Zero crashes, zero compromises: inside the HAProxy security audit(haproxy.com)

20 pointsby owenthejumper5 maanden geleden5 comments

Zero crashes, zero compromises: inside the HAProxy security audit

https://www.haproxy.com/blog/haproxy-security-audit-results

5 comments

JasonADrury5 maanden geleden

Surely haproxy makes enough money to not need to use AI for their marketing?

Why does a LLM-generated article even need two human bylines?

Hard to imagine a human in 2026 accidentally writing something like this:

  The most significant takeaway from the audit was the exceptional stability of the HAProxy core. The auditors didn't just review code; they hammered it.
  The team performed extensive "fuzzing" by feeding the system massive amounts of malformed, garbage, and malicious data. They primarily targeted the HAProxy network request handling and internal sockets. This testing went on for days, and in the case of internal sockets, up to 25 days.
  The result? Zero bugs. Zero crashes.

rlnorthcutt5 maanden geleden

Imagine it. This is the result of multiple internal documents, comments, versions, etc. across marketing and engineering teams. Real people doing real work trying to share real information.

But, that does raise an interesting point.

Content produced by pure LLMs are actually a statistical aggregation of lots of human authors (initially, anyway). So, the non-deterministic "average" takes a specific tone (regression to the mean).

Perhaps you can get similar patterns when combining work across multiple authors, especially when there are different goals, styles, and expressions that are being combined.

You can blame me for the more marketing focused phrases - its an attempt to appeal to both engineering readers and business leaders. I try to find a balance being interesting (so people actually read it) and informative (so it is actually useful), but it can be a fine line.

The technical insights can be attributed to Willy, much of which came directly from his notes. Honestly, we could write a whole other blog post with the stuff we couldn't fit from him.

Thanks for reading.

rudasn5 maanden geleden

Why not have two blog posts, one technical and one informative/tl;dr style that links back to the technical one (or includes specific excerpts)?

rlnorthcutt5 maanden geleden

Thats a great idea, and was my original plan. However, it just didn't make sense given the time and level of the response. The audit report is pretty straightforward, and has all of the details. I assume the technical folks who want to go deeper will read the full report.

The response to the feedback and to give some background was what was needed on our side, and we wanted that to be accessible to non-devs as well.

h4kunamata5 maanden geleden

Because that is what AI is for, said every single company, the vast majority of developers and engineers.

We aren't going back any time soon to humans writing decent article.