Dunno about everyone but my 9-5 salary is awesome. I do Vulnerability Research at an MIT lab. Working there is amazing. Much rather my situation than one where I am forced to “trade” and make it big in order to eat and or anything else in life. Great 9-5 jobs are out there and it’s funny because I used to think of them as “awful slave” jobs. Used to think having to do a 9-5 was something to avoid at all costs. Came to realize I enjoy guaranteed income and job security over anything else. Sorry for bad grammar; typing on phone..
Uhhhh… It was trained on ARC data? So they targeted a specific benchmark and are surprised and blown away the LLM performed well in it? What’s that law again? When a benchmark is targeted by some system the benchmark becomes useless?
Damn... I wish I could say this wasn't true. Been trying to lie and say it hasn't but it absolutely has made programming less enjoyable by far... I been trying to convince myself other wise but I am just lying to myself.
Lcamtuf, the creator of afl shares the same opinion… I linked to his Substack in my original comment. Give that a read. My main point is over emphasis on memory safety doesn’t seem to pay off when there are lower hanging fruits on most large networks.. obviously I want memory safety, but that’s irrelevant when there are easier attack vectors still open.
Can you link me to a viable/real world kernel rewritten in Rust? One that supports modern hardware? I am not talking about implementing a toy kernel here.
I have been doing government work for a while and understand why they respond that way. Nation states can in fact develop very powerful kill chains. My entire start up was created and sold based on a vehicle kill chain but that took us a year and a half to do… Mean while some kid in his moms basement uses leaked credentials and sprays a network or phishes and boom. Major breach…
Yes it has and can be done with rust. But usually by writing “unsafe” code so what the hell is the point if the majority of the code isn’t gonna have the Rust memory guarantees it would normally have? Furthermore, not all MCUs have a Rust compiler or tool chain to use. C is the defacto standard. Not saying it cannot be done, just that I am not sure it’s worth the extra effort and overhead.
A team can learn and start using Golang in a week. That is in fact what is powering a lot of companies right now. Golang has even better memory safety guarantees than Rust and you don't really need to worry about memory management at all... Furthermore its compiled statically and more suitable for distribution and horizontal scaling. I am not sure how quickly a team can become productive in Rust but I am willing to bet that it would take way way longer to get off the ground. That being said, using an LLM might help with that but then you would still have code people don't understand and that becomes technical debt... Maybe I am just old and grumpy.. I am learning Rust myself and I just don't understand why it's being pushed so hard. I think Zig should be pushed for systems programming if anything..
CVEs are being assigned recklessly these days. Most of them aren't even security bugs and or cannot be exploited. Be wary of CVEs and their practical utility.
I understand that. It is just they end up writing Rust code and then you go and see it's linked to libc or filled with "Unsafe". It isn't too difficult to write correct, safe C++. You can enable compiler settings that are similar to what Rust does..
On the critical bugs issue... To exploit a lot of these memory bugs it takes an entire new level of effort. We often need to chain together three or more bugs and land the exploit reliably.. This was much easier to do circa 2001 - 2016 but all the mitigations in place have really raised the bar.. From my experience providing exploits to a red teams that pen-test fortune 500 companies (my previous job at iDefense/FusionX), things have gotten far far more difficult. Rarely needed to use any advanced "sexy kill-chains" (like Chrome or IE exploit) because phishing and other means of network entry were far more reliable and much easier. My point is that study Google released expressed the bugs are dangerous and disastrous, yes, but they aren't the most prevalent risk in the real world. I am rambling a bit. Sorry for poor grammar typing on phone.
What are the other advantages exactly besides tool chain? A lot of people using Rust where the could have just used Go or another language that is memory safe and actually productive. Maybe I am just being a hater because I grew up on C/C++ but I know for a fact "Rustaceans" are getting out of control. Approaching zealot territory for sure. The time people spend fighting the Rust compiler for a project, they could have just written secure C.. That is just my personal opinion. I am not saying Rust shouldn't exist. I am just saying it isn't some big universal answer to all security and systems programming issues..
Say you have to develop an embedded project. Try dealing with Rust and its dependency hell as everything you do requires a million different packages.. Or, develop me a driver that needs DMA.. How about a kernel allocator? Want to do that? Sure just wrap everything in "Unsafe"... So what is the point? Furthermore Rust programs link to libc ironically.
Developing a full kill chain for adobe usually requires chaining together several bugs. "CVEs" are getting ridiculous. Prove to me it is easy and go win Pwn2Own or you can do what I do. Sell it to government contractors for a hefty price...
80% or more of the code you write day to day is just grunt work. Boring code that has, for the most part, already been written in some form such that it was copied from Google or StackOverflow. AI is basically a shortcut to using that stuff..
To be fair the paper that helped launch LLMs to a new level was from Google. “All You Need Is Attention”, Keras… They fell behind when it comes to marketing AI maybe…
It’s hilarious seeing people getting LLMs to traditional takes traditional discrete algorithms do perfectly already. “Let’s use LLM to do basic arithmetic!” Like, that’s not what they are built for. We want more generalization… So much to unpack here and I’m tired of having to explain these basic things. You will know our models got more powerful if they can do something like solve the ARC challenge, not cramming it with new updated information we know it will already process a certain way…
I haven’t seen LLMs do anything I wouldn’t google. LLMs are a great time saver, prevents me from having to manually Google. This is just funny. Because the data LLMs use is supplied by humans, and often we give out, and even believe, wrong information. Wish people would stop overhyping things so much.
edit: typed this on phone sorry for poor punctuation and spelling errors.
Awesome. I produce all my beats on the MPC2 Live. I go by the moniker h3xadecible. If anyone’s interested I have a beatstars https://www.beatstars.com/h3xadecibel
I can’t begin to start explaining how bad these arguments are from a Security Researchers point of view. He suggest using IRC.. this way we can give some random person virtually all control of your information instead of a company that can be held liable…
As Vulnerability Research is my area of expertise we are finding new attack vectors all the time. Remember with new technology and abstraction you introduce new potential security issues that can be used to subvert other means of protection. It’s a tit for tat non ending cycle. That being said exploitation of consoles and phones has become quite difficult. Enough at least to make me move to embedded security as there is more work to be done there..
That is not true. All studies have shown they are only neurotoxic if abused and by abused I mean taking nearly 10x of a normal dose. At that level
Of abuse anything is neurotoxic.