You wouldn’t want him using a local model unless he was running some fancy rig that could run a high end frontier model. He might not have such a thing laying around. Using the best out there for something like this is how you help avoid bugs.
He definitely can afford it yes, but its still a big ask to want someone to spend 15-25k or whatever it would be (shits getting more expensive by the day) to use a tool that he can just do pay per use. The code is open source so its not like he’d be using a local llm to keep it private.
Honestly, his mind and the community is probably one of the best things out there at the moment. They live the Linux Kernel, while that thing he used does not think or understand anything. Eh, it would be better if they moved with care instead, as that is a good way to avoid bugs too. I don’t have a lot of faith in gassed up LLMs.
He’s doing it though. So that’s kind or moot. Fable is out there finding bugs in these things, so seems like if he is going to do it, using the thing that’s already making it more secure by finding multiple exploits is the right choice of what to use.
Ehh, that’s debatable. An LLM will gladly spit out a vulnerability report, but as LLMs lack any understanding or reasoning capability, there’s literally nothing guaranteeing that it has any semblance in fact or reality. They are just random text generators after all.
Going by Anthropic’s own numbers for things like Mythos, it “found” 29,439 vulnerabilities, when a human actually checked if the reports made any sense (ignoring validity) that dropped to around 6,200 reports, when they were tested for validity that further dropped to around 1,300 reports, and when it came time to actually patch the issues only 516 made the cut (i.e. the rest might have been issues, but weren’t considered exploitable, etc.).
516 out of 29,439 is a 1.75% success rate, not exactly groundbreaking.
Now to be fair, according to Greg KH at a recent talk, Mythos is seemingly improving. Of 79 vulnerabilities it reported, a solid 4 were real. That’s a 5% success rate, though it performed much better when it simply reported other developers bug fixes, something it did 11 times.
And how many security vulnerabilities have you found? 516 is still a lot. One of those had been in the Linux kernal for decades.
Edit: and many of those real ones from the 6000 group anthropic says the maintainers just didn’t want to fix as it was outside their threat model. A vulnerability in the Linux kernal, is different than one on an alarm clock app or something less serious.
Edit: And for people that don’t know, this decades old linux exploit wasn’t just a single bug it found. It was able to piece together multiple smaller exploits that it found, that led to being able to exploit this bigger bug.
You wouldn’t want him using a local model unless he was running some fancy rig that could run a high end frontier model. He might not have such a thing laying around. Using the best out there for something like this is how you help avoid bugs.
He gets paid more than enough to afford high end hardware.
He definitely can afford it yes, but its still a big ask to want someone to spend 15-25k or whatever it would be (shits getting more expensive by the day) to use a tool that he can just do pay per use. The code is open source so its not like he’d be using a local llm to keep it private.
Wendell from Level1Techs built Greg KH a monster rig for free, I’m sure they’d be willing to build one for Linus too.
Dang, wish someone would build me one for free! Thats super cool of them though!
AMD Ryzen Threadripper 9960X
GIGABYTE TRX50 AERO D Motherboard
Samsung SSD 9100 PRO 2TB SSD
Noctua NH-U14S TR5-SP6 Cooler
Intel Arc B580 GPU
Fractal Design Torrent E-ATX Case
Seasonic PRIME TX-1600 1600W 80+
Titanium PSU
ASUS ProArt Display PA32QCV 31.5" 6K
HDR Monitor
Honestly, his mind and the community is probably one of the best things out there at the moment. They live the Linux Kernel, while that thing he used does not think or understand anything. Eh, it would be better if they moved with care instead, as that is a good way to avoid bugs too. I don’t have a lot of faith in gassed up LLMs.
He’s doing it though. So that’s kind or moot. Fable is out there finding bugs in these things, so seems like if he is going to do it, using the thing that’s already making it more secure by finding multiple exploits is the right choice of what to use.
Ehh, that’s debatable. An LLM will gladly spit out a vulnerability report, but as LLMs lack any understanding or reasoning capability, there’s literally nothing guaranteeing that it has any semblance in fact or reality. They are just random text generators after all.
Going by Anthropic’s own numbers for things like Mythos, it “found” 29,439 vulnerabilities, when a human actually checked if the reports made any sense (ignoring validity) that dropped to around 6,200 reports, when they were tested for validity that further dropped to around 1,300 reports, and when it came time to actually patch the issues only 516 made the cut (i.e. the rest might have been issues, but weren’t considered exploitable, etc.).
516 out of 29,439 is a 1.75% success rate, not exactly groundbreaking.
Now to be fair, according to Greg KH at a recent talk, Mythos is seemingly improving. Of 79 vulnerabilities it reported, a solid 4 were real. That’s a 5% success rate, though it performed much better when it simply reported other developers bug fixes, something it did 11 times.
And how many security vulnerabilities have you found? 516 is still a lot. One of those had been in the Linux kernal for decades.
Edit: and many of those real ones from the 6000 group anthropic says the maintainers just didn’t want to fix as it was outside their threat model. A vulnerability in the Linux kernal, is different than one on an alarm clock app or something less serious.
Edit: And for people that don’t know, this decades old linux exploit wasn’t just a single bug it found. It was able to piece together multiple smaller exploits that it found, that led to being able to exploit this bigger bug.