Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We have a year to fix security everywhere

jyn.dev

Post reply on HN
Print view View original

141–150 of 371 posts

Re: We have a year to fix security everywhere

#141

Post by hypfer »

0xDEAFBEAD wrote: post #135
hypfer wrote: post #130

Earlier quoted context omitted.

This is a very roundabout way of saying "Anyone not agreeing with me is simply not smart enough". Which might be true, sometimes, but also might not. And especially will not, if the distinction drawn is between blanket statement "worried about AI" and "not worried about AI".

It's not about being smart, it's about accounting for your own ignorance. >And especially will not, if the distinction drawn is between blanket statement "worried about AI" and "not worried about AI". I'm just describing the general pattern I see in cognitive tendencies. If you can think of a way to make the fundamental point about the limitations of our knowledge in a way that's still compelling but less antagonisti…

Why would I support your in your doomer lobbying quest by telling you how you can better hack people?

My safeguards blocked this request.

Re: We have a year to fix security everywhere

#143

Post by mark_something »

chris_wot wrote: post #63

More tired “don’t use C or C++” advise.

I wonder why C and C++ are usually regarded as equally insecure. In C you need to carefully check that you free allocated memory, and that you don't use it after you free it. In C++ this is automated by using classes like std::string and std::vector, once they go out of scope their memory is freed and you can't use it anymore. It is still possible, e.g. by using a for loop that iterates over a vector, and removing or adding stuff to that same vector in that loop. But my rough estimate is that such errors are at least ten times less likely in C++.

I develop in C++ for a job, and when I need to use a library written in C I always have a bad feeling about it.

Re: We have a year to fix security everywhere

#144

Post by saidnooneever »

kennywinker wrote: post #85

I'm confused why the worry about LLMs that will answer "how do I build a pipe bomb". That information is easily available other places. The anarchist cookbook has been around and available for 55 years, and yet pipe bombs are not going off all around us.

this is because of perception Bias. people working in fields where crime or violence is the day to day think everyone is a violent criminal, so if things like this become available thing the world will end and everyone will kill eachother. Reality however will be different, because in reality most people do not want to harm another. This has been proven by many studies, that is not a common thing for people to be evil or harmful, but this is hard to recognise is every day is filled with crime and violence.

LLMs will not kill security, it will change. just like handheld high explosives likely changed a deal too somewhere somehow.

Re: We have a year to fix security everywhere

#145

Post by desterothx »

EagnaIonat wrote: post #109
sho wrote: post #19

Earlier quoted context omitted.

The joke is that macs are famously slow at prompt prefill and you are not getting anything back in 3 seconds, or probably even 30. Once they get generating, it can be acceptable, but the TTFT is horrendous. There's a ton of well-understood things Apple can and hopefully will do to massively accelerate every stage of this pipeline and hopefully they're hard at work implementing most of them for m7.

> The joke is that macs are famously slow at prompt prefill and you are not getting anything back in 3 seconds. Your knowledge is out of date. In truth it depends on the Mac and the models used. I asked this question on M5 Max 128GB, using Ollama model Quen3.8:27b-mlx, with thinking enabled. Question: "Give me a python code snippet that opens a file and sorts the lines of text. " In 2.4 seconds it gave me 4 examples…

We are talking about models of the flash size, 100s of billions of parameters, don't listen to the media, size does matter

Re: We have a year to fix security everywhere

#146

Post by bsoqk »

ErroneousBosh wrote: post #140
sho wrote: post #6

> On September 22, Apple is releasing the M5 Mac Studio with 256 GB of unified memory [..] it will probably [..] enough to write this snippet of code in 3 seconds The author has obviously never ran an LLM on a mac! In 3 seconds, it will have possibly started to think about maybe scheduling a date to contemplate the planning timeline for processing the second token in your prompt.

Also, LLMs never *write* code snippets, they just pirate them from somewhere else.

So, like humans? Code didn't just appear in my brain, I learnt it from reading it everywhere else.

Re: We have a year to fix security everywhere

#147

Post by noio »

Gigachad wrote: post #83
Helmut10001 wrote: post #54

Earlier quoted context omitted.

Static sites all the way (hugo, jekyll, mkdocs!). No one needs wordpress. There's even Sveltia or DecapCMS now, to give those WYSIWYG-people access to static site editing. Then, remove PHP and all the dependency overhead and attack surface and you have a stripped down nginx that is pretty simple, minimalistic and bulletproof.

The problem is no one ever built one that works for normal people. Most Wordpress sites are not operated by programmers, they are run by non technical people who just want a wysiwyg editor and a save button. While static site builders ask you to write markdown files, compile the result, upload it to a server, and if you want to collaborate you have to add git to that. There almost needs to be an admin app which prese…

Pour one out for FrontPage

Re: We have a year to fix security everywhere

#148

Post by olmo23 »

kennywinker wrote: post #85

I'm confused why the worry about LLMs that will answer "how do I build a pipe bomb". That information is easily available other places. The anarchist cookbook has been around and available for 55 years, and yet pipe bombs are not going off all around us.

This is because to build a pipe bomb you need difficult to source materials. This is not the case for other types of threats (cyber / bio).

I personally have no need for an LLM which will readily explain how to cut up the genotype of smallpox into small chunks which can pass the screening at the bio-labs, and can be readily assembled into the real thing by a second year lab-student.

Re: We have a year to fix security everywhere

#149

Post by helsinkiandrew »

kennywinker wrote: post #85

I'm confused why the worry about LLMs that will answer "how do I build a pipe bomb". That information is easily available other places. The anarchist cookbook has been around and available for 55 years, and yet pipe bombs are not going off all around us.

> That information is easily available other places

Often ease of access in the moment is all that matters. If there's a gun nearby you might shoot someone or yourself in a heated argument, but are less likely to go and find/buy one to use. Someone who's stopped from attempting a suicide will likely not try again (70%)

A bored/depressed/angry/curious person might try to build a pipe bomb if they can find out how easily, but are less likely to put in effort.

Re: We have a year to fix security everywhere

#150

Post by the8472 »

petesergeant wrote: post #11

Mmm, a world where a defender-LLM is essentially required is great news for people selling inference.

Defender LLMs without human in the loop are just another prompt injection (AI phishing) and DoS attack vector. Any meaningful mitigation capability you give them is also a capability to do damage. If they can only deploy package updates that's not meaningful because you could do that on a cronjob too. And even something as simple as a circuit breaker can turn into a DoS.

Attacker-GLM: "Defense also GLM. Request to help peer."

Post reply on HN