Live data from Hacker News

SQLite Critical CVEs or LLM Slop?

research.jfrog.com

281–290 of 406 posts

Re: SQLite Critical CVEs or LLM Slop?

#281
post #264

Earlier quoted context omitted.

It is pretty funny to see the shoe on the other foot, since it's usually software engineers with unearned arrogance about other fields.

What fields do you see devs think they know about? I’ve never personally seen this with other devs I work with but obviously small sample size…

find any econ related post on hn et voila

Re: SQLite Critical CVEs or LLM Slop?

#282

Earlier quoted context omitted.

Make a case then. My case is that Greg has, for decades, said that he hates the CVE system and rejected it and that the kernel objectively labels CVEs based on fixes (not the standard at all, CVEs are for vulns), etc. I can point to so many objective pieces of evidence to support my claim. You seem to have a vague, leading question. If you want to say something about "other groups" or ideologies, go ahead.

Malicious compliance is compliance.

I don't know what you're trying to say at all. But no, the kernel is objectively not compliant because they label fixes with CVEs and not vulnerabilities. But even if they were compliant... what would that have to do with anything? Feels like a non sequitur.

It's very hard to figure out what point you're trying to make.

Re: SQLite Critical CVEs or LLM Slop?

#283

Earlier quoted context omitted.

Probabilistic and deterministic are not opposites. The brain is deterministic at the level of specific interactions, which process inputs in a highly chaotic (but still deterministic) manner into probabilistic outcomes. The opposite of deterministic is random , i.e. in the quantum sense of truly no relationship between input and output. There are probably some quantum effects in the brain here and there, but the vast…

Ok right, but then I don't see the original point. Or like, you don't seem to be appealing to a hard science/soft science distinction here if the question revolves around what conceptual model is most "useful" to us. Useful for what? For predicting future actions? That makes sense, but does actually that speak to op's (possibly still fraught) metaphysical/semantic point here? It just feels like you are speaking over…

I am saying that there is no categorical distinction to be made on functional grounds between artificial intelligence and brains.

You cannot say an AI model cannot be intelligent because it's a probability machine, when all available evidence points toward natural intelligence also being generated by probability machines (much more complex ones, called brains).

Re: SQLite Critical CVEs or LLM Slop?

#284
post #180
post #168

Earlier quoted context omitted.

Many people with no skills are taking advantage of the LLM craze to artificially inflate their own value. I see it every day on LinkedIn. People that previously have barely any experience in tech, now being hired in AI startups because they are good bullshitters.

To be fair, "people with no skills inflating their own value" is what LinkedIn has always been like. But I guess LLMs are uniquely well positioned for that task.

People who live and create on LinkedIn? absolutely. For a huge group of people LI was just the most popular job board, though.

Re: SQLite Critical CVEs or LLM Slop?

#285
post #276

Earlier quoted context omitted.

Even now you're engaging in this discussion as though I'm trying to litigate your point and that somehow forcing me to concede is, what, winning? I don't know. I get the impression you want me to concede that the particular points of view you disagree with aren't worthy of representation here on HN. I'm not going to do that.

I just prefer HN comments to be better reflections of reality. There is an unspoken expectation here that people here know what they’re talking about especially when it comes to technical matters. The rise of LLMs has given way to a HN branded populism that willingly denies reality as well. “Next token predictor” truthism is just so dumb and completely ignores the reality of what these tool are able to do. Smash that…

> I just prefer HN comments to be better reflections of reality.

You mean your particular version of it.

It's interesting to see you consistently missing this point.

You've decided LLMs are clearly more than just complex but mindless statistical models.

You've decided that based on, it seems, the very impressive things these tools are capable of.

Therefore if anyone claims they're just mindless stastical models--with or without any attached judgement as to their actual utility or usefulness--then they are ipso facto wrong.

(And yes I just used endashes, damnit!)

That's on you.

It is in fact possible to simultaneously believe that LLMs are mindless token predictors and that they're enormously powerful.

These are entirely orthogonal beliefs.

Heck you could equally believe that LLMs represent true emerging AGI and that they still remain deeply flawed and are only an incremental step along the path of automation.

Or somewhere in between.

And discussing that space of possibilities is, I'd hope, precisely what HN is for.

Re: SQLite Critical CVEs or LLM Slop?

#286
post #52

We can chalk this up as another example of over-exhuberance by what folks believe LLMs can accomplish vs. what they actually are. LLM-based “AI” is able to use its vast corpus of inputs and calculate the most statistically likely output in a given situation. It is probabilistic, and when you are dealing with probabilities in a situation where certainties, not probabilities, matter, you’re going to get dinged on credi…

> LLMs are text-prediction engines. They are not Artificial Intelligence, and shouldn’t not be treated in any form or fashion as if they possess intelligence.

I agree that humans must verify LLM-produced facts, but strongly disagree with these kinds of "stochastic parrot therefore dumb" arguments.

Yes, an LLM is a "stochastic parrot". No, that doesn't imply that it is dumb. Enough to look at how Terence Tao asks ChatGPT to help him understand a solution that nobody had ever discussed before [1], or how a random guy asks ChatGPT in a handful of words to disprove a 30-year-old conjecture, with zero technical input [2].

If your parrot in a birdcage with internet access can finish the sentence, "The counterexample to the Dinitz–Garg–Goemans conjecture is...", then it's a pretty smart parrot, by all reasonable definitions of "smart". Just because someone bottled up the formula into matrix multiplications and added some random sampling to the outcome, that doesn't take away from the fact that the parrot said provably correct statements that the biggest experts in the field couldn't imagine.

And no, I'm not implying that the LLMs are correct all the time, or that their intelligence and reasoning works in any way like ours.

[1]: https://chatgpt.com/share/6a5fdc7a-d6f8-83e8-bbea-8deb42cfed... [2]: https://chatgpt.com/share/6a60b2eb-0b64-83ee-9c76-7931ca1de0...

Re: SQLite Critical CVEs or LLM Slop?

#287
post #52

We can chalk this up as another example of over-exhuberance by what folks believe LLMs can accomplish vs. what they actually are. LLM-based “AI” is able to use its vast corpus of inputs and calculate the most statistically likely output in a given situation. It is probabilistic, and when you are dealing with probabilities in a situation where certainties, not probabilities, matter, you’re going to get dinged on credi…

> LLMs are text-prediction engines. They are not Artificial Intelligence, and shouldn’t not be treated in any form or fashion as if they possess intelligence. I agree that humans must verify LLM-produced facts, but strongly disagree with these kinds of "stochastic parrot therefore dumb" arguments. Yes, an LLM is a "stochastic parrot". No, that doesn't imply that it is dumb. Enough to look at how Terence Tao asks Chat…

The best way to describe the LLM intelligence is "an expert system that works the way people thought expert systems would work". You can encode a massive amount of skills into an LLM, and then the LLM uses those to navigate problems.

But the LLM is still dumb where those skills doesn't have good coverage, since unlike the expert systems it maps fuzzily to its skills, and they are tuned to produce results over rejecting the request when its unclear if coverage is good. As long as that is true you have to treat them as dumb even if they sometimes produce brilliant results.

Re: SQLite Critical CVEs or LLM Slop?

#288

Earlier quoted context omitted.

Funding cuts at NIST did not lead directly to this. You must be new here or haven’t spent a lot of time directly interfaced with NIST on cybersecurity in decades past. And NIST’s role with CVE’s has always been purely ministerial/clerical. It has never been their job to do even a cursory investigation into the vulnerability itself.

OP suggests something at NIST changed in 2024, where they stopped doing as much verification as they did before. To be sure, the suggestion is not funding cuts, but an increase in workload with same funding. Here is the 2024 NIST announcement OP links to: https://nvd.nist.gov/general/news/nvd-program-transition-ann... > Currently, we are prioritizing analysis of the most significant vulnerabilities. In addition, we a…

The main point is NIST is _downstream_ of CVE issuance. Yes, they can — and still do — add disputed/rejected tags to CVEs, but in many cases by then it's already "too late." The CVE has an ID and a lifespan of its own.

NIST does not and did-not/cannot/never-has unilaterally "retracted" CVEs or prevented their issuance.

But yes, NIST's situation is not good for the world. The services they provide are hugely valuable.

Re: SQLite Critical CVEs or LLM Slop?

#290
post #253
post #84

Earlier quoted context omitted.

Absolutely. I'm not sure how universal this is, but I saw George Hotz tweeted something about Mythos not being such a big deal since he's able to find security issues without a claimed $20,000 in token spend per vulnerability. The reality is that humans aren't perfect, so we do not make "perfect programs". It is also possible to test it yourself to see how good LLMs are at finding software issues: Find any open sourc…

So we just need a redundant array of George Hotz, I wonder how much that costs? This is where quantity becomes a quality. Actors with huge budgets and at least a small team to keep the AIs on track now have an immense amount of potential power. Anthropic has somewhat resisted in giving state actors like this full access to 'dangerous' models, but it appears other companies like OpenAI have no such reservations. Befor…

Not just the cost, also boredom. I have used AI to trace down some tricky multi-threaded issues (someone has to write that cross thread framework, and it was me - fortunately most of our code isn't this complex). I already knew the code well, but it would have taken me a long time to find the same issue - the more likely thing is I would give up. Even if I don't give up I'm likely to get bored/frustrated. A month worth of tokens replaced what I would have needed a year to do if I was allowed to spend a year on it.
Post reply on HN