|
| ▲ | rectang an hour ago | parent | next [-] |
| I really don't know how we are going to deal with accelerated exploit generation via LLMs — it blows up the disclosure processes we've evolved. The only thing I can think of is hunkering down with static HTML to reduce attack surface, but that's laughably incompatible with many many business requirements. |
| |
| ▲ | aaron_m04 16 minutes ago | parent | next [-] | | Business requirements will have to change. All your competitors are under the same pressure with the same shitty set of options, after all. | | |
| ▲ | jacquesm 3 minutes ago | parent [-] | | That would have to start with businesses shelling out more funds for the packages that their businesses depend on. |
| |
| ▲ | jacquesm 37 minutes ago | parent | prev [-] | | I think it will kill open source to some degree. I found it already very hard to imagine how the endless queues of issues were being dealt with so diligently, but at least there was a human on the other side. The torrent that is unleashed now is not manageable on a human scale. It's a highly automated arms race with a bunch of good-willing humans caught in the crossfire between large companies and criminals duking it out. | | |
| ▲ | rectang 19 minutes ago | parent [-] | | Could open source activity transition towards provably correct software, with far more modest feature sets? I don't have experience with proof based tools, so I'm not sure what's feasible. | | |
| ▲ | jacquesm 4 minutes ago | parent [-] | | A lot of people in the open source world actually enjoy the act of programming. Not all of them will enjoy prompting to the same degree, but to keep pace with the bad guys you will have to either join or find something else to do. That's going to be a big loss. |
|
|
|
|
| ▲ | kilroy123 7 minutes ago | parent | prev | next [-] |
| It already _is_ a rough decade. I have hated the 20s so damn much. |
|
| ▲ | cortesoft an hour ago | parent | prev | next [-] |
| It feels like the only solution is going to be proactively running your own AI agents looking for patches and applying them. |
| |
| ▲ | rectang an hour ago | parent | next [-] | | The issue is where to direct the LLM's attention. Prompting the LLM to "look for vulnerabilities in PHP's multipart upload handling code" is going to find stuff that "look for vulnerabilities in PHP" won't. | |
| ▲ | cyberpunk 30 minutes ago | parent | prev | next [-] | | Or, you know, use client certificates so the bots can’t hit you. Those can leak / be stolen of course, but a bunch of my clients php apis survived as without a cert they’re told to fuck right off. It does make their client onboarding a bit harder but it’s a trade off which seems to have been the right one. | |
| ▲ | jacquesm 36 minutes ago | parent | prev [-] | | Yes, so who will pay for that? Open source so far meant you would use your brains and your creativity, now you need to use your money too if you want to keep pace. From a 'guts, credits & glory' proposition to 'slop processor if you can afford it' is not really an upgrade. |
|
|
| ▲ | throwaway613746 an hour ago | parent | prev [-] |
| [dead] |
