fosstodon.org is one of the many independent Mastodon servers you can use to participate in the fediverse.
Fosstodon is an invite only Mastodon instance that is open to those who are interested in technology; particularly free & open source software. If you wish to join, contact us for an invite.

Administered by:

Server stats:

11K
active users

Kees Cook :tux:

It's nice that an LLM found a bug, but it's also trivially mitigated with the bounds safety sanitizer with virtually no overhead. Your regular reminder to build all production C projects with "-fsanitize=bounds -fsanitize-trap"

int aIdx[7]; // compiler knows the size of this array
...
int iCol; // if this should not be negative, why is this "int"?
...
aIdx[iCol] = i; // build with bound checking!

infosec.exchange/@ifsecure/113

Infosec ExchangeIvan Fratric (@ifsecure@infosec.exchange)Don't panic now, but LLM-based agent discovered a previously unknown real-world vulnerability. Details in https://googleprojectzero.blogspot.com/2024/10/from-naptime-to-big-sleep.html The bug in question: https://project-zero.issues.chromium.org/issues/372435124

@kees For every bug they find, they also find 10 false positives and recommend introducing new vulns to "fix" them.

Not made up, my real experience with someone sending me garbage AI tool generated bug reports.

@dalias @kees I haven't looked into how GenAI handles this (although [1] gives me an idea), but yes, my main question would be "what's the false positive rate?", that along with the other rates.

And then I'd wonder how does it fit with the other tools, besides these compiler options, how does this compare e.g. with static analysis tools? Because if this ends up only catching things we could already catch, and does not minimize false-positives...

[1] social.sdf.org/@njsg/113141838

SDF Socialnjsg (@njsg@social.sdf.org)#GenAI #GenerativeAutocomplete #Aerospace #STS GPT output, Take 2: Q: when putting an OV on top of an SCA, which side goes down? White or black? A: «When attaching an Orbiter Vehicle (OV) on top of a Shuttle Carrier Aircraft (SCA), typically the white, or bottom, side of the OV faces downward. This orientation is commonly used for aerodynamic and visual reasons, as well as for purposes of heat management during ground transportation or ferry flights. [...] (multipost 1/2)