Earlier quoted context omitted.
Those people weren't engineers to start with.
Software engineers rarely are. I’m saying this tongue in cheek, but there’s some truth to it.
Curl: We still have not seen a valid security report done with AI help
111–120 of 258 posts
Re: Curl: We still have not seen a valid security report done with AI help
#112Counterpoint we have a CVE attributable to ours and I suspect the difference is my co-founder was an offensive kernel researcher so our system is tuned for this in a way your average...ambulance chaser is unable to do. https://blog.bismuth.sh/blog/bismuth-found-the-atop-bug https://www.cve.org/CVERecord?id=CVE-2025-31160 The amount of bad reports curl in particular has gotten is staggering and it's all from people wh…
Re: Curl: We still have not seen a valid security report done with AI help
#113Counterpoint we have a CVE attributable to ours and I suspect the difference is my co-founder was an offensive kernel researcher so our system is tuned for this in a way your average...ambulance chaser is unable to do. https://blog.bismuth.sh/blog/bismuth-found-the-atop-bug https://www.cve.org/CVERecord?id=CVE-2025-31160 The amount of bad reports curl in particular has gotten is staggering and it's all from people wh…
I would try to find a better example than CVE-2025-31160. If you ask me, this kind of 'vulnerability' is CVE spam.
Re: Curl: We still have not seen a valid security report done with AI help
#114Re: Curl: We still have not seen a valid security report done with AI help
#115Earlier quoted context omitted.
That's why I said it's the 2025 version of that, given the new technology. I'm not saying it's the same thing. I guess I'm not being clear, sorry.
It’s not clear to me in what way it is a version of that, other than the response being different from what the asker wanted. The point of lmgtfy is to show that the asker could have legitimately and reasonably easily have found the answer by himself. You can argue that it is sometimes done on cases where googling actually wouldn’t provide the desired information, but that is far from the common case. This present ve…
There are three main reasons I can think of for asking the Internet a question in 2010:
1. You don't know how to ask Google / you are too lazy.
2. You don't trust Google.
3. You already tried Google and it doesn't have the answer or it's wrong.
Maybe there are more I can't think of. But let's say you have one of those three reasons, so you post a question to an Internet forum in the year 2010. Someone replies back with lmgtfy. There are three typical responses depending on which of the those reasons you had f or posting:
1. "Thanks"
2. "Thanks, but I don't trust those sources, so I reiterate my question."
3. "Thanks, but I tried that and the answer is wrong, so I reiterate my question."
Now it's the year 2025 and you post a question to an Internet forum because you either don't know how to ask ChatGPT, don't trust ChatGPT, or already tried it and it's giving nonsense. Someone replies back with an answer from ChatGPT. There are three typical responses depending on your reason for posting to the forum.
1. "Thanks"
2. "Thanks, but I don't trust those sources, so I reiterate my question."
3. "Thanks, but I tried that and the answer is wrong, so I reiterate my question."
So the reason I drew the parallel was because of the similarity of experiences between 2010 and now for someone who doesn't trust this new technology.
Re: Curl: We still have not seen a valid security report done with AI help
#116Earlier quoted context omitted.
It can consult any sources about any topic, ChatGPT is as good at teaching as the pupil's capabilities to ask the right questions, if you ask me
It may well consult any source about the topic, or it may simply make something up. If you don't know anything about the subject area, how do you know if you are asking the right questions?
Re: Curl: We still have not seen a valid security report done with AI help
#117Shame they need to put up with that spam. However, every big open source project has by now had good contributions with "AI help". Many millions of developers are using AI a little as a tool, like Google.
Re: Curl: We still have not seen a valid security report done with AI help
#118For those of you who don't want to click into linked in, https://hackerone.com/reports/3125832 is the latest example of a invalid curl report
Re: Curl: We still have not seen a valid security report done with AI help
#119I handle reports for a one million dollar bug bounty program. AI spam is bad. We've also never had a valid report from an by an LLM (that we could tell). People using them will take any being told why a bug report is not valid, questions, or asks for clarification and run them back through the same confused LLM. The second pass through generates even deeper nonsense. It's making even responding with anything but "clo…
Re: Curl: We still have not seen a valid security report done with AI help
#120Something that really frustrates me about interacting with (some) people who use AI a lot is that they will often tell me things that start “I asked ChatGPT and it said…” stop it!!! If the chatbot taught you something and you understood it, explain it to me. If you didn’t understand or didn’t trust it, then keep it to yourself!
I recently had this happen from a senior engineer. What's really frustrating is I TOLD them the issues and how to fix it. Instead of listening to what I told them, they plugged it into GPT and responded with "Oh, interesting this is what GPT says" (Which, spoiler, was similar but lacking from what I'd said). Meaning, instead of listening to a real-life expert in the company telling them how to handle the problem they…