Both my analogies use hyperbola to comically exaggerate the claimed lack of any difference. just as claiming that advancing a demise of a human makes no difference because it will eventually happen, or claiming that breaching a bank in practice is not a big deal because it was possible in theory, so also claiming that theoretic possibility of a vulnerability being exploited is more or less the same as many of them being exploited at the same time.

The covid was not a lot deadlier and not a lot more contagious than normal seasonal flu. That "not a lot" overloaded hospitals and caused global shutdown.

The increase in rate at which software is being breached right now in in no way "not a lot". Devs were overloaded even without this deluge. We can tank one such php exploit. Then another one. But for how long? If all your smartcards, secure elements, cloud providers, wireless protocols, drivers, government registries etc etc will be having weekly breaches of this magnitude, won't the effect be systemic?

▲

tptacek 2 hours ago | parent [-]

None of these analogies are apposite. They don't respond to the observation I made: the vulnerabilities we're discussing exist regardless of what OpenAI does.

▲

112233 an hour ago | parent [-]

The fact that vulnerabilities exist is not being disputed, and is not causing any controversy. The fact that vulnerabilities are getting exploited does. Even having AI that would simply find all existing vulnerabilities and list them would not be as destructive as current situation. The same AI that finds the previously unknown vulnerability also finds the way to exploit it (NOT THE SAME THING), writes actually usable exploit (also not the same thing), then orchestrates and oversees the mass campaign. THAT is what makes current situation unsustainable.

Let's all recall old times when vulnerabilities of this magnitude were discovered - windows defender had some nice ones, linux kernel did, a lot of software did. They got discovered, communicated to vendor, patches were made, people updated.

Now? You have HOURS from discovery to full-out campaign. You published a patch? HOURS before it is disassembled, all fixed bugs PoC-ed and full out campaign started. You cannot update anything meaningfully in that window of time.

▲

tptacek an hour ago | parent [-]

Your premise, whether you mean it to be or not, is that if OpenAI wasn't working with researchers to publish vulnerabilities, they wouldn't be exploited. That's false.

	▲	112233 an hour ago \| parent [-]
		(where in the article did you read about OpenAI working with researchers to publish vulnerabilities?) Yes, exactly, that is my premise (minus the "working with researchers" bit). The current rate of exploitation is direct consequence of actions of Anthropic, OpenAI, Alibaba and whoever else is making these things. How can I know my false premise is true? By looking at the situation just a year ago, that is how! You are focused on the binary: vulnerability exists or it does not. It can be exploited or it can not. That is not what is causing the issues!