Hacker News
points by athrowaway3z 22 hours ago | 0 comments
On a related note from that tweet

> Noteworthy: ironically, OpenAI and Anthropic's models refused to do this work. Open weight models got the job done. I'm worried the labs' stance might backfire and get in the way of helping developers build correct and secure systems.

I was working on a network protocol and it correctly found a DoS attack. Once found - Claude refused anything and everything to do with it. Even asking what it was reading locked immediately. I had not written any of it.

Sol 6.1 only denied me once.

Having a multi-model harness was always the better choice, but this really drove home the point to not get too dependent on any single provider.

[–] Silagi 21 hours ago
I've been working on a game server in rust, and every once in a while a review will just stop and refuse to explain what happened. So I know there's a security issue in there somewhere, but neither OAI nor Ant models will tell me what it is. Despite the whole thing, top to bottom, having been built in the last two months on the system they're working on.

Planning to hop on openrouter this weekend to chase it down, but man, it's rough knowing I've already burned the tokens to find it probably half a dozen times at this point, but don't have any information that would help point me at it.

[–] thothless 18 hours ago
"I've been working on..."

Vs

"...system they're working on"

"I know there's a security issue... [Nobody] will tell me what it is"

"I don't have any information..."

This might sound crazy, but have you tried looking at "your" code base?

It's just genuinely baffling to read stuff like this.

I can't imagine feeling so helpless on something I was supposedly "working on".

[–] Silagi 17 hours ago
That seems like the least charitable reading of what I wrote.

"system they're working on" refers to the actual physical hardware.

Yes, I look at the code regularly, and a significant portion is hand written, especially the performance critical sections.

A security issue I haven't been able to track came up in automated code reviews. Maybe you're such a savant that you can crack any security issue in a codebase you're working on, but the last few months of critical security bugs in infrastructure with the most experienced and capable maintainers in the world should at least humble you a little.

[–] y-c-o-m-b 16 hours ago
The other day in one of the Android TV related threads somebody posted a Github repo for an AndroidTV browser app with a rich suite of functionality. I pulled the repo down and asked Claude to scan it because I was concerned about security issues and vibe-coded vulnerabilities. It got about half way through the scan and abruptly stopped, refusing to scan it more nor would it say exactly why it stopped or what it found, only that it was a "security" issue.

Needless to say, I ditched the repo. The problem is I don't know if what it found was legitimate or simply a keyword that set off alarm bells or if my prompt was falsely detected of being malicious. It's very frustrating. When I researched more on this topic, I found users complaining about the same issue when asking Claude to scan new releases of legitimate npm packages (a popular library like react-query for example).

They've simultaneously cultivated a medium for faster and more devastating exploits with no good way of protecting ourselves from them. It's ridiculous.