← All topics

software security

3 captures, most recent first.

@lauriewired

— saved image

LaurieWired (verified) @lauriewired · 2h
The boom in Linux CVEs lately should get you thinking.

Surely, given a finite codebase, there are also a finite number of bugs / unintended behavior, thus, a finite amount of vulnerabilities. Theoretically, a "solvable" problem. Right?

Well...not at all actually.

It gets a bit philosophical, but there's the concept of "weird machines".

A weird machine is an accidental computer located inside of another computer program. Quite a few exploits (e.g. anything ROP) falls into this category, where the attacker's instruction set consists of fragments of the original software.

Finite code can *easily* have infinite Unintended Behavior (not undefined behavior btw...that's a very different thing). Weird machines don't even have to be Turing complete to be, really, really powerful!

Even if you have a million superhuman AI coders and fuzzers thrown at the Linux kernel, you quickly hit halting-problem-esque uncomputable states. The concept of patching every possible bug until none remain isn't possible, because we can't often correctly define what a "bug" even is.

Now, can you make a kernel that truly has zero weird machines relative to a formal specification? ....yes, but it wouldn't look like Linux. It'd look more like sel4, VxWorks, or (shudder) INTEGRITY-178.
Note from Claude Sonnet 5

Long tweet arguing that a finite codebase can have unboundedly many unintended behaviours (weird machines), so patching Linux until no bugs remain is not achievable even with vast numbers of superhuman AI coders and fuzzers; conceptual, no exploit specifics.

linuxcveweird machinessoftware securityformal verificationai coders

@moyix

— saved image

Brendan Dolan-Gavitt [verified] @moyix · 58m
Working with frontier LLMs for vulnerability research lately has made me feel like I woke up one day and found the solid walls of my house were all made of paper. I knew humans were not good at secure software but having fistfuls of Chrome vulnerabilities makes it very real
[6 replies, 2 reposts, 58 likes, 1.4K views]

Justin Halford [verified] @Justin_Halford_ · 27m
It seems like a fair conclusion that we will need to rebuild virtually all software so that is formally verified end to end. It makes me wonder if there are bugs implicit to the stack between the machine language and our high level languages, even as deep as the hardware itself.
[3 replies, 5 likes, 56 views]

Brendan Dolan-Gavitt [verified] @moyix · 23m
I had a sort of depressing chat with GPT the other night where I asked if we ever fixed all those cache side channel attacks people wrote about in the mid-2010s, and it was like "no we decided to live with them instead"
Note from Claude Sonnet 5

Dark-mode X screenshot of a three-post thread: Brendan Dolan-Gavitt (@moyix) on frontier LLMs making software insecurity feel very real, Justin Halford replying that software may need to be rebuilt as formally verified, and moyix adding an anecdote about a GPT chat on unfixed cache side-channel attacks.

vulnerability researchllm securityformal verificationsoftware securityside channels

davidad @davidad

— quoting @loss_gobbler — saved image

davidad ✓ @davidad · 12h
yes, 100%. a standing rule in my Fable fleet is that any changes to any TCB must pass aggressive adversarial review by a throwaway codex instance with gpt-5.6-sol at max effort before landing. they sometimes go at it for like seven rounds before sol is satisfied

[quoted tweet]
LOSS GOBBLER ✓ @loss_gobbler · 12h
best workflow is:
- fable writes the security bugs
- sol finds and fixes them
Note from Claude Sonnet 5

Tweet by davidad describing his workflow for a 'Fable fleet': any change to a trusted computing base (TCB) must pass adversarial review by a throwaway codex instance running gpt-5.6-sol at max effort, sometimes taking seven rounds. Quotes a joke from LOSS GOBBLER that Fable writes the security bugs and Sol finds/fixes them.

ai coding agentsclaude fablegpt-5.6software securitytwitter