The recent news about this new LLM has me wondering if Anthropic has uncovered any security vulnerabilities in any Linux-based kernels or other software packages that IPFire uses. If so, will there be accelerated patching done?
With the rise of AI, this whole situation is rather unsettling. In the end, it will be like the “bad guys” attacking with military-grade weapons against security forces using rubber bullet shotguns.
I’m sure some UTM manufacturer (Sophos, Watchguard, Fortinet, etc.) will release an AI-based module to address what’s coming.
I think it would be interesting to transfer this AI from Anthropic to IPFire to see what it finds. This isn’t to diminish the commendable work of the IPFire developers, it’s because of “move 37”. Move 37: The move that redefined the future
Hello,
I am glad we can talk about this, because this will probably require large changes in how we think of distributions. But not in the obvious ways.
Yes, probably, the upcoming release will feature a lot of package updates that have many CVEs in a single release. Wherever those vulnerabilities were discovered (AI or not), there seems to be a larger sensibility for them out there.
But a vulnerabilities are not always the same. They might be easily exploitable, they might not be exploitable at all. They might require you to already have access to the system to then elevate your privileges or there might be an exploit that needs to send you a single packet to DoS your entire company.
We must evaluate how likely something is to exploit and if so how big the damage could be to really asses our next steps.
I wish 
A couple of days ago we released Core Update 201. As of writing this post three days later, less than 4.5% of the systems reporting to fireinfo have installed the update.
This really influences how we would make patching decisions, because what is the point of having fully patched releases available when people don’t install the updates and are exploited anyways.
This is not a question of supply of patched releases, but also a question of how quickly they end up out there in the world.
That could be, but I am also seeing that gun being pointed at the open source ecosystem. Filing a ton of “potential” bug reports with suspected security implications isn’t helpful. Which maintainer has the time to go through all of them, verify them, develop a fix, build a release, and so on? This will completely shut down large parts of the ecosystem for no benefit.
Maintainer burnout is already the topic of at least one talk at every open source conference and it is simply not getting better. Filing the “wants” and “oh yeah but you really should” is not doing anything good if there is no backing for all these people working on the code. They will need money, they will need build resources, they will need a community that supports them. So unity is a key ingredient here so that we can actually improve the software is critical and we should not just fix random issues just because someone filed a ticket.
I don’t know what you are referring to, but in security, AI does not have a place. Any kind of security feature, like IPFire’s firewall engine for example, has to be auditable, reproducible, deterministic and clearly configurable. If people recommend to buy something that replaces these principles with some AI and more buzzwords, I would pull the plug immediately. So let’s not think that AI is the solution to the problems that we have through AI.
I am happy for anyone to report any security vulnerabilities to us and we will take them seriously. But please consider our AI policy and other guidelines on how to do this. Otherwise you will become part of the problem and actually make open source software worse. Nobody wants that.
And if you are not a security researcher, I can only urge you very much to help strengthening your favourite open source projects in any possible way. This has never been more important than now.
If you read the entire article I linked (it’s very long), you will see that Anthropic is being responsible and attempting to keep Mythos Preview private until they use it to find and patch as many critical infrastructure vulnerabilities as possible. Mythos found a 27 year old bug in OpenBSD and they reported and privately fixed it before this article was published. They are letting companies like Apple, Google and Microsoft have private access to it. They (Anthropic) are hitting critical open source software packages hard to try to find, report, and help fix as many of the worst bugs as possible. The idea being, if most critical software is patched before Mythos is released to the public, it will be harder for the bad guys to find vulnerabilities with Mythos once they have access to it. The authors acknowledge that there will be more LLMs to follow, both from Anthropic and other companies, and they are only more likely to get better at finding exploitable vulnerabilities. The question is, who develops them first? The “good guys” or the “bad guys”?