I built a tool that monitors commits and tries to detect silent bug fixes. With GPT-5.5-class models, it can identify fixes hidden within otherwise routine commits quite reliably. Obfuscating the code changes enough to avoid detection is difficult.

I have heard of at least one project (c-lightning?) temporarily releasing a closed-source binary as a workaround until users could update safely.

Have you heard of these things called LLMs are that are quite good at reversing changes in closed source binaries?

you can diff binaries in a disassembler, the technique has been used for a long time to discover patched Microsoft vulnerabilities, create exploits and then race the world.

now you can instruct an LLM to do this with MCP...

There are many techniques for making a closed-source binary harder to reverse engineer: polymorphism, symbol stripping, code encryption, packing, and so on. Closed-source binaries at least stand a chance of being effectively obfuscated, unlike open-source code.

and those measures have always been merely annoyances. except for the VM methods which impact performance significantly.

now none of those methods matter as you can just instruct an LLM to bang its head against the wall until the wall breaks.

They still matter in the sense that they impose a cost. In other words, they buy time, which is all the users need before updating.

I'm not sure if the cat and mouse game resolves clearly one way or another. Since the obfuscation can be hardened against LLMs during development.

People are trying to secretly fix bugs?

Yes. The problem with openly releasing a fix for a security bug is that people are not always quick to update their instances. It only takes one black-hat monitoring your releases by some means to dissect the changes, find the hole, and make an exploit that can be immediately used against unpatched systems, and the sudden availability of better automated tools for that makes it a much bigger problem than it was a year or more ago.

Information about the problem then gets released later, once everyone has had appropriate time to get up-to-date. Or not, and we are non the wiser.

Yes, they don't want the vulnerabilities exposed so they ship the fix in secret, contained in unrelated features.

Ah, I guess that would advertise that users of the old version are vulnerable. I was imagining some altruistic contributor trying to sneak in a bug fix past the maintainer.

Yep, this is for maintainers releasing fixes to secretly-reported 0days without tipping off attackers who are looking to exploit a (sometimes very large) install base.

Whay do you want traffic to go back to estate agents?

Every year rightmove uses statistics about how much time people spend on their website to justify raising prices.

Sellers, buyers and agents end up paying for the "htm" (hidden toll machine) that is rightmove.

The more we can chip away at the time people spend on rightmove the better chance we have a challenging the "htm".

Instead of sharing the link to rightmove with your spouse, friend etc remove the "htm" and share the rigove link instead.

Similar principle to how xcancel drives traffic away from the empire of Musk.

That might help a little, but surely the fundamental problem is RightMove's market consolidation. With competitors like Zoopla and OnTheMarket offering essentially the same product but getting a fraction of the traffic, I suspect RM is engaging in some sort of anti-competitive practise to maintain market dominance. There is a recent lawsuit against them [0], in which the plaintiff pleads that RM employs "exclusionary conduct – behaviour said to weaken rival portals" [1].

Personally, I would hate to go back to the days of trawling individual estate agents and manually comparing prices, floorplans, locations etc... from websites with different formats and UIs. House market aggregators are massively valuable to buyers and sellers, we just need to regulate the industry to be competitive.

[0] https://www.catribunal.org.uk/cases/17717726-mr-jeremy-newma...

[1] https://www.hilldickinson.com/our-view/articles/testing-comp...