alt Hacker NewsMy question is, did it provide POCs? I have had some security issues flagged that I tried my best to exploit, but failed miserably. Since I do not have any kind of privileged access the LLMs I use have been unwilling to actually prove that it can be exploited.
While I did fix most of the things because while they might not have been exploitable they were bugs waiting to happen, in all but one case I haven't been very impressed by any of the LARGE IMPORTANT SECURITY HOLES that were found.
Replies
zelphirkalt • today at 12:12 PM
While it is certainly good to do estimation oneself and not just blindly follow whatever the LLM outputs, keep in mind the recent PHP-related events ... Just because at some point one is not able to make a PoC, it doesn't mean, that no one else ever will be.
No, the Mythos reports do not come with POCs. It's a lot of redundant prose explaining the bug it found (much more than I'm willing to read), it explains how it can be triggered, but doesn't generate actual exploit code.
But that doesn't matter for me. It shows me real bugs and less than 1% false positives. Some bugs are truly nasty and urgent, most are trivial and not exploitable at all, but they're bugs and so I'm fixing them.
Mythos isn't mythically superb for being the best LLM model, but only for not having these annoying guard rails that make all others randomly refuse to cooperate when you need them the most. Whoever invented guard rails - please stop! - they just slow the good guys down in the race.