111–120 of 203 posts
I really didn't expect a story about curl and AI to be positive for once. Some history: https://hn.algolia.com/?q=curl+AI
Yeah this is really fair play to Daniel Stenberg that he still approached these AI generated bug reports with an open mind after all the problems he's had.
Earlier quoted context omitted.
I saw an article today from the BBC where travellers are using LLMs to plan their vacations and getting into trouble going places (sometimes dangerously remote ones) to visit landmarks that don't even exist: https://www.bbc.com/travel/article/20250926-the-perils-of-le... I'm mildly bearish on the human capacity to learn from its mistakes and have a feeling in my gut that we've taken a massive step backwards as civili…
I could almost understand a lawyer working late the night before a brief is due and just run out of time to review the output of the LLM. How do you not look up travel destinations before heading out? That's just something I can't wrap my head around in any way of trying to be kind and seeing the other side of something
From the layman's perspective, they did. That's the whole problem.
Earlier quoted context omitted.
Yeah this is really fair play to Daniel Stenberg that he still approached these AI generated bug reports with an open mind after all the problems he's had.
I think the big difference is that these aren't AI generated bug reports. They are bugs found with the assistance of AI tools that were then properly vetted and reported in a responsible way by a real person.
This should probably link to the original blog post by Joshua Rogers: https://joshua.hu/llm-engineer-review-sast-security-ai-tools... ("Hacking with AI SASTs: An overview of 'AI Security Engineers' / 'LLM Security Scanners' for Penetration Testers and Security Teams")
Link should be updated to this https://joshua.hu/llm-engineer-review-sast-security-ai-tools...
I'll be doing a retrospective in a few weeks when the dust has settled, as well as new tools I've been made aware of.
Something sounds fishy in this. Has these bugs really been found by AI? (I don't think they were). If you read Corgea's (one of the products used) "whitepaper", it seems that AI is not the main show: > BLAST addresses this problem by using its AI engine to filter out irrelevant findings based on the context of the application. It seems that AI is being used to post-process the findings of traditional analyzers. It re…
Hi, I'm Etienne, one of the cofounders @ ZeroPath. We do not use traditional static analyzers; our engine was built from the ground up to use LLMs as a primitive. The issues ZeroPath identified in Joshua's post were indeed surfaced and triaged by AI. If you're interested in how it works under the hood, some of the techniques are outlined here: https://zeropath.com/blog/how-zeropath-works
Joshua describes it as follows: "ZeroPath takes these rules, and applies (or at least the debug output indicates as such) the rules to every .. function in the codebase. It then uses LLM’s ability to reason about whether the issue is real or not."
Would you say that is a fair assessment of the LLM role in the solution?
Earlier quoted context omitted.
Yes, because ideas are not worth much if anything. If you have an idea of a book, or a painting, and have someone else implement it, you have not done creative work. Literally, you have not created the work, brought it to existence. The creator has done the creativity.
If you write a screenplay (the idea), and direct actors to act it out according to your vision (the implementation), did you _create_ the film? I think my answer would be "Does it matter?" If it brings joy to you or others, who cares about the semantics of creation
This is exactly what I'd want from an 'AI coding companion'. Don't write or fix the code for me (thanks but I can manage that on my own with much less hassle), but instead tell me which places in the code look suspicious and where I need to have a closer look. When I ask Claude to find bugs in my 20kloc C library it more or less just splits the file(s) into smaller chunks and greps for specific code patterns and in t…
I explicitly asked it to read all the code (within Cline) and it did so, gave me a dozen action items by the end of it, on a Django project. Most were a bit nitpicky, but two or three issues were more serious. I found it pretty useful!
Earlier quoted context omitted.
Do you believe AI is at the core of these security analyzers? If so, why the personal story blogpost? You can just explain me in technical terms why is that so. Claiming to work for Google does not work as an authority card for me, you still have to deliver a solid argument. Look, AI is great for many things, but to me these products sounds like chocolate that is actually just 1% real chocolate. Delicious, but 99% no…
I had a conversation in a chat room yesterday about AI-assisted math tutoring where a skeptic said that the ability of GPT5 to effortlessly solve quotient differentials or partial fraction decomposition or rational inequalities wasn't indicative of LLM improvements, but rather just represented the LLMs driving CAS tools and thus didn't count. As a math student, I can't possibly care less about that distinction; eithe…
If it doesn't matter if it's AI or not, just that they're good tools, why even advertise the AI keyword all over it? Just say "best in class security analysis toolset". It's proprietary anyway, you can't know how much of it is actually AI (unless you reproduce its results, which is the core argument you missed here).