51–60 of 120 posts
This is completely infeasible in the age of mythos. The reality is that the velocity is just not going to feasible from a security PoV without leveraging these tools.
Analysing codebases with LLMs to find security vulnerabilities is completely unrelated to committing code generated with LLMs
Earlier quoted context omitted.
Analysing codebases with LLMs to find security vulnerabilities is completely unrelated to committing code generated with LLMs
and how do you propose fixing the hundreds, if not thousands, of valid, impactful security bugs that frontier models will find?
What confuses me about this stance is that LLMs are basically indistinguishable from any mid-to-low-tier dev. And those we've let into our codebases with no concerns. Hell, some even threw parties inviting in more of them. At least LLMs don't call HR on you when you rightfully tell them that they're full of shit. Though.. well. Claude probably might.
If there is a bug, its because you are a lazy piece of shit, not because humans make mistakes, and you missed it. It is branded slop.
We're living in interesting times, socially, OSS will die because of this.
Contributors are dwindling, and will continue to do so. If you want to play in your sandbox, please do. Don't open-source, keep it to yourself.
Earlier quoted context omitted.
and how do you propose fixing the hundreds, if not thousands, of valid, impactful security bugs that frontier models will find?
That seems like an unfounded assumption. Why should one assume that Git Annex has hundreds or thousands of critical, exploitable security vulnerabilities?
This is completely infeasible in the age of mythos. The reality is that the velocity is just not going to feasible from a security PoV without leveraging these tools.
In ten years we'll look at human written code like the unreliable garbage it is, and never rely on anything that wasn't at least seriously looked over by an LLM. It won't be even close.
I can imagine LLMs becoming a mainstay, but what you are describing isn't wholly different from sufficiently advanced static code analysis - where you'd want more determinism than most LLMs normally provide.
The problem is that such a thing might take a decade and billions of dollars of investments to create per-language (e.g. actually useful code analysis for Java, for Spring Boot, for processing and validating form data, and DB schemas and document processing and rendering reports etc., literal domain checks for anything and everything that is common across various enterprises) so nobody wants to do that, so it's easier to throw LLMs at it and call it good enough.
What confuses me about this stance is that LLMs are basically indistinguishable from any mid-to-low-tier dev. And those we've let into our codebases with no concerns. Hell, some even threw parties inviting in more of them. At least LLMs don't call HR on you when you rightfully tell them that they're full of shit. Though.. well. Claude probably might.
It's nicely symmetrical, because conversely I prefer my LLM-generated code to have no dependencies.
It isn't your code, it is stolen.
(FYI I'm not disputing that the LLM vendors didn't steal, that doesn't mean the technology is shit)
How come all the open source projects are fretting over the copyright status of LLM code but big companies are just vibe coding slop all day for their internal closed source projects without a care in the world?
Everyone and their cat can look at open source projects, which can and will result in being called out publicly. This can also have legal ramifications on the project itself.