Dan Lorenc

OSS Supply Chain Security. Founder/CEO/Primary Ariba Admin at

[Dan Lorenc @lorenc_dan]

Open source is dying.

We raised over $800M to save it.

Chainguard is the world’s first infrastructure that stops cyberattacks before they can start:

[Dan Lorenc @lorenc_dan]

Mythos 5.2 is definitely a step above 5.1. It outperforms Gemini Carbon 4 Cyber as well, which had a brief period as the top model in our benchmarks.

Cost is slightly higher even though token cost is lower, but it's finding more things so it's not really apples to apples.

[Dan Lorenc @lorenc_dan]

@GeoffreyHuntley shit I knew I shouldn't have used hunter2hunter2hunter2hunter2hunter2hunter2hunter2hunter2hunter2hunter2hunter2hunter2hunter2hunter2hunter2hunter2hunter2hunter2hunter2hunter2hunter2hunter2hunter2hunter2hunter2hunter2hunter2hunter2hunter2hunter2hunter2hunter2hunter2hunter2hunter2

[Dan Lorenc @lorenc_dan]

@bogdan_veliscu This is a vuln research harness. They're all good enough at tool calling at this point that it's not an issue.

[Dan Lorenc @lorenc_dan]

Pretty impressed with Gemini 4 Carbon after some early testing in our harness. It's keeping up with Mythos 5.1, only real problem is the capacity.

[Dan Lorenc @lorenc_dan]

@Steve_Yegge It seems to be hard to get right now but worth it if you do. You have to give the agent doing the work a bit of confidence.

"Feel free to push back on the review" usually works for me.

[Dan Lorenc @lorenc_dan]

I think open source is going to be fine but the community style projects are going to have to change dramatically or fall to solo/small team ones.

[Charlie Marsh @charliermarsh]

I know I have psychosis but I think it's plausible that a foundational open source project could be supplanted by an agent-developed alternative.

There's so much time / energy spent on existing process designed to solve problems that often don't matter anymore (if your goal is to build better software), so much social and coordination tax, resistance to change, etc.

(I don't know where this goes or what it means for open source.)

[Dan Lorenc @lorenc_dan]

@bradgessler This is the way

[Dan Lorenc @lorenc_dan]

@jgavinray You know where to find us

[Dan Lorenc @lorenc_dan]

Who wants to guess where November will land?

[Dan Lorenc @lorenc_dan]

@utpalnadiger We've got something - dm me

[Dan Lorenc @lorenc_dan]

This is the way

[Arian van Putten @ProgrammerDude]

I think CVSS scoring is dead. CVEs should instead come with a prompt that helps your agent assess if your infrastructure is vulnerable.

We're wasting so much time on this as an industry. Lets give up. Give me the prompts.

[Dan Lorenc @lorenc_dan]

Dear Github,

This new agent button is cool. But we would all much rather you fix the spinning merge thing that doesn't work. It's right above it.

Signed,
Everyone

[Dan Lorenc @lorenc_dan]

@charliermarsh @ibuildthecloud You still look at the code?

[Dan Lorenc @lorenc_dan]

So we’re rebuilding the unsecurable parts, at every layer. Two rules: bugs get found slower than you can ship, and every change is small enough for an agent.

Memory allocators, regex engines, XML libraries, and template engines so far. More coming.

We hae to patch the planet. We also have to rebuild it.

[Dan Lorenc @lorenc_dan]

Vulnpocalypse or vulnerability human centipede?

We’re all sewn in somewhere: labs finding, maintainers fixing, vendors packaging, operators deploying. Nobody likes their spot. Last week showed everyone downstream what’s coming.

https://t.co/PbiKegyzYa

[Dan Lorenc @lorenc_dan]

Even on latest, patching doesn’t win. Most of what we’re finding is the same few bug classes, and you can’t patch a class. You replace the design that keeps producing it.