Steve Gibson

speaker

30,295 appearances 25 recordings 1 series first heard May 2026 last heard 4d ago

Steve Gibson’s voice in public audio — every appearance, attributed to the second.

Trend

recordings per month · last 12 months

Recordings per month over the last 12 months — 25 in all, peaking in Sep 2026 with 8.

Appearances

newest first · ▶ plays the moment

Security Now (Audio) · SN 1096: Are we the Krell? - 153 Million Driver's Licenses Leaked · 16 Sep 2026 podcast

Was the vulnerability already discovered? voice-verified

And and he says in paren's the the longer it takes to report vulnerabilities to maintainers, the more likely it becomes that somebody else already discovered it. voice-verified

And finally, is the vulnerability outside the project's security boundary? voice-verified

Meaning, does it even actually matter? voice-verified

Is it, you know, does, you know, does it do something that we don't care about? voice-verified

He says, in the initial Project Glasswing report, Anthropic emphasized discovering thousands of critical and high severity findings. voice-verified

The project used Claude to score severity, and the ledger now provides visibility into both the Claude severity rating and the software maintainers. voice-verified

independent, you know, received severity rating. voice-verified

That data shows that Claude's assessment of the vulnerability severity appears to be overestimated. voice-verified

For the current findings, with both Claude and maintainer severity, Claude determined a critical or high severity for 91.5% of findings, while the maintainer determined voice-verified

only fifty one point three percent as critical or high. voice-verified

So half of them mattered. voice-verified

Claude thought ninety-one point five percent of them mattered. voice-verified

He said one thing to consider is that the vulnerability severity could be much more accurate using AI, but it's likely that a generic determination is being made by the model rather than a well-crafted prompt written by someone with subject matter expertise on actual severity determination. voice-verified

It's also disappointing that the project does not provide the CVSS metrics used to determine the severity in the ledger itself. voice-verified

So it's hard to understand what the root cause is of the severity gap. voice-verified

between Claude and the software maintainers. voice-verified

And just to interrupt, the you know, when you look at a a C VSS metric, it breaks out specifically why this the vulnerability is given the numbers that that they are. voice-verified

They're not just like, you know, rules of thumb where someone says, ah, this kind of feels like a six. voice-verified

Or oh, this feels like a seven and a half. voice-verified

Showing 2821–2840 of 30,295 · page 142 of 1515