NHacker Next on Rails
  • top
  • new
  • best
  • ask
  • show
  • jobs
login
GuidelinesFAQListsAPISecurityLegalApply to YCContact

Hacker News on Rails, powered by React on Rails Pro. Open the source on GitHub by ShakaCode.

Commit 06fc0df

Rendered at 08:33:47 GMT+0000 (Coordinated Universal Time) with Rails + React on Rails RSC.

Using Claude to reduce the attack surface of code (anthropic.com)

30 points by dnw 4h ago | 8 comments

messe 4m ago
If only Claude didn't constantly drop to less capable models whenever it encountered anything vaguely cybersecurity related (despite being part of the Anthropic Cyber Verification Program and having Mythos access, albeit limited).

We're strongly pushing for a move to a mix of Codex and open models at my workplace because of Anthropic's ridiculous nanny-ing.

owebmaster 19m ago
The irony of a company using Nextjs for a chat app and React for a terminal UI talking about reducing attack surface.
esperent 8m ago
[delayed]
vasco 1h ago
These guys are now the biggest slowdown to fixing issues with their bullshit cyber detection. They drop a model, let the model find security issues in your code, then when you want to fix them you need to play a game of charades so it doesn't realize it's creating a validation and then a fix for the issue because you might be hacking yourself. Meanwhile attackers are using some ablated deepseek or what have you.
xnorswap 1h ago
It's frustrating. Claude thinks it finds a way to hop from one client to another, but any attempt to get it to demonstrate it isn't relying on something that's already prevented runs into "safety" concerns and gets blocked.

I'm not that hot on the idea of open models, but having something dangled in front of you but suddenly unable to verify is not a good feeling.

With the right amount of coaxing you can sometimes get it to reproduce a PoC with a "TDD first" approach to fixing, but often now that gets blocked too.

featwanz 15m ago
Why wouldn't everyone be hot on open models? Security implications? First time I have heard someone lightly opposing the idea of fully open models.
generic92034 1h ago
On the other hand this sounds like a job guarantee, though. And not only for the moment, as it is not the capability of the model which is insufficient.
vasco 1h ago
So far I can always get around it by starting fresh sessions on a similar problem and without ever mentioning security issues, but why do I have to play this little theater with a tool we pay to use.
esperent 1h ago
> Meanwhile attackers are using some ablated deepseek or what have you.

I think the hackers are just using "not Claude".