excitedrustle

Agree. I don't read it every week, but I greatly appreciate the quality (both of the technical content and the lack of advertising/sensationalism/clickbait) when I do read an article. Happy to pay to support this style of tech reporting and journalism.

This reminded me that I'd let my LWN subscription lapse after a credit card expired. Just renewed for a year and turned on automatic renewals (at least until the next credit card expiration).

> I found 4 different Postgres bugs.

Bugs in the upstream Postgres C implementations? Did you report them or submit patches? I'm curious to see what you found!

Interesting. I am still defaulting to ChatGPT when I anticipate having a multi-turn conversation.

But for questions where I expect a single response to do, Google has taken over.

Here's an example from this morning:

It's my first autumn in a new house, and my boiler (forced hot water heating) kicked on for the first time. The kickboards in the kitchen have Quiet-One Kickspace brand radiators with electric fans. I wanted to know what controls these fans (are they wired to the thermostat, detect radiator temp, etc?)

I searched "When does a quiet-one kickspace heater turn on". Google Overview answered correctly [1] in <1 second. Tried the same prompt to ChatGPT. Took 17 seconds to get the full (also correct, and similarly detailed) answer.

Both answers were equally detailed and of similar length.

[1] Confirmed correct by observing the operation of the unit.

And those good uses extend from appsec to cloudsec (IaC) as well.

I'm working on open-source tool [1] to look for policy violations in cloud infra. LLMs are great at dealing with cloud security policies that are frequently subjective and under-specified. They can "understand" the intent of the policy and use tools to pull in the necessary context to fully evaluate a potential violation.

We look at two examples in this blog post

https://blog.fraim.dev/ai_eval_vs_rules/

"No publicly exposed admin ports" and "IAM policies follow principle of least privilege".

[1] https://github.com/fraim-dev/fraim

Looks great! Wish Go wasm modules were smaller.

Working on Fraim, open-source agents for cloudsec and appsec engineers to complement existing deterministic scanners. Born out of our 3 years of learnings building such scanners for IaC. Turns out in the real world policies are subjective enough to make this hard.

Examples:

- Policies are frequently subjective. Hard to codify, but LLMs can evaluate them more like a security engineer would. "IAM policies should use least privilege." What is "least" enough? "Admin ports shouldn't be exposed to the Internet." What's an admin port?

- Security engineers are stretched thin. LLMs can watch PRs for potentially risky changes that need closer human review. "PR loosens authz/authn." "PR changes network perimeter configuration."

- Traditional check runs (SAST, IaC, etc.) flood PRs with findings. Security doesn't have time to review them all. Devs tends to ignore them. Frequent false positives. LLMs can draw attention to the important ones. "If the findings are unusual for this repo, require the author to acknowledge the risk before merging."

https://github.com/fraim-dev/fraim

https://www.fraim.dev