Posts by zhuowei@notnow.dev
(DIR) Post #B3oMuPhKT8emcGyUbo by zhuowei@notnow.dev
2 likes, 5 repeats
Who called it "prompt injection" and not "Escape from Markov"
(DIR) Post #B4SiT3oRhQWWEi3x0i by zhuowei@notnow.dev
1 likes, 0 repeats
Sunday is the 10-year anniversary of the npm left-pad incident.
(DIR) Post #B4WXilXb4yfvKyJ9MW by zhuowei@notnow.dev
0 likes, 5 repeats
The `left-pad` incident was 10 years ago today. https://en.wikipedia.org/wiki/Npm_left-pad_incidentThankfully, we've completely solved software supply chains in the years since.
(DIR) Post #B4gWlxgIF2VpU7w0vI by zhuowei@notnow.dev
1 likes, 2 repeats
MacBook Neo · GeoMAX 8192 MEGAPRO–GEAR SPEC
(DIR) Post #B4gpXSGe8dXZ8FjcZc by zhuowei@notnow.dev
1 likes, 2 repeats
Premultiplied Alpha Male
(DIR) Post #B5ADf8zvhMykAXx8xU by zhuowei@notnow.dev
1 likes, 0 repeats
James Bond's "License to Kill" approved by Debian as a Free Software license
(DIR) Post #B5AnF35QePLEekNhPU by zhuowei@notnow.dev
0 likes, 0 repeats
With all this hype about upcoming AIs that can hack anything, I decided to see how well LLMs can audit code for security issues today.I downloaded an older version of a codebase I’ve been researching. It’s a well-written modern C codebase, and I chose an older version with known vulnerabilities.Then I installed an LLM coding tool. (Gemini 3.1 Pro (High) in Antigravity, if you’re wondering)I asked the LLM:Please find potential security issues in the <project> directoryAnd after a few minutes, it replied with:a few out-of-bound reads - which I’ve already found myself with fuzzing, two spec violations, which the LLM claimed makes the codebase vulnerable to a well-known bug.That well-known bug was indeed present in this version of this code, but these two spec violations don’t seem to be part of that bug. The later version of this codebase - which patches that well known bug - didn’t change them.a non-reentrant function - it doesn’t run concurrently anyways (this codebase runs on a single thread event loop)I then asked:Are there any out-of-bound writes?After another minute, it found one:A call that incorrectly passed an ID instead of an array index. This was a real security issue, since it was patched in the later version of this codebase.I asked again:Good catch. Are there any other issues?It then gave me another two:A stack overflow that seems genuine. However, it’s not patched in the later version of the codebase, so I can’t tell if the AI is wrong, or if it found a 0-day.The same issue above, but reached with an integer underflow instead of a large inputSo…2 definite issues2 kinda-issues with a wrong explanation1 issue that’s not a security issue but is not good practice1 issue that might be a 0-day or might be completely wrong.That’s honestly way better than I expected - there wasn’t a flood of false positives I had to wade through. And this is with a current generation LLM.So… yeah, I can see why people are hyped. But still:Why did I have to keep telling it to continue looking?The LLM wasn’t able to check by itself if its potential issues are genuine.Project Zero BigSleep and Claude Mythos/Glasswing both gave the AI agent a harness where it can write code to test its findings and see if they’re real issues.Is the future of security researchers just writing harnesses for GenAI, the same way everyone wrote harnesses for fuzzers back when the first coverage-based fuzzers came out?(sha256 of the conversation transcript is 36a9508bc06bb0d10d67294fabe0f46f3e71b676662fcf57e40956674c8428e5 - I’ll post the whole transcript once I check whether it actually found a real unpatched issue)
(DIR) Post #B5Ftxusba5xZkXxbqS by zhuowei@notnow.dev
1 likes, 1 repeats
With the RAMpocalypse, it’s time to bring back the x32 ABI4GB of virtual address space is enough for anybody! It’s not like you can afford enough physical memory to fill it anymore.
(DIR) Post #B5G3yhKMS93fY6xEa8 by zhuowei@notnow.dev
0 likes, 0 repeats
8b10b nail art
(DIR) Post #B5HCXu3a6wMbxIMcfg by zhuowei@notnow.dev
1 likes, 2 repeats
Happy Pi day, JavaScript users!> new Date(2026, 3, 14)2026-04-14T00:00:00.000Z
(DIR) Post #B5QZy1yhKSq7Q799c0 by zhuowei@notnow.dev
1 likes, 0 repeats
Quantum computing researchers theorize Shor's Algorithm will put asunder what God hath joined together
(DIR) Post #B5Qa0ZztohgJVavLQ8 by zhuowei@notnow.dev
0 likes, 0 repeats
There’s exactly one search result for “quantum divorce lawyer”.
(DIR) Post #B5hLYviHOAC14zvGCG by zhuowei@notnow.dev
1 likes, 0 repeats
from classic sci-fi novel Don’t Create The Sonatype Nexus
(DIR) Post #B5iQqktr1bXPgTcEm8 by zhuowei@notnow.dev
1 likes, 1 repeats
At long last, we have stolen the macOS from classic kernel extension Dont Steal Mac OS.kext
(DIR) Post #B5k20XEsYs97fow760 by zhuowei@notnow.dev
0 likes, 1 repeats
If our universe is a computer simulation, then all those "Can it run Doom?" demos actually all ran on the same computer
(DIR) Post #B5nCFvS8OoxK8Azffs by zhuowei@notnow.dev
1 likes, 0 repeats
Want to tell a salesperson and an engineer apart?Ask them to pronounce "codesign"
(DIR) Post #B5xhFeD7XsHMoauxii by zhuowei@notnow.dev
0 likes, 0 repeats
No neurotypical ever used Windows NT
(DIR) Post #B6Jlu8s3e1lgmekUYy by zhuowei@notnow.dev
1 likes, 1 repeats
A Windows zero day in transactional NTFS?usb stick says trans writes
(DIR) Post #B6VyTVExzuurdybxPE by zhuowei@notnow.dev
1 likes, 0 repeats
Waiting for the copycats who are, even now, forcing a bot to port Windows CE to every video game console.Port Windows CE to the Dreamcast! no wait
(DIR) Post #B6rfP3To7kBM6CaTdw by zhuowei@notnow.dev
1 likes, 0 repeats
Christopher Nolan should’ve used a New Glenn to film Oppenheimer