| ▲ | supriyo-biswas 2 hours ago | |
The more likely thing is that we'll see people use the sandboxing and security tools that people already have. After all, it's quite easy to get LLMs to write a seccomp profile, a Kubernetes manifest, or a systemd unit with the minimum required privileges and permissions, and for insecure C code, we'd probably see mainstream use of Fil-C and similar. | ||
| ▲ | traceroute66 2 hours ago | parent [-] | |
> The more likely thing is that we'll see people use the sandboxing and security tools that people already have. Will they though ? Given the amount of vibe-coded slopware being pushed out on an hourly basis ? Still to this day I see LLMs make schoolboy errors like use deprecated security idioms and call in far too many dependencies. "it's quite easy to get LLMs to write...." sure. But it has always and will always require a human with domain expertise to check what it has (and indeed has not) written. | ||