People always cite CURL incorrectly in thier anti Mythos rants.
> Before this first Mythos report, we had already scanned curl with several different very capable AI powered tools (I mean in addition to running a number of “normal” static code analyzers all the time, using the pickiest compiler options and doing fuzzing on it for years etc).
This is why Mythos found so little: Curl is already a follows all best practices project, and they already had run scans with other leading AIs and fixed everything. The correct conclusion isn't that Mythos isn't good, it is that Mythos is only slightly better than everyone else (at the time - there have been new models since then).
If you project isn't already running all of the current best practices Mythos will find a lot - but so will everything else. If Mythos is what it takes to get you (your boss?) to take these issues serious, then the hype is worth it. You need to fix your security before you get hacked.
> If you go looking for the public record of what Mythos actually found you land on roughly 40 CVEs, and 28 of those are Firefox and 9 of them are wolfSSL. A browser and a cryptography library. There’s no PHP in that list, no CMS, nothing that resembles the web most people actually use.
How does one arrive at the idea that "browsers" is a category less representative of "the web most people actually use" than "PHP applications"?
Anthropic's own criterion, from the Glasswing page: "systems that represent a very large portion of the world's shared cyberattack surface."
A Firefox exploit would be targeted, one user at a time, and you still need delivery. A pre-auth RCE in the CMS behind 40% of the web does fit that criteria better right?
You need both sides for a useful web. In this discussion if the servers are all dead web is dead too: don't use a compromised server even if you can't tell it is compromised.
People always cite CURL incorrectly in thier anti Mythos rants.
> Before this first Mythos report, we had already scanned curl with several different very capable AI powered tools (I mean in addition to running a number of “normal” static code analyzers all the time, using the pickiest compiler options and doing fuzzing on it for years etc).
This is why Mythos found so little: Curl is already a follows all best practices project, and they already had run scans with other leading AIs and fixed everything. The correct conclusion isn't that Mythos isn't good, it is that Mythos is only slightly better than everyone else (at the time - there have been new models since then).
If you project isn't already running all of the current best practices Mythos will find a lot - but so will everything else. If Mythos is what it takes to get you (your boss?) to take these issues serious, then the hype is worth it. You need to fix your security before you get hacked.
> If you go looking for the public record of what Mythos actually found you land on roughly 40 CVEs, and 28 of those are Firefox and 9 of them are wolfSSL. A browser and a cryptography library. There’s no PHP in that list, no CMS, nothing that resembles the web most people actually use.
How does one arrive at the idea that "browsers" is a category less representative of "the web most people actually use" than "PHP applications"?
Anthropic's own criterion, from the Glasswing page: "systems that represent a very large portion of the world's shared cyberattack surface."
A Firefox exploit would be targeted, one user at a time, and you still need delivery. A pre-auth RCE in the CMS behind 40% of the web does fit that criteria better right?
https://www.anthropic.com/glasswing
You need both sides for a useful web. In this discussion if the servers are all dead web is dead too: don't use a compromised server even if you can't tell it is compromised.
What do you mean by WordPress fell? What did I miss?
https://wp2shell.com/
But the phrase/meme is this: https://knowyourmeme.com/memes/where-was-gondor-when-the-wes...
So it’s just something rhetorical, “Wordpress fell” is probably an exaggeration for dramatic / meme fitting purposes.
Btw I googled all this, didn’t use ai even. You could have too!