331–340 of 373 posts
Earlier quoted context omitted.
Also, LLMs never *write* code snippets, they just pirate them from somewhere else.
So, like humans? Code didn't just appear in my brain, I learnt it from reading it everywhere else.
With an LLM you do zero of those things. I don't understand how you don't get that.
Earlier quoted context omitted.
You’re leaving out some options for sure. Not everyone would need to live under the conditions of a police state, you could theoretically screen everyone and assign them to various levels of risk which would determine their level of supervision.
While true, I'm not sure this is much better. There are many genetic traits which are correlated with increased criminality, risk taking, obesity, heart disease, unemployment, etc. IQ in particular is the most well correlated metric we have for criminality, for example. This would imply that some people are just born with fewer freedoms. That's probably a good thing for society in aggregate, but something about this…
Earlier quoted context omitted.
> would have to be honestly reported for that idea to work. and why does this idea work for accounting audits, but not for security? As long as regulations for companies exist, they would necessarily follow it, and this would lead to reporting of security breaches just like companies would have to report their financials honestly.
Accounting is generally both easier to do correctly and easier to verify than security practices, unfortunately
Earlier quoted context omitted.
> There are millions of schizophrenics worldwide. Are you sure you want to roll those dice? We've been rolling them for the past 3 years and nothing happened. Can we stop with this baseless fearmongering crap?
Humans are inherently bad at reasoning about rare events. In 2019, many people implicitly reasoned that "since there hasn't been a pandemic in the past 3 years, there won't be one in 2020". Bill Gates was one of the few voices arguing that the world was quite vulnerable to a pandemic. Now he's arguing that the world is quite vulnerable to AI.
...pandemics are precedented. There's a world of difference between that and a fully hypothetical catastrophe that you can't even describe without looking and feeling silly.
Bill Gates is Epstein's pal, and not a very intelligent person to-boot. I trust his liberal musings about as much as I trust Chomsky's hysterical and discredited views concerning AI.
Earlier quoted context omitted.
> I wonder why C and C++ are usually regarded as equally insecure. They aren't, usually. C++ has all the C problems, and multiples more on top of those. It's a broad attack surface - literally no one is going to claim to be proficient in every single C++ feature available to their compiler. It's also quite opaque to visual inspection (making double-checking with an LLM difficult as it needs whole-program reasoning in…
I disagree, the minimalism of C results in writing overly complex code to solve simple problems. Things like type punning and bit hacks are common place in C. The end result is equivalent C code is much more complex than C++. For example, you need to remember to call free every time, forever, in every function. In C++ you just use unique ptr or shared ptr and you’re done. It’s a simpler model, enabled by the more com…
The analogy I prefer is that it's safer to ride a bike down to the store than flying a space shuttle down to the store.
[EDIT: Added trailing 'down to the store']
Earlier quoted context omitted.
> There are millions of schizophrenics worldwide. Are you sure you want to roll those dice? We've been rolling them for the past 3 years and nothing happened. Can we stop with this baseless fearmongering crap?
The necessary IQ for destroying the world is dropping. Op does not say it's low enough today , but that will probably come sometime. Denying the possible harm these tools are capable of doesn't help.
Earlier quoted context omitted.
The necessary IQ for destroying the world is dropping. Op does not say it's low enough today , but that will probably come sometime. Denying the possible harm these tools are capable of doesn't help.
It would be much harder to deny it if any of you were capable of describing the risks. The current discussion is a national-scale Handwavium mine.
Earlier quoted context omitted.
That’s not been my experience at all when working in DevSecOps. What actually happens in organisations is they define risks and then sign off what risks they’re willing to accept. Any business that looks at security as a binary value is running their business wrong. Period. And yes, people really are that lazy. There are countless studies that have shown just how lazy people are. It’s why shadow IT is a big problem i…
I think that's separate. You can define an obvious risk e.g. "we may be infected with ransomware" and the security spending / productivity costs to stop it are still unlimited because nobody knows how to solve it.
You should tackle security in the same way you’d tackle any other kind of engineering initiative in IT. You break the problem down to identifiable tasks that can be easily marked as completed or not required (eg like developers track work in a KANBAN or sprint).
So to take your ransomware example, instead of having a “ransomware” as a risk you’d instead talk about data loss as a risk. And the action items would be DR policies, automated backups, IaC tested in fresh environments, and so on.
And the reason compliance standards like CIS and NIST can be valuable is because you then have a benchmark for code and infrastructure. And you’ll use their findings to define a plan of action. Some of their findings will be high risk and some of them won’t even be relevant to your specific architectural design. But that’s up to you as a business to review and decide.
So you absolutely can know how much time and money to spend on these problems. And while it doesn’t provide guarantees (just like you don’t build houses in the UK to withstand hurricanes because nobody expects a hurricane in the UK but it’s not entirely impossible that one day such a weather phenomenon might occur), following the processes I’ve described does allow you to define how much effort to invest in security and what risks you’re willing to sign off.
In a way, you already do this subconsciously when you make engineering decisions eg cloud agnostic / multi-cloud architectures vs on prem or which open source libraries to used based on community support. But the process I describe just documents the same decisions in a way that’s presentable to stakeholders.
I'm confused why the worry about LLMs that will answer "how do I build a pipe bomb". That information is easily available other places. The anarchist cookbook has been around and available for 55 years, and yet pipe bombs are not going off all around us.
In our town, a single homeless man has caused millions in infrastructure damage (and 24-48 hr hold ups of utilities) every year. I imagine what one determined, clear-headed individual might do and...it certainly wouldn't take a single LLM interaction.
Earlier quoted context omitted.
Also, LLMs never *write* code snippets, they just pirate them from somewhere else.
So, like humans? Code didn't just appear in my brain, I learnt it from reading it everywhere else.