Conversation

Notices

1. Embed this notice
   Hailey (hailey@hails.org)'s status on Friday, 10-Apr-2026 09:55:54 JST Hailey

   so it cost anthropic $20k to find this openbsd crash bug which amounts to putting a negative integer in a tcp field where a negative integer was not expected by the c code which does some cavalier int cast bullshit, ie. a vuln which is totally fuzzable, and quite certainly would have been found by the fuzzers of the 2010s had anyone cared to burn that much compute on fuzzing openbsd.

   The difference today is not that anybody suddenly cares about investing that much in openbsd (is the build server still a donated machine running in Theo's basement?), but that openbsd's reputation for security makes it really good marketing if you can find a bug, any bug, it doesn't matter; and that marketing value is what makes it worth spending $20k on fuzzing.

   • Rich Felker repeated this.
   • Embed this notice
     Hailey (hailey@hails.org)'s status on Friday, 10-Apr-2026 09:55:53 JST Hailey

     in reply to

     I don't mean to throw shade at openbsd here, it's a scrappy project running on the smell of an oily rag and I have a lot of respect for that kind of scrappy resourcefulness, but it's key to understanding why the most salient factor here is big tech deciding to throw lots of money at it. That this is the best they got for $20k really speaks to why nobody bothered previously.

   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Friday, 10-Apr-2026 09:56:34 JST Rich Felker

     in reply to

     @toerror @hailey Millions.

   • Embed this notice
     toerror (toerror@mastodon.gamedev.place)'s status on Friday, 10-Apr-2026 09:56:35 JST toerror

     in reply to

     @hailey I find myself wondering - if they spent 20k finding that bug, what did they also spend finding nothing.
     How are the books actually cooked?