Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SQLite Critical CVEs or LLM Slop?

research.jfrog.com

Post reply on HN
Print view View original

331–340 of 406 posts

Re: SQLite Critical CVEs or LLM Slop?

#331

Post by vouwfietsman »

Jensson wrote: post #308
vouwfietsman wrote: post #302

Earlier quoted context omitted.

It can be a token predictor and still tell me exactly how my life will proceed from now until the indefinite future, or be the most intelligent conversational entity you have ever witnessed. The issue is of course with using the word "dumb": they are next token predictors, no doubt about it, but whether LLms as a class of system are smart or dumb is entirely unknown and entirely variable in time. To interact with the…

The "dumb" part comes from how it behaves in contexts where it lacks a lot of data, or where the data is skewed. Since they are tuned to give a prediction anyway and just make something up since sometimes those made up things are useful they will produce dumb results. So people call them dumb since like dumb people they make strong statements about things they don't understand. And it doesn't matter how much smart th…

> they will keep making strong statements about things they don't understand until they are fundamentally changed

If ever there was a human quality.

Also, your explanation of "dumb" is really favoring the anti-llm side, and its a very generous interpretation. I suspect what is much more likely meant, is that token predictors cannot be smart, not now nor in the future after improvements, because they are token predictors and predicting tokens is not how intelligence works.

All of this is of course unfounded, and hidden behind the word "dumb".

Re: SQLite Critical CVEs or LLM Slop?

#332

Post by beepbooptheory »

estearum wrote: post #283
beepbooptheory wrote: post #268

Earlier quoted context omitted.

Ok right, but then I don't see the original point. Or like, you don't seem to be appealing to a hard science/soft science distinction here if the question revolves around what conceptual model is most "useful" to us. Useful for what? For predicting future actions? That makes sense, but does actually that speak to op's (possibly still fraught) metaphysical/semantic point here? It just feels like you are speaking over…

I am saying that there is no categorical distinction to be made on functional grounds between artificial intelligence and brains. You cannot say an AI model cannot be intelligent because it's a probability machine, when all available evidence points toward natural intelligence also being generated by probability machines (much more complex ones, called brains).

This seems fine but things being the same "on functional grounds" is just one way things can be the same. Why should we privilege this framing as something definitive versus another conceivable one?

On functional grounds my bike has not a lot of distinction from a horse, but just, like, saying that doesn't tell me much about either. Or at least, it seems to leave out a lot of otherwise crucial details and differences..

What does it mean to you, this point of view? Are you truly coming from like a 20th century pragmatism point of view? Where what is most useful is what is right? Or are your trying to make a larger claim about nature? I think being clear about that would help focus your critique here.

Re: SQLite Critical CVEs or LLM Slop?

#333

Post by Jensson »

estearum wrote: post #329
Jensson wrote: post #311

Earlier quoted context omitted.

But brains do much more than just predict tokens based on previously seen tokens. I think all the other things brains do are probably important for our intelligence. So, LLM are just next token predictors, brains are next token predictors + many other things in addition, and that makes people still feel LLM are dumb even when they solve a lot of problems using tokens.

> But brains do much more than just predict tokens based on previously seen tokens. I think all the other things brains do are probably important for our intelligence. Like what? What specific biological structure in the brain could be doing anything other than producing output as a function of 1) current electrical/chemical/thermal inputs and 2) previous electrical/chemical/thermal inputs?

LLM doesn't just produce output as a function, they are much more specific: they predict text based on text they have been trained on.

Re: SQLite Critical CVEs or LLM Slop?

#334

Post by mr_mitm »

lucideer wrote: post #322
mr_mitm wrote: post #42

Earlier quoted context omitted.

> - Firstly, you quickly realise how irrelevant CVSS scores are Even if you factor in the environmental score? I realize it's a lot more work, but it basically allows you to tune the score to get any value you want.

I could reword that CVSS is useless on its own - EPSS takes CVSS as an input afterall. The point here is that applying environmental scoring is the hard part. That's the algorithm that's containing the complexity.

True, I guess you might as well evaluate each vulnerability yourself without the CVSS base score.

Re: SQLite Critical CVEs or LLM Slop?

#335

Post by Jensson »

vouwfietsman wrote: post #328
Jensson wrote: post #309

Earlier quoted context omitted.

If it keeps doing dumb things, yeah. But if that actually solves it then those opinions will quickly disappear when it replaces all human white collar work since it does it cheaper and better and faster. AGI is fairly easy to detect for this reason. Does this system make a majority feel you don't have to hire people anymore? If not its not AGI.

> But if that actually solves it then Solves what? Chess? No thats not AI, its just a chess bot. Turing test? No, thats not AI, its just a dumb token predictor. Why would the goalposts stop moving at AGI? I am 100% convinced it will somehow still lack the "gusto" or the "taste" or the "timbre" of real intelligence. You can see it in coding right now, AI has bad "taste" in coding, because really, we can't do a better…

> Solves what? Chess? No thats not AI, its just a chess bot. Turing test? No, thats not AI, its just a dumb token predictor.

You are moving the goalpost here if you think the chess AI was AGI. All those problems were evidence AI wasn't as smart as humans, not goalposts determining when AI is as smart as humans. The first turing test winner wasn't even an LLM, it was an expert system, so we already knew that test wasn't enough for AGI.

Re: SQLite Critical CVEs or LLM Slop?

#336

Post by jrochkind1 »

mbauman wrote: post #288
jrochkind1 wrote: post #216

Earlier quoted context omitted.

OP suggests something at NIST changed in 2024, where they stopped doing as much verification as they did before. To be sure, the suggestion is not funding cuts, but an increase in workload with same funding. Here is the 2024 NIST announcement OP links to: https://nvd.nist.gov/general/news/nvd-program-transition-ann... > Currently, we are prioritizing analysis of the most significant vulnerabilities. In addition, we a…

The main point is NIST is _downstream_ of CVE issuance. Yes, they can — and still do — add disputed/rejected tags to CVEs, but in many cases by then it's already "too late." The CVE has an ID and a lifespan of its own. NIST does not and did-not/cannot/never-has unilaterally "retracted" CVEs or prevented their issuance. But yes, NIST's situation is not good for the world. The services they provide are hugely valuable.

I only know about this what I learned from OP and you guys.

It sounds like you guys think OP was mistaken, whatever analysis NIST was doing that they reduced in 2024 would not have prevented this anyway?

Legit question, I'm trying to understand!

OP says:

> Hit by a massive surge in vulnerability reports, NIST effectively hit pause on deep analysis. CISA and other Authorized Data Publishers (ADPs) tried to step in with their own enrichment efforts, but the global pipeline is now fragmented and drowning in a massive backlog. Because no step in today's system actually requires a proof-of-concept or bug reproduction, a plausible-sounding fake advisory can slide right through the pipeline and end up in GHSA, downstream databases, and enterprise scanners.

Do i correctly understand you are saying you think they've mistunderstood the diagnosis of what changed, the 2024 change to NIST didn't actually make it any more likely for a fake advisory to go through pipeline?

Re: SQLite Critical CVEs or LLM Slop?

#337

Post by vouwfietsman »

Jensson wrote: post #311
estearum wrote: post #283

Earlier quoted context omitted.

I am saying that there is no categorical distinction to be made on functional grounds between artificial intelligence and brains. You cannot say an AI model cannot be intelligent because it's a probability machine, when all available evidence points toward natural intelligence also being generated by probability machines (much more complex ones, called brains).

But brains do much more than just predict tokens based on previously seen tokens. I think all the other things brains do are probably important for our intelligence. So, LLM are just next token predictors, brains are next token predictors + many other things in addition, and that makes people still feel LLM are dumb even when they solve a lot of problems using tokens.

> brains are next token predictors

Of the vast uncertainties and philosophical exercises that we must face to bridge the chasm between where we are now, and where we will be when we understand intelligence, I can take comfort in claiming, with 100% accuracy, that our biology is not based on technology invented by Google in 2017.

Re: SQLite Critical CVEs or LLM Slop?

#338

Post by estearum »

Jensson wrote: post #333
estearum wrote: post #329

Earlier quoted context omitted.

> But brains do much more than just predict tokens based on previously seen tokens. I think all the other things brains do are probably important for our intelligence. Like what? What specific biological structure in the brain could be doing anything other than producing output as a function of 1) current electrical/chemical/thermal inputs and 2) previous electrical/chemical/thermal inputs?

LLM doesn't just produce output as a function, they are much more specific: they predict text based on text they have been trained on.

Yes that is the item (2) parameter described above.

Re: SQLite Critical CVEs or LLM Slop?

#339

Post by Jensson »

vouwfietsman wrote: post #331
Jensson wrote: post #308

Earlier quoted context omitted.

The "dumb" part comes from how it behaves in contexts where it lacks a lot of data, or where the data is skewed. Since they are tuned to give a prediction anyway and just make something up since sometimes those made up things are useful they will produce dumb results. So people call them dumb since like dumb people they make strong statements about things they don't understand. And it doesn't matter how much smart th…

> they will keep making strong statements about things they don't understand until they are fundamentally changed If ever there was a human quality. Also, your explanation of "dumb" is really favoring the anti-llm side, and its a very generous interpretation. I suspect what is much more likely meant, is that token predictors cannot be smart, not now nor in the future after improvements, because they are token predict…

> I suspect what is much more likely meant, is that token predictors cannot be smart, not now nor in the future after improvements, because they are token predictors and predicting tokens is not how intelligence works.

Why do you think that? LLM are used as expert systems today, in order to quickly navigate problems by breaking them down and iterating between different well known possible solutions and paths to check etc. That is how they work, they do that by using their next token predictions, and for things they aren't well trained on they will produce dumb results.

LLM has solved enough problems that almost nobody has the view you ridicule here, but there are still many who think LLM are thinking just like humans and that you can trust them just like humans. So its important to remind people these are just token predictors and lack many things humans do.

> If ever there was a human quality.

Humans can avoid doing that by using introspection, LLM can't. That some humans do it by not using introspection doesn't mean humans are incapable of it, we know humans are capable of it, which is why we can point out when the LLM is wrong with certainty, humans as a group make extremely good predictions.

Re: SQLite Critical CVEs or LLM Slop?

#340

Post by icedchai »

eli wrote: post #180
elmer2 wrote: post #168

Earlier quoted context omitted.

Many people with no skills are taking advantage of the LLM craze to artificially inflate their own value. I see it every day on LinkedIn. People that previously have barely any experience in tech, now being hired in AI startups because they are good bullshitters.

To be fair, "people with no skills inflating their own value" is what LinkedIn has always been like. But I guess LLMs are uniquely well positioned for that task.

LLMs have brought it to a new level. I have multiple people in my feed posting several page dissertations on a daily basis. More often than not, these posts are about the benefits of AI...
Post reply on HN