quasar

just a security researcher

[quasar @quasar249]

@ProfBuehlerMIT repo does not exists

[quasar @quasar249]

submission fees are annoying - why is there no refund for duplicates

[quasar @quasar249]

@0xSCSamurai @ImmunefiFdn @immunefi or at least fee refund for duplicate reports

[Immunefi @immunefi]

Welcome to Immunefi, @cosmoslabs_io.

One of the foundational Layer 1 stacks in crypto is bringing its bug bounty program to the largest security researcher community in Web3.

Excited for what the next 90 days will show. 🔥

[quasar @quasar249]

finally top100 on immunefi

[quasar @quasar249]

@RareCodeAI How to fix this error on https://t.co/EWDbTjt21H 'Error during test execution: fetch failed' ?

[Jeffrey Scholz @Jeyffre]

1 - So GLM 5.2 is 700b parameters (ish)

2 - 4x DGX Sparks can supposedly handle up to 700b parameters (give or take)

3 - GLM 5.2 is supposedly in striking distance of the performance of GPT 5.5 and Opus 4.8. In my brief tests, it's really not shabby at all.

4 - So for $20k, you can get near the frontier on your table.

5 - Extrapolate the trend, and you could have mythos/5.5 pro - class models in your dining room for the cost of a cheap car less than five years from now. Even without extrapolation, we're already the near frontier running locally.

6 - Paying real api costs, I could easily blow through $3,000 per month coding and running agents. The machine pays for itself in 6-7 months conservatively.

7 - In 3-5 years, most power users of AI will self-host.

8 - Am I missing something?

[Marco Hextor @marcohextor]

On Fable 5 and "Evil Anthropic":

Anthropic is giving you a cheap preview of what happens when you let your critical capabilities depend on a centralised third party.

Take the lesson, then plan accordingly.

[LonelySloth @lonelysloth_sec]

The dead internet scenario is very possible — LLMs stop improving and actually degrade because they are trained on their own slop.

The incentives for humans to write novel stuff and publish are also near zero.

The worse risk is that it will make humans dumber in two ways. They unlearn how to do things without LLMs. They don’t share knowledge anymore.

I don’t know how we prevent that future.

But I think not forgetting how to do things without the robots is a start.

[LonelySloth @lonelysloth_sec]

You provide the data for the models to be trained. You didn't opt in, but they took it for free anyway.

There's no attribution whatsoever.

Then they sell it back to you.

Then they tell you selling it back to you is too risky, so they keep the results of your work to themselves.

Why would anyone ever publish anything again?

We're headed to the new dark ages.

Exponential Intelligence Implosion.

[Jeffrey Scholz @Jeyffre]

You should either yolo-solve your technical problem with AI loops or think things through carefully with pen and paper with no internet (preferably using candlelight or sunlight).

Anything in between is suboptimal.

[sysls @systematicls]

Our honesty is all we have; and being able to speak one's truth and own it is a mark of a man.

[LonelySloth @lonelysloth_sec]

I think the idea AI will just generate Formal Verification for code and everything will be fine is very dangerous.

The limitations of FV are the same if an LLM or a human wrote it.

You "change" the target from the code to whether the formal description actually represent what goes on in the code and if the properties proven are the correct ones, or sufficient for what you need from the code.

I put "change" in quotes bc if the FV wasn't correctly constructed then the full code is still a target.

So you don't actually remove the need to audit the code or the possibility of exploiting the code.

It's more like a test/fuzz harness that makes bugs less likely than something that guarantees bug-free code or even reduces the surface to be examined.

**And I think mistaking one for the other is very dangerous. In general thinking there is a silver bullet that can guarantee code is safe will make code even less safe.**

That isn't saying FV can't be great. It's just not the guarantee some people think.

And it's even less of a guarantee when an LLM wrote it for you, and you dont fully understand it (like tests, audits, or anything else if you just trust it uncritically).

[quasar @quasar249]

@ethereumfndn please fix https://t.co/8hGr1HC9jg, it does not work

[WhiteHatMage @WhiteHatMage]

@immunefi Espresso & Hunt

[WhiteHatMage @WhiteHatMage]

Most protocols are lowering bounties this year while hacks are spiking. Dumbest move ever.

Bounties are only paid if a vulnerability is found. It's not an expense, it's risk management.

Meanwhile some chad protocols like Aave are increasing their bounties. Good move.

[LonelySloth @lonelysloth_sec]

If LLMs finding bugs missed by multiple human auditors makes it super-human.

When I find bugs missed by multiple humans and AI does it make me super-super-human?

When then people catch bugs I missed do they become super-super-super-human?

Congrats to teams finding bugs with whatever tools they use.

But for the people making a living off bounties, finding stuff missed by dozens of the best auditors is just a Tuesday.

Nothing super human about it.

[Mitchell Amador @MitchellAmador]

Big platform update for Immunefi All Stars: Streamlined report escalations.

We've removed the friction that was getting in the way of top whitehats doing their best work.

What it means for Immunefi All Stars: No submission fees. No rate limits. No mediation cooldowns. No identity gates that slow down urgent disclosures.

The All Stars have earned this through consistent, high-quality work on the platform - they've proven they're here to protect protocols, not spam them. These are the researchers who've built trust through performance, and we're building the platform to match that trust.

When a critical vulnerability is found, speed matters. Top whitehats don't need to be slowed because of platform anti-spam bureaucracy.

This is what it looks like when we actually listen to our top researchers and remove the barriers that shouldn't have been there in the first place.

The goal has always been simple: make it easier for the good guys (all of you!) to win. Happy hunting.

[quasar @quasar249]

Firedancer v1.0 audit contest, 3 days left. Several BHM issues, all turned out to be already patched in upstream - so ineligible as duplicates. Still fuzzing.

[Mitchell Amador @MitchellAmador]

We're doing another massive million dollar audit competition on Immunefi.

Hunt, earn a fortune, and become a legend.