| ▲ | Using Claude to reduce the attack surface of code(anthropic.com) |
| 47 points by dnw 6 hours ago | 19 comments |
| |
|
| ▲ | mentalgear an hour ago | parent | next [-] |
| There is really just one way this goes and its upwards to the peak: which means full formal verification programming languages, OS uni-kernels, small TCB and probably verified HW for the most sensitive cases. Everything else will soon be hackable via 'brute compute' because economy of scale and accessibility of open weight models. |
|
| ▲ | lptome 44 minutes ago | parent | prev | next [-] |
| I'd really expect a company like Anthropic to proof-read their posts. I found at least 4 typos in this. |
| |
|
| ▲ | messe an hour ago | parent | prev | next [-] |
| If only Claude didn't constantly drop to less capable models whenever it encountered anything vaguely cybersecurity related (despite being part of the Anthropic Cyber Verification Program and having Mythos access, albeit limited). We're strongly pushing for a move to a mix of Codex and open models at my workplace because of Anthropic's ridiculous nanny-ing. |
|
| ▲ | owebmaster an hour ago | parent | prev | next [-] |
| The irony of a company using Nextjs for a chat app and React for a terminal UI talking about reducing attack surface. |
| |
| ▲ | esperent an hour ago | parent [-] | | React is actually pretty good for any kind of reactive interface, and it's small. Something under 3k lines of code, and it's well battle tested at this point. You might have a dislike of react and that's fine, but it's not adding any significant attack surface to a project. Nextjs on the other hand... | | |
| ▲ | shakna 16 minutes ago | parent | next [-] | | We're only 10 months out from React2Shell. That is not nearly enough time to say "battle-tested". | |
| ▲ | brazukadev 8 minutes ago | parent | prev [-] | | Just the ReactFiberWorkLoop.js has 5k+ lines of code. React is one or two orders of magnitude bigger than you are thinking. And that's not counting Nextjs. |
|
|
|
| ▲ | vasco 3 hours ago | parent | prev [-] |
| These guys are now the biggest slowdown to fixing issues with their bullshit cyber detection. They drop a model, let the model find security issues in your code, then when you want to fix them you need to play a game of charades so it doesn't realize it's creating a validation and then a fix for the issue because you might be hacking yourself. Meanwhile attackers are using some ablated deepseek or what have you. |
| |
| ▲ | xnorswap 3 hours ago | parent | next [-] | | It's frustrating. Claude thinks it finds a way to hop from one client to another, but any attempt to get it to demonstrate it isn't relying on something that's already prevented runs into "safety" concerns and gets blocked. I'm not that hot on the idea of open models, but having something dangled in front of you but suddenly unable to verify is not a good feeling. With the right amount of coaxing you can sometimes get it to reproduce a PoC with a "TDD first" approach to fixing, but often now that gets blocked too. | | |
| ▲ | featwanz an hour ago | parent | next [-] | | Why wouldn't everyone be hot on open models? Security implications? First time I have heard someone lightly opposing the idea of fully open models. | | |
| ▲ | xnorswap 19 minutes ago | parent | next [-] | | I'm not opposed to open models at all, I'm just slightly sceptical on how much some people push their use compared to the value we get out of a dirt cheap subscription. Propriety models are clearly subsidised by enterprise API contracts, so it makes sense to milk that for all its worth, provided one steers clear of any lock in so the option to switch is always there. Jumping to spending time managing and self-hosting open models is a nice ideal but I think it's a distraction to jump on that train without proven benefits given the value that other plans deliver. I don't mean I'm against the idea of open models, they were especially instrumental in Anthropic backing down from the "Fable only initially available 2 weeks" plan, which got extended up until Fable was over-taken by Opus in general usefulness. It's my view that any company sized appropriately for Teams plan should be milking it for all its worth while it still exists, and it is a waste to lose that opportunity by jumping on open models too early. If you're a larger enterprise then it would be a very different story, you'd already be paying more forced onto API pricing and would likely have the capacity to have a team look at open models without impacting delivery. | | |
| ▲ | rgbrenner 2 minutes ago | parent [-] | | there is a middle ground between proprietary models and self-hosting: Fireworks, et al. Popular models like DeepSeek have a couple dozen providers on openrouter. |
| |
| ▲ | ajb an hour ago | parent | prev [-] | | There's a lot of lobbying against open models on the grounds of a) China and b) open models mean we won't be able to prevent a hard takeoff. |
| |
| ▲ | generic92034 3 hours ago | parent | prev | next [-] | | On the other hand this sounds like a job guarantee, though. And not only for the moment, as it is not the capability of the model which is insufficient. | |
| ▲ | vasco 3 hours ago | parent | prev [-] | | So far I can always get around it by starting fresh sessions on a similar problem and without ever mentioning security issues, but why do I have to play this little theater with a tool we pay to use. |
| |
| ▲ | esperent 3 hours ago | parent | prev | next [-] | | > Meanwhile attackers are using some ablated deepseek or what have you. I think the hackers are just using "not Claude". | |
| ▲ | abc123abc123 42 minutes ago | parent | prev [-] | | In the kingdom of vibe coderz the engineer is king! |
|