None of these analogies are apposite. They don't respond to the observation I made: the vulnerabilities we're discussing exist regardless of what OpenAI does.

▲

112233 an hour ago | parent [-]

The fact that vulnerabilities exist is not being disputed, and is not causing any controversy. The fact that vulnerabilities are getting exploited does. Even having AI that would simply find all existing vulnerabilities and list them would not be as destructive as current situation. The same AI that finds the previously unknown vulnerability also finds the way to exploit it (NOT THE SAME THING), writes actually usable exploit (also not the same thing), then orchestrates and oversees the mass campaign. THAT is what makes current situation unsustainable.

Let's all recall old times when vulnerabilities of this magnitude were discovered - windows defender had some nice ones, linux kernel did, a lot of software did. They got discovered, communicated to vendor, patches were made, people updated.

Now? You have HOURS from discovery to full-out campaign. You published a patch? HOURS before it is disassembled, all fixed bugs PoC-ed and full out campaign started. You cannot update anything meaningfully in that window of time.

▲

tptacek an hour ago | parent [-]

Your premise, whether you mean it to be or not, is that if OpenAI wasn't working with researchers to publish vulnerabilities, they wouldn't be exploited. That's false.

	▲	112233 an hour ago \| parent [-]
		(where in the article did you read about OpenAI working with researchers to publish vulnerabilities?) Yes, exactly, that is my premise (minus the "working with researchers" bit). The current rate of exploitation is direct consequence of actions of Anthropic, OpenAI, Alibaba and whoever else is making these things. How can I know my false premise is true? By looking at the situation just a year ago, that is how! You are focused on the binary: vulnerability exists or it does not. It can be exploited or it can not. That is not what is causing the issues!