| ▲ | bko a day ago | ||||||||||||||||
> I feel like if you can’t be bothered to write the code, at least document it yourself and write the marketing copy so I know you understand the product. Do you not understand it? This person doesn't owe you any work. He's providing a product for free and this is a reasonable enough description of the product. > Did the LLM generate some amazing rm -rf somewhere, or another blunder that wrecks data I might care about? I'm pretty sure at this point hand-crafted code is more likely to contain security bugs. The mythical "rm -rf" random LLM insertion is not a real threat. Every time I see stories about this kind of issue, it's almost always preceded by basically prompt poisoning. | |||||||||||||||||
| ▲ | embedding-shape a day ago | parent | next [-] | ||||||||||||||||
> The mythical "rm -rf" random LLM insertion is not a real threat. Every time I see stories about this kind of issue, it's almost always preceded by basically prompt poisoning. It is real, typically happening when dumber models (haven't personally seen any of the SOTA ones on reasonable thinking/reasoning level do this) try to clean up stuff via bash and forget to assign a variable. Things like "rm -rf sessions/$id" without double-checking $id is actually defined, would do "rm -rf sessions/" and remove the entire directory. Add in more variables in a path like "rm -rf $HOME/projects/$user/$repo/$tmpdir" and the dumb models people think they can use for local coding, promptly removes a lot more than expected. Not sure how people aren't already running these agents in an environment/sandbox where stuff like this wouldn't matter, locally or not, but some LLMs do truly accidentally delete stuff for people, without "prompt poisoning", I had it happen myself while testing Qwen3.8-27B (BF16) locally just a week or two ago, exactly as described above. | |||||||||||||||||
| |||||||||||||||||
| ▲ | sortoflog 20 hours ago | parent | prev [-] | ||||||||||||||||
> This person doesn't owe you any work. He's providing a product for free A product being free doesn’t make it exempt from criticism. It’s not about “owing” anybody work. > and this is a reasonable enough description of the product. It’s not a great idea to signal a lack of effort, nor is it wrong for users to pick up on that signal. This is the post-llm equivalent to spelling or grammatical errors. > I'm pretty sure at this point hand-crafted code is more likely to contain security bugs. LLMs produce code which is fairly ‘locally optimal’, so in good hands they can absolutely be used to build correct software. They also allow those with little to no experience* to cobble something together very quickly and easily while creating a ton of security holes. I think you might be underestimating how common the latter is. * not to suggest this applies to the OP necessarily. Rather some extra wariness is necessary nowadays since the floor has been lowered so much. | |||||||||||||||||
| |||||||||||||||||