The point is that memory issues are a smallish number of issue compared to the larger ecosystem of vulnerabilities, and choosing to port everything to Rust is like over-optimizing. Well, that’s my 2 cents.
For a language as ugly as Rust, my thought is that people should actually be using Ada, and have a mathematically provable correctness angle; not just a replacement for C/C++ with memory safety.
Perhaps. But what percentage of exploits are actually zero days versus, say, 10 days or 100 days?
Most exploited code probably exists in the application layer in a high-level, memory safe language. I would wager that but I don’t have time to cite ten papers on HN.
Rust and Ada are about equally safe, both have advantages and disadvantages. Perhaps you're thinking about SPARK ADA, but that's a different kettle of fish.
It's a bit like saying you should program in C, because formal verification tool X generates C code hence C is safe.
Rust and non-SPARK Ada are not equally safe. Ada is unsafe in the presence of data races, and also has runtime checks that slow it down, or you disable them and then it's even less safe.
> would you prefer they just release it as-is and everyone suffers data-breaches and more supply-chain attacks?
Yes, because then we get to use SOTA models to defend against the exact same attacks. Fable detected issues in my projects but got downgraded back to Opus before it could tell me about them or fix them. In what world could that possibly be reasonable?
I agree and don’t think they should have been forced to pull it, but what I’m surprised about is how many people are accusing Anthropic of being liars or trying to overhype the danger. It IS dangerous, which is why it can identify vulnerabilities.
Plenty of knowledge is dangerous. However, some principles are more important than danger. Freedom of information and learning is one such principle. I find it extremely offensive when they speak of the dangers of "uplifting" people.
Is this not the same as security by obscurity? Open source is more secure because it's more open and thus is able to have flaws found in it more easily. So I'd probably prefer more people to have Fable level models than not.
Perhaps. Open source is also more vulnerable because the source is out in the open. As we’ve seen it doesn’t matter with supply-chain attacks.
I’m not a security expert by any stretch, and I also want Fable it helped me a lot in a short time, but I don’t like that so many people are throwing shade at Anthropic for speaking the truth. Mythos and Fable are dangerous.
For a language as ugly as Rust, my thought is that people should actually be using Ada, and have a mathematically provable correctness angle; not just a replacement for C/C++ with memory safety.
reply