Comment on Google pays $250K for Linux vulnerability allowing guest VM escapes

irmadlad@lemmy.world ⁨3⁩ ⁨days⁩ ago

• Tangent5280@lemmy.world ⁨3⁩ ⁨days⁩ ago

  If you pay attention you can hear a hundred NSA assholes tear their hair out

  original

  • mlg@lemmy.world ⁨3⁩ ⁨days⁩ ago

    20 years of hoarding CVEs down the drain.

    Now they’ll never be able to gg ez their way into any countey and will have to actually use their bribery budget to get more implants lol.

    original

    • sp3ctr4l@lemmy.dbzer0.com ⁨3⁩ ⁨days⁩ ago

      Which means the new paradigm will be ‘every piece of hardware is a supply chain attack.’

      original
  • panda_abyss@lemmy.ca ⁨10⁩ ⁨hours⁩ ago

    This is why they restrict Mythos and similar.

    They want the vulnerability machine, and they don’t want you to have it.

    original
  • chicken@lemmy.dbzer0.com ⁨2⁩ ⁨days⁩ ago

    You don’t think frontier AI models are leaving some out deliberately?

    original

    • Reannlegge@lemmy.ca ⁨2⁩ ⁨days⁩ ago

      If they leave it out someone else will find it, the days of leaving things out deliberately past.

      original
• mnemonicmonkeys@sh.itjust.works ⁨2⁩ ⁨days⁩ ago

  Keep in mind that the rate of errors caught by AI will not be consistent. It will drop off over time.

  While I’m no fan of AI, that has nothing to do with it. Adding AI to error detection suites is (mostly) fine so long as you don’t remove more tradional methods like code review, manually set up unit tests, and properly reviewing each failed test instead of just letting the AI slop in a patch.

  My point is that any test you add to an existing codebase is going to catch a decent number of issues at first, then over time it will drop off as pre-existing issues get resolved. Then you’ll be left with the lower rate of new issues from updates.

  AI isn’t a silver bullet. It (sometimes) is another tool in the toolbox.

  original

  • irmadlad@lemmy.world ⁨2⁩ ⁨days⁩ ago

    AI isn’t a silver bullet. It (sometimes) is another tool in the toolbox.

    I would fully agree with that statement.

    original
• lambalicious@lemmy.sdf.org ⁨3⁩ ⁨days⁩ ago

  as we use AI to find vulnerabilities faster (hopefully) than bad actors can use AI to find vulnerabilities.

  Oh small, simple child: who do you think has the better access to AI in the first place?

  original

  • Fedizen@lemmy.world ⁨3⁩ ⁨days⁩ ago

    This is a reminder that US scientists during the cold war thought fish were russian subs because they didn’t have biologists on staff

    Judging by the way they’ve treated big companies in the past the NSA is staffed by a bunch of people who use backroom deals with US tech companies to collect their data mostly.

    original

    • lambalicious@lemmy.sdf.org ⁨2⁩ ⁨days⁩ ago

      You start as a bully when a kid, then grow up to be a fash / nazi, then they give you a badge and the ability to institutionalize your hate.

      original
  • irmadlad@lemmy.world ⁨3⁩ ⁨days⁩ ago

    small, simple child:

    Didn’t downvote you but…

    LOL! The level condescension sure is right on point Lemmy.That genuinely got a chuckle. In some ways I enjoy being that simple child. Full of wonderment at this universe around him.

    original

    • lambalicious@lemmy.sdf.org ⁨2⁩ ⁨days⁩ ago

      Wonderment is cool. The key is to know to keep it as you learn more truths about the world.

      original

      • irmadlad@lemmy.world ⁨2⁩ ⁨days⁩ ago

        That’s a mouthful of a statement, and one that I wrestle with constantly.

        original
  • realitaetsverlust@piefed.zip ⁨3⁩ ⁨days⁩ ago

    Well, you know … “them”

    original

    • lambalicious@lemmy.sdf.org ⁨2⁩ ⁨days⁩ ago

      Almost sounds like a pejorative when you say it like that! :p

      original
  • pienz@feddit.org ⁨3⁩ ⁨days⁩ ago

    The companies who are training AI… On Linux servers?

    Wait no, obviously smaller actors you’re referring to with your mysterious comment.

    Or maybe all the follow on tech companies that are the largest customers using AI aaand who also mostly use Linux

    No no I’ve got it wrong, US government entities want a backdoor so restrict AI releasing, then during that window exploit non-US companies using Linux

    original

    • atzanteol@sh.itjust.works ⁨2⁩ ⁨days⁩ ago

      It goes right to the top!

      original