Comment Re: Vibe coding works fine... (Score 1) 23
Is the Lovable tool what we in the nineties called a Wizard, or a Setup assistant? A template tuner?
Comment Vibe is for code you throw away (Score 2) 23
" he wrote the whole thing by hand, vibes be damned."
That could mean Nanochat is not a throwaway weekend project.
Why are people forgetting the "throwaway" part of the definition of vibe coding ?
Submission + - AI slop? Not this time. Generative AI found 50 real bugs in cURL — and cou (etn.se)
jantangring writes: AI-generated bug reports are usually trash. But when a security researcher used LLM-based scanners the right way, he found 50 real bugs in libcURL. Swedish tech journal talks to cURL maintainer Daniel Stenberg and to Joshua Rogers, the Australian hacker / security researcher that is using AI tools to uncover loads of old bugs in open source projects.
Generative AI has now proven that it can independently discover new vulnerabilities in high-quality source code. New generative AI tools are suddenly digging up bugs that traditional static analysis tools have been overlooking for years.
”I’m actually overwhelmed by the quality of some of these findings”, says Daniel Stenberg, maintainer of the file-transfer library cURL, in an interview with Swedish industrial electronics news publisher Elektroniktidningen (etn.se).
In a well-known talk this August, Daniel Stenberg warned that he and his team were being flooded with AI-generated bug reports — wrong, confused, hallucinatory garbage created by generative AI.
Such “AI slop” has begun to waste valuable time for open-source maintainers, not only in cURL. The community is struggling with how to stem the tide.
Still, banning AI wasn’t the solution, Stenberg argued back then. He believed that AI might yet prove useful.
And he turned out to be right. In September, a batch of cURL bug reports arrived that has so far led to 50 fixes in the cURL library source code.
It marks a clean break from the previous wave of junk reports. There may have been the odd valid AI-based bug report before, but this time, Stenberg’s team implemented fifty fixes, all stemming from AI-generated reports. Once again the team is knee-deep in AI bug reports — but this time, they’re not slop. These are bugs that cURL’s regular analysis tools have been completely been overlooking.
“This is new,” says Daniel Stenberg. “It really looks like these new tools are finding problems that none of the old, established tools detect.”
“We regularly run clang-tidy, scan-build, CodeSonar and Coverity on the code, and whenever they find something, we fix it. So when all those tools report zero issues and someone suddenly finds hundreds, that’s pretty spectacular,” he adds — with some understatement.
All the bug reports came from one single developer: Joshua Rogers, an Australian with 15 years in cybersecurity, including at Opera Software in Poland. Today he works in security for a cryptocurrency company.
Over the past few months, he has been evaluating new AI-based tools and has started submitting bug reports to several open-source projects — including cURL, sudo, libwebm, Next.js, avahi, wpa_supplicant and squid.
None of the 50 bugs found in cURL were critical, but Rogers has discovered critical vulnerabilities elsewhere, including in source code from his former employer Opera Software. That bug was patched in early September.
Initially, Rogers hesitated to report bugs to cURL — familiar with Stenberg’s public stance on “AI slop”.
“Even though I could literally see the bugs in the code, I thought there was a 0.001% chance I was wrong — and I’d end up in the hall of shame,” Rogers says with a smile.
But he eventually gathered his courage and started sending reports.
After a while, Stenberg reached out curiously and asked where the reports were coming from.
”After I explained it to him, he asked me to send him the un-reviewed list of problems, and he'd triage them himself.”
“Triage” is a medical term — sorting patients by urgency. In software, it means prioritizing bug reports by severity.
Rogers says he’s received similarly astonished reactions from other open-source maintainers.
On his blog, he has shared insights into how he performs vulnerability analysis using LLM based SAST tools (Static Application Security Testing). His main message: these tools exist, and they’ve become incredibly good.
Generative AI has now proven that it can independently discover new vulnerabilities in high-quality source code. New generative AI tools are suddenly digging up bugs that traditional static analysis tools have been overlooking for years.
”I’m actually overwhelmed by the quality of some of these findings”, says Daniel Stenberg, maintainer of the file-transfer library cURL, in an interview with Swedish industrial electronics news publisher Elektroniktidningen (etn.se).
In a well-known talk this August, Daniel Stenberg warned that he and his team were being flooded with AI-generated bug reports — wrong, confused, hallucinatory garbage created by generative AI.
Such “AI slop” has begun to waste valuable time for open-source maintainers, not only in cURL. The community is struggling with how to stem the tide.
Still, banning AI wasn’t the solution, Stenberg argued back then. He believed that AI might yet prove useful.
And he turned out to be right. In September, a batch of cURL bug reports arrived that has so far led to 50 fixes in the cURL library source code.
It marks a clean break from the previous wave of junk reports. There may have been the odd valid AI-based bug report before, but this time, Stenberg’s team implemented fifty fixes, all stemming from AI-generated reports. Once again the team is knee-deep in AI bug reports — but this time, they’re not slop. These are bugs that cURL’s regular analysis tools have been completely been overlooking.
“This is new,” says Daniel Stenberg. “It really looks like these new tools are finding problems that none of the old, established tools detect.”
“We regularly run clang-tidy, scan-build, CodeSonar and Coverity on the code, and whenever they find something, we fix it. So when all those tools report zero issues and someone suddenly finds hundreds, that’s pretty spectacular,” he adds — with some understatement.
All the bug reports came from one single developer: Joshua Rogers, an Australian with 15 years in cybersecurity, including at Opera Software in Poland. Today he works in security for a cryptocurrency company.
Over the past few months, he has been evaluating new AI-based tools and has started submitting bug reports to several open-source projects — including cURL, sudo, libwebm, Next.js, avahi, wpa_supplicant and squid.
None of the 50 bugs found in cURL were critical, but Rogers has discovered critical vulnerabilities elsewhere, including in source code from his former employer Opera Software. That bug was patched in early September.
Initially, Rogers hesitated to report bugs to cURL — familiar with Stenberg’s public stance on “AI slop”.
“Even though I could literally see the bugs in the code, I thought there was a 0.001% chance I was wrong — and I’d end up in the hall of shame,” Rogers says with a smile.
But he eventually gathered his courage and started sending reports.
After a while, Stenberg reached out curiously and asked where the reports were coming from.
”After I explained it to him, he asked me to send him the un-reviewed list of problems, and he'd triage them himself.”
“Triage” is a medical term — sorting patients by urgency. In software, it means prioritizing bug reports by severity.
Rogers says he’s received similarly astonished reactions from other open-source maintainers.
On his blog, he has shared insights into how he performs vulnerability analysis using LLM based SAST tools (Static Application Security Testing). His main message: these tools exist, and they’ve become incredibly good.
Comment Re: chess (Score 2) 238
You should paste the full board after each move, to make sure positions don't drop out of his context window.
Comment Re: Ah yes, cheap batteries (Score 1) 100
The text doesn't say 92 percent, 10 years and Powerwalls, it says 90 percent, 15 years and batteries.
Comment Re:He didn't get sick though (Score 1) 168
Indeed he did not!
”During his second infection, the man did not have any symptoms”
Philosophically, this is unfair towards Covid-19. Any other ”illness” – no one would ever have known.
Comment Slashdot editors are sucking up to Microsoft (Score 1) 194
... it happens too often to be just a coincidence.
There must be money involved, right?
Thank God for Slashdot commenters!
Comment Re: The same Bloomberg of Supermicro non-evidence? (Score 1) 166
No
Comment Re: Interesting Spin.. (Score 1) 166
ÂWithout knowing the specifics of the vulnerabilitiesÂ
The Âbackdoor is Telnet. Vodafone instructed Huawei to uninstall Telnet. Huawei agreed to do that, but didn't, because they needed it for installation and test. It sounds from the story like they only killed it.
Comment Re: LEARN TO READ ILLITERATE ARCHTECH FAGGOT (Score 1) 166
ÂIn China, a company is a Chia pet. The state tells them what to do, and they do it.
There is no hard evidence that's happened with Huawei. -- 60 minutes
Nothing has changed since then.
Comment Re:Trump may cause lower IQ in Republicans (Score 1) 118
They are implausible because you are getting numbers wrong. I suspect you have not read the study.
Only former Uber and/or Lyft users were in the study.
https://ancillary-proxy.atarimworker.io?url=https%3A%2F%2Fpapers.ssrn.com%2Fsol3%2Fp...
Comment Re:not worth reading (Score 1) 30
These were super cool references, and you are obviously very knowledgeble.
”Weapon” is just a metaphor.
Stuxnet/Olympic Games caused physical damage, that was a first (counting only well documented cases).
Comment Re:What exactly is the law/rule? (Score 2) 323
They are accused of this:
-Selling millions of cars that are not certified. VW does have some certificates, but they are valid only for (non-existing) cars without the defeat devices. Devices that work like this have to be declared. There are acceptable uses for example when handling emergencies or when starting the car, but cheating on emissions testing would presumably not have been an acceptable use. So VW didn't mention them in the application and thus the certficiates they do own are not valid for the cars they sold.
-Having installed defeat devices, which is illegal.
Comment Re: Futile search? (Score 1) 208
There is also the possibility that the closest civilization to earth, or even the closest planet harboring life, is in a parallel universe.
Comment In a parallell world without XKCD 936 (Score 1) 549
”What is there to prevent “letmeinfacebook” from being the new most common four word password for Facebook accounts”
Chance. XKCD 936 says to choose the words at random.
Diogomonica is wrong. And so was Bruce Schneier, and for the same reason – he missed that the words are to be chosen at random.
https://ancillary-proxy.atarimworker.io?url=https%3A%2F%2Fwww.schneier.com%2Fblog%2F...
This means for example picking a up a few books and selecting pages and words at random. I picked a poetry book and used only words starting with an "o". Not optimal, but nice.
Password managers are better, definitely. So sure, mention the password manager first. But nine out of ten of your readers will not install them. What will you tell them? Nothing?
Slashdot Top Deals
The bugs you have to avoid are the ones that give the user not only the inclination to get on a plane, but also the time. -- Kay Bostic
