12:19:39 <br-m> <monero.arbo:matrix.org> re: Claude Mythos preview https://blog.mozilla.org/en/firefox/ai-security-zero-day-vulnerabilities/
12:32:42 <br-m> <syntheticbird> @monero.arbo:matrix.org: tl;dr corporate mozilla bullshit about how they really care about security. 
12:32:42 <br-m> <syntheticbird> There is nothing in this that permit someone to distinguish between groundbreaking AI vulnerability assessement or Firefox codebase being utter garbage
12:34:34 <br-m> <syntheticbird> nothing about the severity of the vulnerabilities have been disclosed
12:34:44 <br-m> <syntheticbird> nothing about when these vulnerabilities will be disclosed
12:35:01 <br-m> <syntheticbird> so much for a company that market on transparency
12:51:17 <moneromooo> Come on. It's 100% transparent. You're looking at it and not even seeing it.
13:15:26 <br-m> <syntheticbird> moneromooo: https://mrelay.p2pool.observer/m/monero.social/ugcVvmaFcUcDvZZHmQAwxxws.png (image.png)
13:48:29 <br-m> <monero.arbo:matrix.org> honestly find this take dangerously dismissive and if anything it reinforces my fear that people here are writing off AI security concerns with undue confidence > <@syntheticbird> tl;dr corporate mozilla bullshit about how they really care about security. 
13:49:54 <br-m> <monero.arbo:matrix.org> Nothing you said is wrong per se but I don't think any of it amounts to a good reason to dismiss out of hand what an open source project the size of Mozilla is saying about its effectiveness
13:53:53 <br-m> <ixr3:matrix.org> @syntheticbird: It found 1 high severity and 2 medium severity vulnerabilities. https://www.mozilla.org/en-US/security/advisories/mfsa2026-30/
13:54:23 <br-m> <ixr3:matrix.org> Nothing significant
13:54:29 <br-m> <syntheticbird> If anything a security critical project must show skepticism about and seriousness when it comes to security related matters. I know that what I am saying right now is in the great legacy of others here who have expressed hatred against AI generated reports. None of what I am saying here is meant to dismiss the possibility for [... too long, see https://mrelay.p2pool.observer/e/_Lff9_sKZVA4TG1O ]
13:54:29 <br-m> <syntheticbird> 1. I'm awaiting for serious evidence of what has been claimed because so far we just have big meaningless numbers. Most of the AI reports the H1 team gets and other projects are bogus and slop. That's mythos claims soudns extraordinary and therefore requires extraordinary proofs.
13:54:29 <br-m> <syntheticbird> 2. This one is purely opinionated, I have zero trust in mozilla corporation. They have for a very long time been subject to financial dependence and have shown lot of tomfuckery when it comes to how they handle their own employees.
13:56:15 <br-m> <syntheticbird> @ixr3:matrix.org: Thank you. That indeed make more sense
13:56:41 <br-m> <syntheticbird> In 271 vulnerabilities, only 3 were of significance.
13:57:02 <br-m> <syntheticbird> That is makes the claim fell from extraordinary to within the expectation of AI tools
13:57:22 <br-m> <ixr3:matrix.org> @syntheticbird: Yes. While others humans found many more
13:57:31 <br-m> <syntheticbird> that only reinforce my hatred towards the way this article has been wrote to suggest an epic grounbreaking discovery in software security
13:58:23 <br-m> <syntheticbird> saying zero-days, is just appealing to the public because people imagine an RCE or LPE upon hearing it
13:58:24 <br-m> <monero.arbo:matrix.org> well this is a bit of a tangent but I am aware mozilla has generated a lot of ill will, still I have a soft spot for them because they seem like the only thing standing between us everything being chromium based
13:59:13 <br-m> <monero.arbo:matrix.org> on topic, I gotta say that while most individual vulnerabilities might not be that big, a bunch of smaller ones can potentially be chained together into something bigger
14:00:20 <br-m> <monero.arbo:matrix.org> anyway, I just don't want us to find out that these tools are effective by being exploited by a group using one. not ideal.
14:00:27 <br-m> <syntheticbird> @monero.arbo:matrix.org: Servo and ladybird are very far from to be on par with Gecko or Chromium. I indeed share that frustration
14:01:50 <br-m> <syntheticbird> @monero.arbo:matrix.org: If we talk about browser in particular. You will never find someone selling a single vulnerability. They always an exploit chain, which is extremely rare to pull off and so far, in browser again, are limited to a few versions most of the time
14:01:52 <br-m> <ixr3:matrix.org> @monero.arbo:matrix.org: In that case, some should have been marked as higher severity.
14:02:27 <br-m> <syntheticbird> just to say that even if people discover single vulnerabilities in browser they aren't particularly gonna communicate or trade them unless they pull up an entire chain.
14:02:30 <br-m> <monero.arbo:matrix.org> for sure
14:02:43 <br-m> <syntheticbird> people = malicious actor
14:03:09 <br-m> <syntheticbird> @ixr3:matrix.org: nah. CVSS scoring is broken for this
14:03:25 <br-m> <syntheticbird> Either you follow the criteria or you don't
14:03:46 <br-m> <syntheticbird> but you can perfectly get a sandbox escape and code execution with medium severity vulnerabilities only
14:03:58 <br-m> <syntheticbird> this is critical in practice, but not in cvss criteria
14:04:23 <br-m> <syntheticbird> the scope is playing a lot in the score
14:04:45 <br-m> <ixr3:matrix.org> Mozilla does increase the severity if it's chainable if I'm right > <@syntheticbird> nah. CVSS scoring is broken for this
14:05:10 <br-m> <syntheticbird> @ixr3:matrix.org: I'll take your word for it. Didn't know they were a CVE authority
14:05:19 <br-m> <ixr3:matrix.org> They mention it in that case
14:05:26 <br-m> <ixr3:matrix.org> I follow each CVE of mozilla
14:07:16 <br-m> <hinto> > <@monero.arbo:matrix.org> well this is a bit of a tangent but I am aware mozilla has generated a lot of ill will, still I have a soft spot for them because they seem like the only thing standing between us everything being chromium based
14:07:16 <br-m> <hinto> there is a pattern of relatively much smaller orgs that defacto uphold certain values being easy scapegoats by the very communities that benefit from them, almost as if all industry problems are pinned on them
14:08:19 <br-m> <syntheticbird> i hate tribalism
14:08:47 <br-m> <syntheticbird> @hinto: i agree with that statement but is it a pattern you have observed on your own, does it have a name ?
14:09:27 <br-m> <syntheticbird> if this is studied in a field then that's a topic i would like to know more about
14:11:55 <br-m> <ixr3:matrix.org> I don't understand why Mozilla is promoting Mythos at the expense of their own brand. Calling 271 vulnerabilities when only three are significant. > <@monero.arbo:matrix.org> re: Claude Mythos preview https://blog.mozilla.org/en/firefox/ai-security-zero-day-vulnerabilities/
14:12:40 <br-m> <jpk68:matrix.org> Even by Mozilla's own admission, the exploits were nothing that couldn't have been found by a human researcher > <@monero.arbo:matrix.org> Nothing you said is wrong per se but I don't think any of it amounts to a good reason to dismiss out of hand what an open source project the size of Mozilla is saying about its effectiveness
14:12:58 <br-m> <ixr3:matrix.org> @ixr3:matrix.org: Listing 271 sounds alarming. It doesn't make users feel any safer.
14:13:12 <br-m> <syntheticbird> @ixr3:matrix.org: you would be surprised
14:13:25 <br-m> <syntheticbird> most people are updooter
14:13:34 <br-m> <syntheticbird> the more zero days patched the safer they feel
14:13:37 <br-m> <syntheticbird> while this should actually be the opposite
14:14:03 <br-m> <ixr3:matrix.org> @syntheticbird: Yes hahahaha
14:14:05 <br-m> <syntheticbird> they don't have the concept of attack surface and they don't intuitively understand that each new version brings its lot of new vulnerabilities
14:14:53 <br-m> <jpk68:matrix.org> Ladybird has improved a lot recently... two weeks ago it had a bunch of rendering issues with SVG graphics on the beta site, but it's seemingly all fixed now > <@syntheticbird> Servo and ladybird are very far from to be on par with Gecko or Chromium. I indeed share that frustration
14:15:12 <br-m> <jpk68:matrix.org> *the beta Monero site
14:15:30 <br-m> <syntheticbird> nice. I should try it out then
14:17:04 <br-m> <jpk68:matrix.org> You have to build it from source still (including vendored ffmpeg and Skia, lol)
14:17:15 <br-m> <jpk68:matrix.org> It takes like an hour
14:18:15 <br-m> <ixr3:matrix.org> I'm not dismissing AI security concerns. I'd like Mythos to scan the Monero code, but I dislike the marketing around it. Humans are still far better > <@monero.arbo:matrix.org> honestly find this take dangerously dismissive and if anything it reinforces my fear that people here are writing off AI security concerns with undue confidence
15:01:04 <br-m> <monero.arbo:matrix.org> @ixr3:matrix.org: fair take for sure
15:03:00 <br-m> <monero.arbo:matrix.org> yeah that's very notable, it's just that the available man-hours to hunt for them didn't really exist. hence why they hadn't been found before > <@jpk68:matrix.org> Even by Mozilla's own admission, the exploits were nothing that couldn't have been found by a human researcher
15:24:46 <br-m> <boog900> @vtnerd:monero.social: do you know if it is normal for stem txs to group up in a single message, AFAIK they should be sent as soon as you receive one so they shouldn't bunch up.
15:27:29 <br-m> <boog900> I have nodes sending me 10s or 100s of stem txs in a single message and my node knows them all already
15:53:04 <br-m> <vtnerd> independent, exponential delays to its neighbors on the P2P graph."
15:54:22 <br-m> <vtnerd> I interpreted this to mean there should be bulk transmits, to confuse receive order (the txes should be sorted), but realistically this could be interpreted to mean each connection AND each tx has an independent timer 
15:55:08 <br-m> <vtnerd> I recall Bitcoin implementing it the way monero does now, but it's possible I botched this somehow
15:56:34 <br-m> <vtnerd> Unfortunately diffusion was basically defined as "whatever Bitcoin happens to be doing right now"
15:58:13 <br-m> <boog900> That's for fluff though right, these are txs sent in stem state 
16:01:40 <br-m> <vtnerd> Oh stem, sorry, it should be immediate, let me double check
16:04:16 <br-m> <vtnerd> The only time this should occur is when a node receives multiple from a stem. I.e. a node received 2 in one shot via stem, then the current algorithm will forward both in one shot via stem
16:05:04 <br-m> <vtnerd> But it otherwise wouldn't occur naturally. A spy node could be interfering with this process, which you would notice indirectly or directly 
16:05:06 <br-m> <boog900> So someone has custom code crafting these messages, that's worrying. 
16:05:16 <br-m> <vtnerd> Yes, that's my guess 
16:05:19 <br-m> <syntheticbird> There is a new node impl in town ?
16:05:31 <br-m> <syntheticbird> Awesome
16:05:43 <br-m> <vtnerd> Technically the spies were just that ...?
16:05:50 <br-m> <boog900> I think we should add a check that ignores stem messages which have more than 1 tx. 
16:05:59 <br-m> <syntheticbird> we don't know
16:06:01 <br-m> <syntheticbird> it's modified monerod for sure
16:06:08 <br-m> <syntheticbird> and proxies written in java
16:06:13 <br-m> <boog900> They probably are abusing this somehow to work out the stem graph 
16:06:18 <br-m> <syntheticbird> but not a full reimpl on a node
16:06:43 <br-m> <vtnerd> Yeah it might leak data somehow, have to think about it
16:07:31 <br-m> <boog900> Multiple IPS are doing this fwiw but it doesn't happen all the time 
16:07:55 <br-m> <syntheticbird> IPS ?
16:08:01 <br-m> <syntheticbird> ip subnet?
16:08:16 <br-m> <boog900> IPs 
16:08:27 <br-m> <boog900> Nah just singles 
16:08:27 <br-m> <ofrnxmr:xmr.mx> Plural form of IP
16:08:42 <br-m> <syntheticbird> thanks ofrn
16:12:53 <br-m> <vtnerd> Possible, but we'd probably need to update rpc to forward one at a time just in case > <@boog900> I think we should add a check that ignores stem messages which have more than 1 tx. 
16:13:23 <br-m> <vtnerd> Http rpc used by wallet 
16:13:25 <br-m> <syntheticbird> by updating rpc, you mean the endpoint ?
16:13:43 <br-m> <syntheticbird> you can't just buffer them and sending them sequentially ?
16:14:33 <br-m> <vtnerd> Yes, it's just that if it allows 2+ now (I'd have to check to verify), we could temporarily block some legit cases as the nodes roll out
16:14:50 <br-m> <vtnerd> It'd be rare to the point of being practically irrelevant though 
16:15:03 <br-m> <vtnerd> Oh I just thought of one case!
16:15:25 <br-m> <ofrnxmr:xmr.mx> Relay fails and it re-attemots after n minutes?
16:15:27 <br-m> <vtnerd> If the TX is received over tor/i2p is randomly delayed, so these might be grouped because of that
16:16:14 <br-m> <ofrnxmr:xmr.mx> txs coming from anonymous-inbound?
16:20:22 <br-m> <vtnerd> Yup, it's either custom nodes or tor/i2p
16:22:10 <br-m> <vtnerd> I decided to add a randomized delay to txes received over tor/i2p, and that delay is only to the seconds granularity, checked once a second
16:22:49 <br-m> <ofrnxmr:xmr.mx> If its 100s, and boog already has them, i think custom
16:23:25 <br-m> <ofrnxmr:xmr.mx> 100s of txs, not 100 seconds*
16:46:49 <br-m> <boog900> @vtnerd: hmm yeah, I wonder if that itself is a data leak
16:47:49 <br-m> <boog900> like we know these txs were all sent over Tor
16:48:15 <br-m> <boog900> and the nodes txs it creates itself will be sent as singles 
16:49:22 <br-m> <boog900> and yeah I would be surprised at so many txs going over a single Tor node at pretty much the same time 
16:55:52 <br-m> <ofrnxmr:xmr.mx> if you already have the txs, for them to arrive on an anonymous-inbound, theyd have to come from a tx-proxy, which means youd have to have a hundred txs sent to rpc -> relayed to a single node over tx-proxy -> delayed AND somehow already had seen them on your own node
16:55:58 <br-m> <ofrnxmr:xmr.mx> Sounds like it must be a custom node
17:17:35 <br-m> <ixr3:matrix.org> You’ve made important discoveries in the past and now. I'm glad BinaryFate chose to fund you through the GF > <@boog900> I have nodes sending me 10s or 100s of stem txs in a single message and my node knows them all already
23:44:56 <br-m> <elongated:matrix.org> How are zcash shielded txs around 3k while fcmp will be 10k+ ?
23:54:02 <br-m> <jeffro256> Where did you get 3k from ? 
23:54:56 <br-m> <jeffro256> Try 9k
23:55:21 <br-m> <jeffro256> https://mainnet.zcashexplorer.app/transactions/59b9dbac637e34068200ad503bdc7e57a227433a3286fb5d81058f5a1cbf3cff
23:56:16 <br-m> <jeffro256> This is a 2 "action" tx, which is the size for a 1-in/2-out tx. It's 9165 bytes 
23:59:13 <br-m> <jeffro256> Granted, ~1000 of those bytes are for encrypted memos IIRC