Thread

1. tetrisgm · 1790901257 · focus · HN ↗

   That’s probably a great thing. The initial friction of AI overwhelming projects certainly sucks, but once there are better processes to deal with them it’s going to strengthen the quality of so many projects!

   1. SchemaLoad · 1790901729 · focus · HN ↗

      Long term we will end up with software with no low hanging fruit exploits left. But right now we are in a period where low hanging fruit is everywhere and it's easier to exploit systems than ever before.

      1. catlifeonmars · 1790906017 · focus · HN ↗

         That’s assuming we’re not adding software defects at the same pace, but I imagine we are generating a lot more defects than are being discovered at the moment.

         1. skeledrew · 1790908150 · focus · HN ↗

            > we are generating a lot more defects than are being discovered

            Wouldn't this mean people are actually encountering issues where there are none before? Likely some serious enough that they lead to exploits where there weren't before? Where are the reports of these new defects?

            1. catlifeonmars · 1790909514 · focus · HN ↗

               I just mean there is a proliferation of new code. New code == new defects. It’s likely that popular software projects get the majority of the scrutiny, while no one is spending tokens looking for defects on my 0-star GitHub repo.
      2. somenameforme · 1790906087 · focus · HN ↗

         That relies on a major assumption that current systems are finding the vast majority of all possible exploits out there. This assumption itself would assume that either current LLMs are near perfect, or that the peak difficulty for exploits was just above human capability (which is where LLMs currently are). I think both of those assumptions are very likely false. If so then we'll see indefinitely ongoing exploit discovery as LLMs improve their capabilities.

         Long term I suspect that the purpose of the digital domain is going to end up being rethought. For instance connecting critical infrastructure to the internet has always been a terrible idea, and LLMs will just make that even more clear.

         1. SchemaLoad · 1790909588 · focus · HN ↗

            Computers are becoming architecturally more secure alongside just patching bugs. We have seen the move to using VMs with a minimal hypervisor, using separate security chips to hold sensitive info like encryption keys, Memory Tagging to detect and prevent memory exploits.

            On the iphone for example even if you find a crippling bug in iOS which gives you full root access, there is still no way to get the device encryption key or face ID info because the secure enclave simply has no electrical connection that can pass that key to the OS.

      3. kamma4434 · 1790918856 · focus · HN ↗

         I fear the vast majority of projects never went with any kind of code review but somebody high on Red Bulls at 9 PM looking at the code and saying “looks good to me”.

         And this is the best of cases. I fear many times in a smaller projects it was “it compiles at last, let’s see if anybody complains”. That’s why LLM’s are so damn effective today.

         (been there, done that – I’m not pointing fingers, but we are human, we get tired, and we don’t have the NASA budget to complete things and ship them)

Unofficial Hacker News client; not affiliated with Y Combinator.