jooops1

Why would someone send their exploit chain to a random for a mediocre 'bug bounty'. The bounty was later claimed by people who just did It for fun after work for fun with a LLM of their choice quickly.

The key difference is even If an Integer overflows in Rust It still doesn't violate memory safety in safe Rust and therefore doesn't lead to exploitation.

That's irrelevant identify a non-toy language which responds to a serious RCE with vibe security.

Yet their response is doing vibe security to this which will never work. From my personal side I don't care about PHP to invest my free time into making such a project. Unfortunately as EU citizen I'm forced to care about PHP's security, because the government thinks It's a good idea to use such It.

So instead of using a memory safe language or harden the C code they hope LLMs will find bugs in their code? Neither do they mention how their way to patch Exceptions into C makes It very difficult for Fuzzers to find those bugs? Good luck this statement should tell everyone to migrate away from that horrible language and runtime.

If we run out of Saltwater then we have very different problems at our hand.

That's not completely correct. If the Rust or C++ compiler has a bug in both cases either the compiler has to be fixed or the program can be adjusted to work around said compiler bug If possible. However, It's fair to argue that the Rust compiler makes more assertions and is more complex, which results in a larger error surface.

I hope this includes politicians in power as well, who acted like software security is an after thought.

I do care, because those models can contain backdoors and 'open weight' models can require specialized hardware to run in the future.

Can you explain how an effect based language helps here? Also to note filesystem access can allow network access on many systems and also the other way around.

The author proposes to reinvent the wheel and depend on stale dependencies, which are EOL. Neither of that is an acceptable solution with LLM-based Agents being able to produce exploit(ExploitGym) chains in minutes from known bugs. The other issue is that Rust's forces the user to provide more information and APIs are usually kept generic for systems programmer, so standardizing things is not as straight-forward compared to Go where you can assume a memory-management, a virtual thread runtime and mostly ignore dynamic dispatching.

Can there be consequences for those who grant those patents? It seems the primary examiner Brian W Wathen also granted prior Art patents to Salesforce and NCR Voyix as well.

It increments rip by one.

Yep I agree C++ lacks many features Rust has solid support for. But the real issue with C++ is the development process, almost all the people involved in the Module system are rather old and worked for Microsoft once. They are just in their own bubble and not having an open RFC-process blocks experts in that field.