Has the OPNsense team applied for Claude Mythos access yet?

[drosophila]

Judging from it's most recent response, the SPAMbot has lost the plot now. So much for AI. XD

Yeah, a fuzzer can be useful, and AI tests may effectively be a "stateful fuzzer". Still the old saying "don't believe the hype" stands strong and it's certainly nothing that must be done now, immediately. Let the dust settle and see what remains.

And I prefer spaghetti code to the risotto code we get today. With spaghetti code, you can at least scroll and find (by /, F3, whatever) directly because you know which file it is in. With risotto, you have to search through countless files for a one-liner that merely sets some parameters in something that you then need to find in yet another file, in another directory, rinse, repeat. Yes, this can be fixed by good indexing that can tell the difference between declaration, implementation and calls, if it has a quick way to access it without digging through countless sub-menus. To stay on topic: maybe AI would work for that as well, but it's not needed. The only benefit would be that it could generate a meaningful summary of what the respective function actually does.

[OPNenthu]

I see a lot of focus on software bugs but is there a similar push to work out issues in silicon?  Or are those proprietary secrets too precious to ever let these AIs sniff around in? 🤔

[connervt]

I work in semiconductor manufacturing (25+ years now).  The "silicon" you are talking about, CPU/GPU/SoC CMOS logic, has some of the most guarded IP (Intellectual Property) that you can imagine.  The companies offering LLM AI also make semiconductor chips, so there is no way they will ever let AI get a whiff of them.

That said, there is extensive use of computer algorithmic review during all phases of development, manufacturing and test.  Companies such as Cadence Design Systems have been offering tools to the semiconductor industry for decades.

[serving_myself]

Not on your radar at the moment.


Cheers,
Franco

Hello Franco,

Has something changed after these past few months?

I'd like to voice an opinion on this subject as a (home) user of OPNsense.

Major vendors of commercial network security products have all joined the party. Of course, from the outside, it may seem like a marketing/PR stunt ("let's join to show everyone how serious we're about security", "X joined so we also have to, otherwise X's sales will say to the customers that we aren't serious enough about security", etc.). I can't know what were the incentives at the start of it, but it's certainly not the case today.

During the past few months, the number of security-related software updates in some relevant commercial software products increased significantly. I know it is taken very seriously inside those companies.

Leaving aside the political, economic, and social aspects of AI as a phenomenon, in my opinion, ignoring its direct impact on the security/tech landscape is not pragmatic.

I don't know what requirements a FOSS project like OPNsense would have to meet to get involved in Glasswing (and I appreciate the amount of work this can potentially generate for maintainers), but my suggestion would be to at least have a look and try to get access.
After all, if getting access itself is not a lot of work, the worst that could happen is that all you get is useless false positives and/or minor things not worth fixing (immediately). In return you will learn the current baseline for frontier AI security capabilities in the context of OPNsense codebase and get a confirmation that (at least at the moment) OPNsense is safe in this brave new world. And us, users, will also get a peace of mind.

Of course, I don't have your full perspective, so it'd be valuable to at least understand why not.