Live data from Hacker News

Curl: We still have not seen a valid security report done with AI help

linkedin.com

131–140 of 258 posts

Re: Curl: We still have not seen a valid security report done with AI help

#131

For those of you who don't want to click into linked in, https://hackerone.com/reports/3125832 is the latest example of a invalid curl report

This is interesting because they've apparently made a couple thousand dollars reporting things to other companies. Is it just a case of a broken clock being right twice a day? Seems like a terrible use of everyone's time and money. I find it hard to believe a random person on the internet using ChatGPT is worth $1000.

Re: Curl: We still have not seen a valid security report done with AI help

#132

Earlier quoted context omitted.

I recently had this happen from a senior engineer. What's really frustrating is I TOLD them the issues and how to fix it. Instead of listening to what I told them, they plugged it into GPT and responded with "Oh, interesting this is what GPT says" (Which, spoiler, was similar but lacking from what I'd said). Meaning, instead of listening to a real-life expert in the company telling them how to handle the problem they…

>They view it as a shortcut to problem solve and it isn't Oh but it is, used wisely. One: it's a replacement for googling a problem and much faster. Instead of spending half an hour or half a day digging through bug reports, forum posts, and stack overflow for the solution to a problem. LLMs are a lot faster, occasionally correct, and very often at least rather close. Two: it's a replacement for learning how to do so…

This exactly!

There are so many things that a human worker or coder has to do in a day and a lot of those things are non-core.

If someone is trying to be an expert on every minor task that comes across their desk, they were never doing it right.

An error page is a great example.

There is functionality that sets a company apart and then there are things that look the same across all products.

Error pages are not core IP.

At almost any company, I don't want my $200,000-300,000 a year developer mastering the HTML and CSS of an error page.

Re: Curl: We still have not seen a valid security report done with AI help

#133
post #89

Shame they need to put up with that spam. However, every big open source project has by now had good contributions with "AI help". Many millions of developers are using AI a little as a tool, like Google.

I unironically can't remember a single case where AI managed to find a vulnerability in an open source project.

And most contributions with 'AI help' tend to not follow the code practices of the code base itself, while also in general generating worse code.

Also, just like in HTTP stuff 'if curl does it its probably right', I'm also tend to think that 'if the curl team says something its bullshit its probably bullshit'.

Re: Curl: We still have not seen a valid security report done with AI help

#134

Something that really frustrates me about interacting with (some) people who use AI a lot is that they will often tell me things that start “I asked ChatGPT and it said…” stop it!!! If the chatbot taught you something and you understood it, explain it to me. If you didn’t understand or didn’t trust it, then keep it to yourself!

[deleted]

Re: Curl: We still have not seen a valid security report done with AI help

#135
post #83

Earlier quoted context omitted.

Reputation systems for this kind of thing sounds like rubbing some anti-itch cream on bullet wound. I feel like the problem seems to me to be behavior, not a technology issue. Personally I can't imagine how miserable it would be for my hard-earned expertise to be relegated to sifting through SLOP where maybe 1 in hundreds or even thousands of inquiries is worth any time at all. But it also doesn't seem prudent to jus…

I guess I'm confused by your position here. > I feel like the problem seems to me to be behavior, not a technology issue. Yes, it's a behavior issue, but that doesn't mean it can't be solved or at least minimized by technology, particularly as a technology is what's exacerbating the issue? > It's fundamentally about trust in people. Who is lacking trust in who here?

Vulnerability reports are interesting from a trust point of view, because each party has a different financial incentive. You can't 100% trust the vendor to accurately assess the severity of an issue - they have a lot riding on downplaying an issue in some cases. The person reporting the bug is also likely looking for bounty and reputational benefit, both of which are enhanced if the issue is considered high severity. So a user of the supposedly-vulnerable program can't blindly trust either party.

Re: Curl: We still have not seen a valid security report done with AI help

#136

Earlier quoted context omitted.

But is "I asked chatgpt" assigning any authority to it? I use precisely that sentence as a shorthand for "I didn't know, looked it up in the most convenient way, and it sounded plausible enough to pass on".

In my own experience, the vast majority of people using this phrase ARE using it as a source of authority. People will ask me about things I am an actual expert in, and then when they don’t like my response, hit me with the ol’ “well, I asked chatGPT and it said…”

I think you are misunderstanding them. I also frequently cite ChatGPT, as a way to accurately convey my source, not as a way to claim it as authoritative.

Re: Curl: We still have not seen a valid security report done with AI help

#137
post #85
post #39

Earlier quoted context omitted.

We cannot blame the tools for how they are used by those yielding them. I can use ChatGPT to teach me and understand a topic or i can use it to give me an answer and not double check and just copy paste. Just shows off how much you care about the topic at hand, no?

This subthread was about blaming people, not the tool.

my bad I had just woke up!

Re: Curl: We still have not seen a valid security report done with AI help

#138

Earlier quoted context omitted.

It is not about stating a source, the bad thing is treating chatGPT as an authoritative source like it is a subject matter expert.

But is "I asked chatgpt" assigning any authority to it? I use precisely that sentence as a shorthand for "I didn't know, looked it up in the most convenient way, and it sounded plausible enough to pass on".

It's a social-media-level of fact checking, that is to say, you feel something is right but have no clue if it actually is. If you had a better source for a fact, you'd quote that source rather than the LLM.

Just do the research, and you don't have to qualify it. "GPT said that Don Knuth said..." Just verify that Don said it, and report the real fact! And if something turns out to be too difficult to fact check, that's still valuable information.

Re: Curl: We still have not seen a valid security report done with AI help

#139

Something that really frustrates me about interacting with (some) people who use AI a lot is that they will often tell me things that start “I asked ChatGPT and it said…” stop it!!! If the chatbot taught you something and you understood it, explain it to me. If you didn’t understand or didn’t trust it, then keep it to yourself!

I find that only acceptable (only little annoying) when this is some lead in case we're we have no idea what could be the issue, it might help to brainstorm and note that this is not verified information is important. most annoying is when people trust chatgpt more that experts they pay. we had case when our client asked us for some specific optimization, and we told him that it makes no sense, then he asked the othe…

> when this is some lead in case we're we have no idea what could be the issue

English please

Re: Curl: We still have not seen a valid security report done with AI help

#140
post #89

Shame they need to put up with that spam. However, every big open source project has by now had good contributions with "AI help". Many millions of developers are using AI a little as a tool, like Google.

I unironically can't remember a single case where AI managed to find a vulnerability in an open source project. And most contributions with 'AI help' tend to not follow the code practices of the code base itself, while also in general generating worse code. Also, just like in HTTP stuff 'if curl does it its probably right', I'm also tend to think that 'if the curl team says something its bullshit its probably bullshi…

You wouldn't say "the Google search engine contributed to an open source project". Similarly, many millions of developers are using AI. Sometimes in a good way. When that results in a good MR, they likely don't even mention they used Google, or stackoverflow, or AI, they just submit.
Post reply on HN