IainIreland

8 ms·

1.
by IainIreland 4mo ago
We have a bounty program. If you can find security bugs in Firefox, please let us pay you for them. You don't need to provide a fix; a testcase that crashes in an interesting way is often enough to qualify. https://www.mozil
2.
by IainIreland 4mo ago
I never got direct access to Mythos, so all I know is what I've seen from the quality of the bugs being produced. I also haven't been involved at the prompting end. So the best answer I can give is: I dunno, maybe it's possib
3.
by IainIreland 4mo ago
Yeah, the test with the patch also adds comments. The human reviewer had extra context available. I did get Opus to do an audit for similar problems elsewhere, to supplement the investigations that we were already doing by hand. It initiall
4.
by IainIreland 4mo ago
If I had to guess, I'd say that AI is better at finding TOCTOU bugs than fuzzing because it starts by looking at the code and trying to find problems with it, which naturally leads it to experiment with questions like "is there an
5.
by IainIreland 4mo ago
The same is also true of a good security researcher, and has been for a long time. The question is mostly whether it takes long enough to come up with a testcase that we've managed to ship the fix to all affected releases, and given pe
6.
by IainIreland 4mo ago
I work on SpiderMonkey, so I mostly looked at the JS bugs. It was a smorgasbord of various things. Broadly speaking I'd say the most impressive bugs were TOCTOU issues, where we checked something and later acted on it, and the testcase
7.
by IainIreland 4mo ago
Yeah, fuzzing, sanitizers, and bug bounties were our main pre-AI tools for finding bugs.
8.
by IainIreland 4mo ago
There doesn't have to be a huge qualitative discontinuity between Opus and Mythos. It's just that Mythos has reached a threshold where it's finally smart enough that putting it in a loop and asking it to find bugs is suddenly
9.
by IainIreland 4mo ago
I work at Mozilla; I fixed a bunch of these bugs. In general, I would say that our use of "vulnerability" lines up with what jerrythegerbil calls "potential vulnerability". (In cases with a POC, we would likely use the w
10.
by IainIreland 5mo ago
This is really cool. Thanks for the write-up, Chris! I kept waiting for "sea of nodes with CFG" to be shortened to SeaFG, and it never happened. I guess maybe it's ambiguous out loud.
11.
by IainIreland 11mo ago
One clear use case for GC in Rust is for implementing other languages (eg writing a JS engine). When people ask why SpiderMonkey hasn't been rewritten in Rust, one of the main technical blockers I generally bring up is that safe, ergon
12.
by IainIreland 11mo ago
Cranelift does not use copy-and-patch. Consider, for example, this file, which implements part of the instruction generation logic for x64: https://github.com/bytecodealliance/wasmtime/blob/main/crane...
13.
by IainIreland 1y ago
Yeah, SM will compile functions with try/catch/finally, but we don't support unwinding directly into optimized code, so the catch block itself will not be optimized.
14.
by IainIreland 1y ago
I don't know how JSC handles it, but in SM `eval` has significant negative effects on surrounding code. (We also decline to optimize functions containing `with` statements, but that's less because it's impossible and more bec
15.
by IainIreland 1y ago
This isn't about languages; it's about hardware. Should hardware be "higher-level" to support higher level languages? The author says no (and I am inclined to agree with him).
16.
by IainIreland 1y ago
This is really impressive analysis.
17.
by IainIreland 1y ago
This doesn't read as AI-generated to me at all. The prose isn't polished enough to be AI. AI generation is unlikely to produce missing spaces like "...which are not readable to humans.SDB uses eBPF ...", or grammatical i
18.
by IainIreland 2y ago
Copy and paste all four lines at once.
19.
by IainIreland 2y ago
Taking a quick look at the JSC code, the main difference is that CacheIR is more pervasive and load-bearing. Even monomorphic cases go through CacheIR. The main justification for CacheIR isn't that it enables us to do optimizations tha
20.
by IainIreland 2y ago
asm.js solves this in the specific case where somebody has compiled their C/C++ code to target asm.js. It doesn't solve it for arbitrary JS code. asm.js is more like a weird frontend to wasm than a dialect of JS.
21.
by IainIreland 2y ago
The main thing we're doing differently in SM is that all of our ICs are generated using a simple linear IR (CacheIR), instead of generating machine code directly. For example, a simple monomorphic property access (obj.prop) would be Gu
22.
by IainIreland 2y ago
We talk about this a bit in our CacheIR paper. Search for "IonBuilder". https://www.mgaudet.ca/s/mplr23main-preprint.pdf
23.
by IainIreland 2y ago
I believe the technical term for the property that existing JS engines lack here is "safe for space". The V8 bug ( https://issues.chromium.org/issues/41070945 ) has already been linked elsewhere). Here's a
24.
by IainIreland 2y ago
I can't speak for any other engines, but in SpiderMonkey a BigInt is a GC-managed object with a one-word header containing the sign bit, the length, and some GC bookkeeping bits, along with a second word that is either a single inline
25.
by IainIreland 2y ago
This seems unlikely, given that the moai were mostly carved from tuff from a specific crater ( https://en.wikipedia.org/wiki/Rano_Raraku ), whereas the stone gardens are made of "fresh basalt quarried at nearby vall
26.
by IainIreland 2y ago
The whole point is that the sandbox is an approach that can be used in JIT code, where Rust doesn't help. Take the fizzbuzz example with a missing bounds check. Rust can't prevent you from generating JIT code that omits a bounds c
27.
by IainIreland 2y ago
Those are the intended semantics of JS, but that doesn't help you when you're the one implementing JS. Somebody has to actually enforce those restrictions. Note that the code snippet is introduced with "JSArray::buffer_ can b
28.
by IainIreland 3y ago
Yes. The speedometer graphic was inherited from Speedometer 2. When Speedometer 2 was released, scores were in a reasonable car-speed range. The combination of hardware and software improvements meant that early versions of Speedometer 3 (w
29.
by IainIreland 3y ago
"The score is a rescaled version of inverse time" is the key here. If you run all the tests in half the time, your Speedometer score will double. If your score improves by 1%, it implies that you are 1% faster on the subtests. (Th
30.
by IainIreland 3y ago
(I work on SpiderMonkey.) Benchmarking is hard. It is very easy to write a benchmark where improving your score does not improve real-world performance, and over time even a good benchmark will become less useful as the important improvemen

More ›