If you think vulnerability research simply doesn't matter, you have a lot of company in that opinion. It's something Bruce Schneier used to argue, and Marcus Ranum, and a bunch of other people that used be on closed secret vulnerability-sharing mailing lists before Bugtraq blew those cliques up. These are very old arguments.
But if you do think vulnerability research matters, and you're trying to argue that frontier models aren't a seismic change for that discipline, you have almost no company. Vulnerability researchers are overwhelmingly leaning on automation to find vulnerabilities and, just as importantly, generate the tooling required to test hypotheses.
You can feel about that however you want to feel about it. I mostly don't care, except: you can watch people like this being negatively polarized back into the bad old days of the mid-1990s, content-free CERT advisories, and vendor-controlled "responsible disclosure" by a use case that frontier models unimpeachably excel at.
It’s amazing how half the developers on earth live on a completely different planet now. There are plenty of new challenges, sure but we are far past the point where we can have a debate about “is it useful?”
And yet we continue to do so. I understand the feeling of loss some people may be facing. And there are definitely some really bad practices - like nakedly spewing claudspeak at your colleagues instead of communicating. Or raising a PR you don’t understand. There are asymmetries we haven’t learned to navigate. But we aren’t returning to a world where it doesn’t dominate our discipline so it’s best to find opportunities.
The bigger challenge is that the mechanics of the day to day work have entirely changed. Mechanically, using C is similar to using JS. You’re tying and compiling and checking results, whatever. With an Agent what you actually do is completely different. Even as technologies have changed in the past and people have learned more, your mechanical day to day work would look similar, just with different tools. Not so with AI.
So it should be utterly unsurprising that many people are going through a bit of an existential crisis around this. Because what you actually sat down and enjoyed doing, what motivated you, may be entirely gone now.
And on top of that, there’s an extreme amount of pressure to do more in less time, which is by definition stressful. And do much more context switching.
I’ve often spent more of my time reviewing code than writing code off and on for decades as my role and team size changes. So, none of this is new to me except that the loops are much tighter and I don’t have to debate the social cost of pointing out what is workable but not acceptable after the 4th review cycle when I suddenly notice something new in code that had been there all along.
The truth is a lot of developers are terrible at reviewing design specifications and code. They rarely - if ever - find any real correctness issues and more than half believe it’s mostly a status / dominance game. Many can’t force themselves to deeply think about the code if they aren’t writing it.
tptacek · · focus · HN ↗
But if you do think vulnerability research matters, and you're trying to argue that frontier models aren't a seismic change for that discipline, you have almost no company. Vulnerability researchers are overwhelmingly leaning on automation to find vulnerabilities and, just as importantly, generate the tooling required to test hypotheses.
You can feel about that however you want to feel about it. I mostly don't care, except: you can watch people like this being negatively polarized back into the bad old days of the mid-1990s, content-free CERT advisories, and vendor-controlled "responsible disclosure" by a use case that frontier models unimpeachably excel at.
jeremyjh · · focus · HN ↗
And yet we continue to do so. I understand the feeling of loss some people may be facing. And there are definitely some really bad practices - like nakedly spewing claudspeak at your colleagues instead of communicating. Or raising a PR you don’t understand. There are asymmetries we haven’t learned to navigate. But we aren’t returning to a world where it doesn’t dominate our discipline so it’s best to find opportunities.
anon7000 · · focus · HN ↗
So it should be utterly unsurprising that many people are going through a bit of an existential crisis around this. Because what you actually sat down and enjoyed doing, what motivated you, may be entirely gone now.
And on top of that, there’s an extreme amount of pressure to do more in less time, which is by definition stressful. And do much more context switching.
jeremyjh · · focus · HN ↗
The truth is a lot of developers are terrible at reviewing design specifications and code. They rarely - if ever - find any real correctness issues and more than half believe it’s mostly a status / dominance game. Many can’t force themselves to deeply think about the code if they aren’t writing it.