You must log in or register to comment.
6 daysI suppose I should quote a part, since no one else will read the dreaded wAlL Of tEXt.
Is this short enough for you?
AI helps people find more vulnerabilities in existing code. To address those vulnerabilities, people use AI to generate patches. The resulting pull requests are then “reviewed” by AI. That is, the more AI is in the loop, the less we understand the code base. The mystical “human in the loop” often is nothing more than a rubber stamp.
So what happens when things go bump? Complex systems fail in complex ways, and debugging code is an order of magnitude harder than writing code. Debugging somebody else’s code is harder still. Trying to debug large, complex, distributed systems consisting of components that are effectively opaque to your entire organization is going to be impossible.
You know what’s harder than debugging? Maintenance, especially of someone else’s code, keeping up to date with security exploits, revamping UX etc. which is why github is full of write only (as in never read, never changed) slop projects. That’s a critical part of a software project with any lifespan.
And then there’s integrating new functionality.
Without a solid architecture (which AI sucks at), strict code readability standards (ditto, but improving) and nuanced reviewing of potential additions to the codebase (ditto) what you get is a spagettified mess. It ends up costing more to maintain and improve than just starting fresh.
The promise of the AI bros was that by the time you needed to maintain or extend, you could just get the next version of Claude or whatever to do it, as it’s capabilities would have improved. That was a lie, and LLMs have hit a logarithmic wall where throwing more compute and bigger training sets at it produces diminishing returns. No AGI for you (unless some genius finds a new architecture). Frameworks / harnesses are still improving, but there’s only so far that can go.
The amount of technical debt that has been racked up by the last two years of AI coding is staggering to contemplate, and the industry will be dealing the fallout for years. Companies will collapse, and god help you if you’ve used it liberally in a codebase as large as an OS - looking at you Microslop.
- spiffmeister@aussie.zoneEnglish6 days
since no one else will read the dreaded wAlL Of tEXt.
It’s okay I can just have an AI summarise it for me.
- MangoCats@feddit.itEnglish6 days
I will say, we’ve been deployed on Ubuntu 18.04 for 8 years now and tracking the CVEs against our configuration watching for potential exploits that could really matter to our systems, and it wasn’t until the past few months that those exploits actually started to get meaningful ability to compromise us.
What that says to me is: the LLMs are finding meaningful vulnerabilities that “the best minds” missed for years and years. And they’re also generating functional patches for these vulnerabilities far faster and more easily than the patches came out in the past.
I’m not loving the changed landscape, but I have to acknowledge that LLMs are making a significant difference.
- Blue_Morpho@lemmy.worldEnglish5 days
Yeah I got to this in the blog and stopped:
" I don’t think that we’re any safer than before. That’s because finding vulnerabilities has never been the bottleneck in information security. The bottleneck isn’t even verifying a vulnerability report and validating its severity, as time consuming as that is. The bottleneck isn’t determining the fix, creating the patch, or publishing a new release. The bottleneck is still, as ever before, getting the goddamn packages updated. "
Dude thinks security through obscurity is valid and thinks running
sudo apt update && sudo apt upgrade -y
Is the really hard part.
- MangoCats@feddit.itEnglish5 days
running
sudo apt update && sudo apt upgrade -y
Is the really hard part.
That’s not the hard part to do, it’s the hard part to get other people to do, particularly those who can’t just run the package manager or let in-doze play patch roulette every Tuesday.
Security through obscurity isn’t going to cut it in the future, much less than it already didn’t in the past.
Security through air-gapping is still pretty good.
- abcdqfr@lemmy.worldEnglish5 days
It isn’t even the LLM. Its the data scraped from the internet wholesale and users contributing to corps by use. Not to mention the staggering amount of engineers turning that raw data into better output. The LLM just spits those billions of dollars of effort back out. I only pick this nit because too many people see local LLM and think that’s where the magic happens. It is just a flash in the pan. you need an internal combustion engine, transmission, wheels, chassis, cabin, and probably some seats if you want to get anywhere with it. That said, it is the concentration of effort. Individuals can’t really rival that. I wonder if there are any initiatives in the open source community with this mindset…
We are all instantly obsolete. You cannot compete with the sum total of all human invention at the click of a prompt.
The other day I went to talk to some subject matter expert because I wanted an experienced human’s knowledge and perspective on my problem. They literally just read me Reddit posts and Gemini search results to answer my questions. Even turning their laptop and being like “see?”
What a waste of everyone’s time.
- frongt@lemmy.zipEnglish6 days
Maybe they were exercising their experience by identifying valid material. No point rewriting a treatise when some guy’s blog already has a perfectly good article.
- ImmortalColeSlaw@lemmy.todayEnglish6 days
God forbid we think for ourselves and have real conversations.
