Live data from Hacker News

Google announces Sec-Gemini v1 a new experimental cybersecurity model

security.googleblog.com

31–40 of 53 posts

Re: Google announces Sec-Gemini v1 a new experimental cybersecurity model

#31
I'm always torn apart when it comes to LLMs and analytical tasks. When you perform an analytical task, whether it is something simple like assessing the potential risk and impact of a vulnerability or complex like analyzing an obfuscated malware sample to determine its capabilities, you have to thoroughly go over the data points available to you, and corroborate the data points or evidence you are using to come up with conclusions. LLMs can help with a lot of this, but you still have to go over their reasoning (black-box mostly) or backtrack their work before you can accept their conclusions.

In other words, even with humans, their skills and experience are never enough. they have to show the reasoning behind their conclusions and then show that reasoning is backed up by an independent source of fact. Short of that, you can still perform analysis, but then you must clearly state that your analysis is weak and requires more follow-up work and validation.

So with LLMs, I'm torn up because they kind of make your life a lot easier, but does it just feel that way or are they adding more work and uncertainty where that is intolerable?

Re: Google announces Sec-Gemini v1 a new experimental cybersecurity model

#32
post #11
post #10

There is generally something about the Gemini models which feels a bit different than Claude, ChatGPT or Mistral. I always have the feeling that I'm chatting with a model oriented towards engineering tasks. The seriousness, lack of interest of being humorous or cool. I don't know if this is because I interact with Gemini only through AI Studio, and it may have different system instructions (apart from those one can a…

> The seriousness, lack of interest of being humorous or cool. I love this. When ChatGPT compliments me on my great question or tries to banter it causes me great despair.

If I am brainstorming ideas and ChatGPT gives the inevitably fawning response, it always reminds me of those friends who have never heard a side project idea before and get excited about anything.

Re: Google announces Sec-Gemini v1 a new experimental cybersecurity model

#33
post #10

There is generally something about the Gemini models which feels a bit different than Claude, ChatGPT or Mistral. I always have the feeling that I'm chatting with a model oriented towards engineering tasks. The seriousness, lack of interest of being humorous or cool. I don't know if this is because I interact with Gemini only through AI Studio, and it may have different system instructions (apart from those one can a…

I uniformly call Gemini is a bash script. Really like it they way.

Re: Google announces Sec-Gemini v1 a new experimental cybersecurity model

#34
post #19

Earlier quoted context omitted.

Every now and then 4o seems to get a bit drunk and use tonnes of emojis or start swearing when I haven’t sworn myself in the chat. The other day I asked a fairly innocuous question and it LOLed and said it’d give me the ‘no Bullshit answer’

I've had 4o start off its response with a Smiling Face with Sunglasses emoji by the heading unprompted lol. edit: does hacker news filter out emojis? TIL (there should be emojis after this colon: )

Meta: no emojis on HN. Pure emoticon. :)

Re: Google announces Sec-Gemini v1 a new experimental cybersecurity model

#35
post #11
post #10

There is generally something about the Gemini models which feels a bit different than Claude, ChatGPT or Mistral. I always have the feeling that I'm chatting with a model oriented towards engineering tasks. The seriousness, lack of interest of being humorous or cool. I don't know if this is because I interact with Gemini only through AI Studio, and it may have different system instructions (apart from those one can a…

> The seriousness, lack of interest of being humorous or cool. I love this. When ChatGPT compliments me on my great question or tries to banter it causes me great despair.

Sometimes it answers something along the lines of: BOOM! thats where the bug was, and here’s how to fix it…

While being entirely wrong and I cringe a little

Re: Google announces Sec-Gemini v1 a new experimental cybersecurity model

#36
post #6
post #5

Could be great for augmenting a cybersec professional's tasks; I'm certainly interested in trying it. However, I fear it will not be used as just one of the tools in the toolbox, and rather it will be used as something to defer (and consequently shed liability) to.

Has anybody been able to shed liability to AI yet?

We have practiced the art of liability displacement from living, breathing human beings to artificial constructions for a lot longer than we've had a digital substrate for such

Re: Google announces Sec-Gemini v1 a new experimental cybersecurity model

#37
post #10

There is generally something about the Gemini models which feels a bit different than Claude, ChatGPT or Mistral. I always have the feeling that I'm chatting with a model oriented towards engineering tasks. The seriousness, lack of interest of being humorous or cool. I don't know if this is because I interact with Gemini only through AI Studio, and it may have different system instructions (apart from those one can a…

Is it because Google is feeding the model that information about you? It knows more of the responses you'd like? Just like Google does with search history?

Re: Google announces Sec-Gemini v1 a new experimental cybersecurity model

#39
Using AI systems for high-speed security actions, proactive and reactive, seems necessary but not sufficient:

I expect attackers will also use AI systems, trained on the latest in effective attacks. What about defense would make defenders' AI systems more effective than attackers'?

I think it's necessary because, if the attackers use AI systems then the defenders need to keep up.

Also, we need to be creating far more secure systems to start with. Now it is, to a degree, security through obscurity - something is secure when attackers can't find the bugs fast enough. Security through obsurity wouldn't seem to work well when the attacker uses AI software.

Post reply on HN