Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SQLite Critical CVEs or LLM Slop?

research.jfrog.com

Post reply on HN
Print view View original

381–390 of 406 posts

Re: SQLite Critical CVEs or LLM Slop?

#381

Post by andrewflnr »

27183 wrote: post #379
andrewflnr wrote: post #378

Earlier quoted context omitted.

PEs are demonstrably a partial solution at best. Fields with certified engineers still have financially motivated disasters ( boeing goes the door plug). For better or worse, I think we'll see more political support for increased oversight of companies on the next free decades. I only hope it manifests in a useful way instead of a self-defeating way.

It'll have to be pretty much all the ways. One way will stick. The rest will be forgotten failures.

I'm afraid this is a situation where the first halfway plausible solution will "stick" and sap the pressure to change even if it doesn't do a good job.

Re: SQLite Critical CVEs or LLM Slop?

#383

Post by dns_snek »

traceroute66 wrote: post #35
lucideer wrote: post #9

Earlier quoted context omitted.

I'm very curious what organisations would have such a policy. I can't imagine it being viable for any size of org without significant self-deception (or banning the use of all open source at which point CVEs are moot anyway).

> I'm very curious what organisations would have such a policy. I would humbly suggest any org of any size that has insurance cover that covers anything tech related (e.g. data loss/recovery, cyber etc.) has a very good look at the small print. Over the last few years insurers have aggressively been adding "no vulnerability patch, no claim" exclusion clauses.

> Over the last few years insurers have aggressively been adding "no vulnerability patch, no claim" exclusion clauses.

If you take an even closer look- what exactly does that mean?

It should stipulate patching real vulnerabilities in your system and not "all CVEs in all dependencies irrespective of their usage or applicability to your system", that's madness. It's like voiding your health insurance policy because a smoker moved in across the street.

Most vulnerabilities in your dependencies don't become vulnerabilities in your system, and most vulnerabilities in your system (probably) don't originate from your dependencies.

Re: SQLite Critical CVEs or LLM Slop?

#384

Post by fsflover »

27183 wrote: post #366
fsflover wrote: post #363

Earlier quoted context omitted.

> For an LLM to be as smart as a human it has to be able to learn like a human. "For a plane to fly as well as a bird it has to be able to flap its wings". "For a submarine to swim as well as a fish it has to be as light as fish".

> "For a plane to fly as well as a bird it has to be able to flap its wings". > "For a submarine to swim as well as a fish it has to be as light as fish". These are false equivalences. The post you're responding to defined intelligence as learning rate. LLMs unequivocally do not learn. You can disagree with OP or agree, but what you have done is out of bounds. You're implicitly claiming that LLMs learn, albeit differ…

> The post you're responding to defined intelligence as learning rate.

How is the learning method or rate related to intelligence? LLMs learn during the training, much faster than any human. Yes, they drastically slow down their learning afterwards, but they still can learn a bit from an uploaded document or a web site.

And in the end they may be better at intelligence than any human, depending on the task and time given. I though intelligence is not about history but current performance.

How is this different than my examples, in which a possibility to fly is judged by (learning to) flapping the wings and not by the actual result?

> And don't bother yapping about context windows, it's just not anything like learning.

That's debatable, but I don't see how it's relevant here. You can ignore that part of my reply above, and the argument will remain unchanged.

Nevertheless, I don't understand how this not learning. Without it, no meaningful intelligent task can really be performed. LLM/human must learn the relevant bits from current situation in order to answer meaningfully. Often it requires to actually acquire new knowledge like reading a new piece of text unknown before. Feel free to link to a relevant discussion for me if you find this boring and settled.

Re: SQLite Critical CVEs or LLM Slop?

#385

Post by glitchcrab »

Joe_Cool wrote: post #187
elmer2 wrote: post #168

Earlier quoted context omitted.

Many people with no skills are taking advantage of the LLM craze to artificially inflate their own value. I see it every day on LinkedIn. People that previously have barely any experience in tech, now being hired in AI startups because they are good bullshitters.

I heard the term "Sloperator" a few times. Quite fitting...

Thanks!That's definitely getting added to my vocabulary.

Re: SQLite Critical CVEs or LLM Slop?

#386

Post by traceroute66 »

dns_snek wrote: post #383
traceroute66 wrote: post #35

Earlier quoted context omitted.

> I'm very curious what organisations would have such a policy. I would humbly suggest any org of any size that has insurance cover that covers anything tech related (e.g. data loss/recovery, cyber etc.) has a very good look at the small print. Over the last few years insurers have aggressively been adding "no vulnerability patch, no claim" exclusion clauses.

> Over the last few years insurers have aggressively been adding "no vulnerability patch, no claim" exclusion clauses. If you take an even closer look- what exactly does that mean? It should stipulate patching real vulnerabilities in your system and not "all CVEs in all dependencies irrespective of their usage or applicability to your system", that's madness. It's like voiding your health insurance policy because a s…

> If you take an even closer look- what exactly does that mean?

Here is one example:

    "Critical Vulnerability Exclusion

    We will not pay you under the cyber and data risks section of cover where your legal liability or any loss that you suffer arises from a cyber attack that exploits a critical vulnerability within your computer equipment.

    However this exclusion will only apply where a patch or fix for any critical vulnerability exploited has been available for 21 days prior to the date of the incident and has not been applied to your computer equipment.

    Critical Vulnerability means a common vulnerability and exposure (CVE) in the National Vulnerability Database operated by the National Institute of Standards and Technology which has a score of 8.0 or higher on the Common Vulnerability Scoring System (CVSS)"

Re: SQLite Critical CVEs or LLM Slop?

#387

Post by lenkite »

Blackthorn wrote: post #374
ryan_n wrote: post #264

Earlier quoted context omitted.

What fields do you see devs think they know about? I’ve never personally seen this with other devs I work with but obviously small sample size…

Literally everything. Just pick a topic and you'll see SWEs on Hacker News prognosticating about it as if they knew everything while knowing nothing but the surface.

Internet discussion != real-world professional fakery

Re: SQLite Critical CVEs or LLM Slop?

#388

Post by Sammi »

ekholm_e wrote: post #326
afavour wrote: post #320

Earlier quoted context omitted.

In my experience, product. There’s a pervasive view that product is easy, that anyone working in it is a dunderhead who gets in the way of engineers doing the really worthwhile work. In reality, it would just mean they rewrite the software five times and have zero customers. Oh, design too. I’ve met many engineers who simply don’t see any value in design.

This. I'm a former teacher. I left to get a PhD in educational psychology, and now I'm a data scientist for a large school division. The number of ed tech companies I interact with who clearly have little grasp of research-based best practices in education is staggering. But they can all build slick-looking websites and dashboards.

The software is not the product.

You can't get a software person to understand this unless they learn the domain they are working in properly.

Re: SQLite Critical CVEs or LLM Slop?

#389

Post by sam_lowry_ »

cogman10 wrote: post #56
flerchin wrote: post #39

Earlier quoted context omitted.

The vast majority of CVEs are not exploitable, basically noise. I suspect that the overwhelming majority of the CVEs being generated by LLMs are either noise of the sort in the linked article or noise of the sort that is not exploitable.

This is what I truly don't like about the CVE system. One such example is CVE-2023-45853 [1]. Zlib included in it's source an extra set of utilities and add-ons. One such utility, MiniZip, had a buffer overflow vulnerability. BAM, 8.8 CVE (was a 9, looks like they pulled it back a bit). But not one that the 99% of applications using zlib would ever be vulnerable to because almost nobody used the MiniZip utility. It w…

> our security policy required us

Nope, someone should have requested that from you directly or indirectly, but you should not have done the pointless job if you have a pointy one usually.

If you obey, it degrades you and the society at large.

Re: SQLite Critical CVEs or LLM Slop?

#390

Post by senordevnyc »

gbnwl wrote: post #198
gortok wrote: post #52

We can chalk this up as another example of over-exhuberance by what folks believe LLMs can accomplish vs. what they actually are. LLM-based “AI” is able to use its vast corpus of inputs and calculate the most statistically likely output in a given situation. It is probabilistic, and when you are dealing with probabilities in a situation where certainties, not probabilities, matter, you’re going to get dinged on credi…

Every day I wake up and open HN. “LLM has made legitimate mathematical discoveries” —> Wow the rate of progress is amazing. Highly upvoted. “LLM does something not good” -> Does everyone else not realize LLMs are just dumb next token predictors? Highly upvoted. So tired of this discourse and this site.

I agree. To me it seems blindingly obvious that a huge swath of the HN audience is gripped by fear and a loss of identity as a result of what LLMs have demonstrated over the last couple years, and they're lashing out as a result. Shaking their fist at the sky because they don't like the weather. Very understandable, but it's getting old to read month after month.
Post reply on HN