Post B57q3HgQGuJMq9t36e by neauoire@merveilles.town
 (DIR) More posts by neauoire@merveilles.town
 (DIR) Post #B57q3GxOyIIaaWp5vs by yosh@toot.yosh.is
       1 likes, 0 repeats
       
       Big new Wasmtime security release today - 11 new CVEs found including 2 critical ones using LLMs.https://bytecodealliance.org/articles/wasmtime-security-advisoriesIf LLMs can find this many critical bugs in a project that is as rigorous about security as Wasmtime, then get ready for projects with weaker security postures to do a lot worse. Like,,, actually.
       
 (DIR) Post #B57q3HNzNRZ9uzGKNE by yosh@toot.yosh.is
       1 likes, 0 repeats
       
       Like, you have to realize that Wasmtime is like if a group of fuzzing fanatics decided to start a group project. It implements a formally verified instruction set. Heck, parts of wasmtime itself are formally verified.However good you think your safety and correctness practices are, Wasmtime's are going to be better. This isn't just a toy either: it's a production-grade project used in tons of places.If LLMs can find 11 new CVEs in *that* - yeah it's legit, and I don't think we're ready.
       
 (DIR) Post #B57q3HgQGuJMq9t36e by neauoire@merveilles.town
       0 likes, 0 repeats
       
       @yosh we're not ready in a similar way that self-driving will make insurance companies price human driving out, in the guise of "security" this will price out developers from working on codebases. The people have spoken and voted against participatory practice and for more technocratic corporate capture."To minimize suffering and to maximize security were natural and proper ends of society and Caesar. But then they became the only ends, somehow, and the only basis of law — a perversion. Inevitably, then, in seeking only them, we found only their opposites: maximum suffering and minimum security."Walter M. Miller Jr.
       
 (DIR) Post #B57xp38sKzhxJxv1oO by yosh@toot.yosh.is
       0 likes, 0 repeats
       
       @neauoire This also reminds me of https://f.duriansoftware.com/@joe/116366549257239624The only pushback I'd provide is that I think it's less "the people have chosen" and more "capital has chosen". We're here only because hundreds of billions have been sunk into this.
       
 (DIR) Post #B57xp9LrFdeqZy2Tse by neauoire@merveilles.town
       0 likes, 0 repeats
       
       @yosh yeah, I agree with that, the pieces were already in place for us to fail, it's not something that just happened accidentally.