Apply sarcasm or not based on sleep deprivation.
At this point the play is simply to move the goalposts, suggesting that vulnerabilities don't matter so long as you yourself couldn't easily exploit them, regardless of what well-armed attackers can do with them. That's, obviously, not how software security works.
What sort of evidence? What "strongly suggests" this was actually easy to exploit?
Instead of highlighting the exceptional quality of curl, under intense, unprecedented scrutiny, the maintainer chose to dismiss Mythos as a nothingburger. I think this was a huge mistake and a disservice to curl itself.
> vulnerabilities don't matter so long as you yourself couldn't easily exploit them, regardless of what well-armed attackers can do with them.
This is moving goalpost. The goalpost was not "yet another vulnerability like the others".
Patching it was the issue, not the hole.
1. The patches had to be unofficially backported to the versions of php that most people were using.
2. Devs had to figure out if the unofficial backports were safe and they weren't just falling into trapped versions
3. Devs had to migrate all of their projects to unofficial versions
4. No one was ready for it to happen because there was no advance notice (someone broke the embargo) for everyone to plan maintenance windows and upgrade at the same time.
The correction is valid. It would be better if people used the right term. It's ok to correct. But it would be better if it were in addition to discussion of the actual point, not instead of it.
(And the phrase "catastrophic vulnerabilities" is pretty obviously talking about exploits anyway.)
the "pedantic" difference is between something being exploited and not being exploited
> Assume the original message said "exploits" in place of "vulnerabilities".
if the original message said something else, then it would mean something else.
For example, as others have noted, there were no results on cryptography in OpenAI's October 6th math drop. But it seems unlikely that they didn't look at this sort of thing.
There were conflicting claims about the degree to which the $6 Billion Binance heist was an AI thing. But either way it seems like it would be a "look what it enabled" or a look what it failed to prevent"
If nothing happens at all it's waved away as scaremongering rather than prevention.
At the point I wonder if there is any information left secure honestly. These are not from glasswing, but they are from LLMs.
Sure LLMs have helped reduce the attack surface and we patch things faster too, but I was really expected a few more Supermarket-level bangers.