If you think vulnerability research simply doesn't matter, you have a lot of company in that opinion. It's something Bruce Schneier used to argue, and Marcus Ranum, and a bunch of other people that used be on closed secret vulnerability-sharing mailing lists before Bugtraq blew those cliques up. These are very old arguments.
But if you do think vulnerability research matters, and you're trying to argue that frontier models aren't a seismic change for that discipline, you have almost no company. Vulnerability researchers are overwhelmingly leaning on automation to find vulnerabilities and, just as importantly, generate the tooling required to test hypotheses.
You can feel about that however you want to feel about it. I mostly don't care, except: you can watch people like this being negatively polarized back into the bad old days of the mid-1990s, content-free CERT advisories, and vendor-controlled "responsible disclosure" by a use case that frontier models unimpeachably excel at.
It’s amazing how half the developers on earth live on a completely different planet now. There are plenty of new challenges, sure but we are far past the point where we can have a debate about “is it useful?”
And yet we continue to do so. I understand the feeling of loss some people may be facing. And there are definitely some really bad practices - like nakedly spewing claudspeak at your colleagues instead of communicating. Or raising a PR you don’t understand. There are asymmetries we haven’t learned to navigate. But we aren’t returning to a world where it doesn’t dominate our discipline so it’s best to find opportunities.
The question most of us are asking isn’t “is it useful”, but “is it worth it”. Engaging with these tools involves no small amount of self-debasement and long term degradation of skills; do I want to sacrifice myself on the altar of productivity?
For me the answer is still absolutely resolutely “no”.
Because AI removes you from analytical thinking, and the brain is a muscle. The less you think, the less you are able to think.
Programming is inherently analytical and logic-driven. It’s a great brain exercise, even if the code has no value. When you use AI, you lose that exercise. What replaces it isn’t the same.
I mean, consider. I can solve a crossword, or I can ask AI to solve the crossword. AI will do it perfectly, and faster too. But which one is better for my brain? What was my goal with solving the crossword, anyway? On the surface it was to find a solution to the crossword. But, maybe, deeper down, the goal was to improve myself in some way.
People conflate the improvement of products with the improvement of self. Maybe it’s a result of our consumerist mindset. But the truth is the product can improve greatly, and you can be making it, while you yourself degrade.
We write better and better code, at a faster rate, but are we better programmers than before? Maybe, maybe not. I’m leaning maybe not.
It’s not new or unique. The assembly line is the same. Sure, I can build better furniture faster at the factory than by hand. But what is the goal here? Is it to make the best furniture, or to become the best carpenter?
If it’s to make the best furniture, the best product, then I’ve won. If it’s to become the best carpenter, then I’ve lost heavily.
tptacek · · focus · HN ↗
But if you do think vulnerability research matters, and you're trying to argue that frontier models aren't a seismic change for that discipline, you have almost no company. Vulnerability researchers are overwhelmingly leaning on automation to find vulnerabilities and, just as importantly, generate the tooling required to test hypotheses.
You can feel about that however you want to feel about it. I mostly don't care, except: you can watch people like this being negatively polarized back into the bad old days of the mid-1990s, content-free CERT advisories, and vendor-controlled "responsible disclosure" by a use case that frontier models unimpeachably excel at.
jeremyjh · · focus · HN ↗
And yet we continue to do so. I understand the feeling of loss some people may be facing. And there are definitely some really bad practices - like nakedly spewing claudspeak at your colleagues instead of communicating. Or raising a PR you don’t understand. There are asymmetries we haven’t learned to navigate. But we aren’t returning to a world where it doesn’t dominate our discipline so it’s best to find opportunities.
vermilingua · · focus · HN ↗
For me the answer is still absolutely resolutely “no”.
akerl_ · · focus · HN ↗
Why is using AI tools self-debasing or degrading?
preg_match · · focus · HN ↗
Programming is inherently analytical and logic-driven. It’s a great brain exercise, even if the code has no value. When you use AI, you lose that exercise. What replaces it isn’t the same.
I mean, consider. I can solve a crossword, or I can ask AI to solve the crossword. AI will do it perfectly, and faster too. But which one is better for my brain? What was my goal with solving the crossword, anyway? On the surface it was to find a solution to the crossword. But, maybe, deeper down, the goal was to improve myself in some way.
People conflate the improvement of products with the improvement of self. Maybe it’s a result of our consumerist mindset. But the truth is the product can improve greatly, and you can be making it, while you yourself degrade.
We write better and better code, at a faster rate, but are we better programmers than before? Maybe, maybe not. I’m leaning maybe not.
It’s not new or unique. The assembly line is the same. Sure, I can build better furniture faster at the factory than by hand. But what is the goal here? Is it to make the best furniture, or to become the best carpenter?
If it’s to make the best furniture, the best product, then I’ve won. If it’s to become the best carpenter, then I’ve lost heavily.
zahlman · · focus · HN ↗
Or, you know, to pass some time in an enjoyable way. To have fun.