • [–] 17 points 3 months ago (1 child)

    Microsoft being slow to fix bugs isn't news.

  • source
  • hideshow 1 child comment
  • [–] 15 points 3 months ago

    this type of thing really shows llm's to me. its great at creating this busy work but not so much with fixing it. so it can find them and we know microsoft is all in on ai coding, but it does not seem to help fixing them quickly. they are spending so much money to muck things up more and make more expense.

  • source
  • [–] 6 points 3 months ago (-1 children)

    That's not what they're saying. They're saying llms are getting so good at revealing vulnerabilities that they have to put focus and effort on finding and fixing them before external malicious actors do.

    Yeah it's faster to find a bug than to refactor a whole codebase to fix it, they're still using llms to speed up fixing the bugs. If you believe them, anyway.

    I do. Their software stacks were so shit and bloated and had many owners with different visions and understanding of what code does what and why and they rely on being closed source to survive penetration, I do believe llms are finding vulnerabilities left and right, and focused refactoring to address legacy human slop can take time, even for a super competent llm that does it correctly in one shot.

  • source
  • parent
  • hideshow -1 child comments
  • load more comments (-1 replies)
  • [–] 11 points 3 months ago

    AI slop kettle calls AI slop pot black.

  • source
  • [–] 8 points 3 months ago (-1 children)

    While these models can find more bugs, it seems that these bugs do not convert to exploits to a higher rate than before

  • source
  • hideshow -1 child comments
  • load more comments (-1 replies)
    [–] 8 points 3 months ago

    The Open Source epidemic, people.

  • source
  • [–] 6 points 3 months ago

    The Epsteins and their Corps seem to be organizing/manipulating the information sphere to create fear/hype around their top models. It seem to be centrally coordinated and different US tech Corps/players enters and leave. We keep getting either exaggerated/fake or 'woopsie' security narratives thrown at us.

    The normal purpose is to create fear/anger before a false-flag operation, so we'll likely see many claims about AI-hacking and a single great hit (the flag) against the Merican people, that will point towards one of the nations that the US/Epsteins have manufactured consent to attack - likely Iran. Old playbook stuff with a new topic..

    Wild that so many people are still stuck believing the information from the Epstein class' owned information sphere.

    ..on the other hand, I wouldn't want to BE the Epstein class when ~250M Mericans finally discover they got mind-raped for their entire lives..

  • source
  • [–] 5 points 3 months ago (1 child)

    LLMs probably created a lot of these bugs in the first place.

  • source
  • hideshow 1 child comment
  • load more comments (1 reply)
    [–] 1 point 3 months ago*

    We're talking about Microsoft here so I think it's probably found three bugs, two of which were already reported.

  • source
  • [–] 2 points 3 months ago (1 child)

    Can anybody help me understand the threat of these advanced models once the public and adversaries have access to them? I understand they can find software bugs and vulnerabilities and I get that US tech companies are using it to make their software more secure, but all of these companies have the benefit of their source code being available as an input to the model. Everybody else only has compiled binaries. Do the bad guys use the models to decompile or reverse engineer the code first?

  • source
  • hideshow 1 child comment
  • [–] 7 points 3 months ago
    • There are common techniques that can be used broadly to get results with LLMs.
    • Some source code is floating around out there, like it is mentioned in the article.
    • Yes, decompilation techniques are something that cannot be prevented and are sped up by LLMs.
    • There are only so many devs patching bugs, while there might be millions trying to break in - they mentioned the chaining of multiple "low"-priority bugs to escalate the severity, and if you need months to even get the really dangerous stuff fixed, it's a free-for-all bonanza as soon as those models hit the public, and these people don't even need to know anything about cybersecurity - Joe Shmoe can tell Mythos to "go hack Onedrive" and that's all that is needed from Joe Shmoe.
  • source
  • parent
  • load more comments (-1 replies)
    [–] 2 points 3 months ago

    Sounds like Microsoft needs to hire some people...

  • source
  • [–] 2 points 3 months ago

    In the end, LLM’s will find and fix those same bugs autonomously, people will do the final sign off and software will be simultaneously more secure and less secure as software continues to be tested worldwide wide

  • source