Hacker Newsnew | past | comments | ask | show | jobs | submit | MaxLeiter's commentslogin

I think they key thing here is they "isolated the relevant code"

If the exploits exist in e.g. one file, great. But many complex zerodays and exploits are chains of various bugs/behaviors in complex systems.

Important research but I don’t think it dispels anything about Mythos


Seems perfectly comparable to anthropic's method, they just wrapped the same kind of prompt in a for loop.

Did Mythos identify vulnerabilities across files? Afaik Mythos worked the same way, analysing a single file at a time.

FTA:

> In 2022, we built Tart, which became the most popular virtualization solution for Apple Silicon, along with several other tools along the way.

from Tart's github:

> [Tart is for] macOS and Linux VMs on Apple Silicon to use in CI and other automations

My (naive?) hypothesis is this kind of expertise is why OpenAI chose to acquihire.


Same; the reason everyone ran out to buy Mac Minis last month is it gave their Claw access to iMessage, their browser cookies, and a residential IP. Cirrus provides a way to provision and orchestrate MacOS VMs, which is exactly what I did for running Openclaw (for a minute …).

Note that apples terms do not allow someone to sell something like an agent running on macOS. They have explicit cut outs for 24-hour minimum leases of full hardware, but they prohibit this with vms

Not to sell Tart short (it is quite good), but it's "just" a wrapper around Virtualization.framework with a few extra pieces. This is the kind of thing that Codex driven by experts _should_ be able to build very easily.

Agreed. The benefit from not having anyone else or any partial (container) solutions in the computing chain is huge for secure isolation. Getting rid of the intermediary solves a universe of possible problems.

That said, I've been free-riding on tart because they've often surfaced issues I needed to address. Free riders like me are possibly the reason these companies can't make their own way.


Yes, but it’s also currently the best one. They have OCI compatible Mac VM images that are prebuilt. It’s quite good.

interesting that was what i thought this was, it keeps boggling my mind the sums being paid for what really could be built by experienced devs on their own teams

You don't want a 40-men strong team that needs to be managed, you want 2 guys that already did it and are hungry for the next 10 problems all on their own.

"Hey guys, make our agents verify tool use before responding to the user. See you in 2 months. Here's 2$b"


Short term: they don’t need devs to build it, it’s already built

Long term: they now have experienced dev(s?) to build their next products and features


Great write-up. I love hardware running software it shouldn’t support

Each page navigation runs a WebGL shader that reads both the old and new page as live textures via the new texElementImage2D() API, then composites them through the selected compiz inspired effect.

You can test it here (must be using chrome canary): https://compiz-web.vercel.app/, or see the demo video on github


LLM generated READMEs hurt my eyes

But maybe there is some cool stuff here. A lot of prolific AI-assisted engineers I know have their own advanced plan modes, and the CEO plan mode in the repo is interesting (although very token heavy)

https://github.com/garrytan/gstack/blob/main/plan-ceo-review...


MCPs are great for some use cases

In v0, people can add e.g. Supabase, Neon, or Stripe to their projects with one click. We then auto-connect and auth to the integration’s remote MCP server on behalf of the user.

v0 can then use the tools the integration provider wants users to have, on behalf of the user, with no additional configuration. Query tables, run migrations, whatever. Zero maintenance burden on the team to manage the tools. And if users want to bring their own remote MCPs, that works via the same code path.

We also use various optimizations like a search_tools tool to avoid overfilling context


I can add Supabase or Stripe to my project with zero clicks just by setting up a .envrc.


But then the LLM needs to write its own tools/code for interacting with said service. Which is fine, but slower and it can make mistakes vs officially provided tools



My friend and I were able to give claude a (no longer updated) unity arcade game. It decompiled it and created a one-to-one typescript port so it can run in the browser and now we're adding multiplayer support (for personal use, don't worry HN - we won't be distributing it). I'm very excited for what AI can do for legacy software.


v0 actually can directly copy files out of its examples and then apply edits. This saves it from having to write out the long examples verbatim. The rest of your comment is accurate


The comments are pretty good

From @dangs_successor in the first post:

  We've merged several duplicate threads on this topic. Please keep the discussion substantive and avoid personal attacks.

  Also, yes, my username is silly. The previous dang retired in 2031 and I lost a bet.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: