271–280 of 303 posts
Those 3 letter agencies are going to see their stash of 0-days dwindle so hard.
Their stash will explode. LLMs can do this on binaries just the same, and there's a lot more closed than open source SW out there.
But on the other hand, Claude might introduce more vulnerability than it discovered.
Code review is the real deal for these models. This area seems largely underappreciated to me. Especially for things like C++, where static analysis tools have traditionally generated too many false positives to be useful, the LLMs seem especially good. I'm no black hat but have found similarly old bugs at my own place. Even if shit is hallucinated half the time, it still pays off when it finds that really nasty bug.…
It will hurt some CC heavy user’s feeling but that’s a different thing.
Earlier quoted context omitted.
Well, the cloud is someone else's computer.
It is, but that's not a useful or insightful thing to say
Protesting the term is, I'd wager, motivated by something like: it sounds innocuous to nontechnical people and obscures what's really going on.
Pasting a big batch of new code and asking Claude "what have I forgotten? Where are the bugs?" is a very persuasive on-ramp for developers new to AI. It spots threading & distributed system bugs that would have taken hours to uncover before, and where there isn't any other easy tooling. I bet there's loads of cryptocurrency implementations being pored over right now - actual money on the table.
Pasting a big batch of new code and asking Claude "what have I forgotten? Where are the bugs?" is a very persuasive on-ramp for developers new to AI. It spots threading & distributed system bugs that would have taken hours to uncover before, and where there isn't any other easy tooling. I bet there's loads of cryptocurrency implementations being pored over right now - actual money on the table.
You just have to be careful because it will sometimes spot bugs you could never uncover because they’re not real. You can really see the pattern matching at work with really twisted code. It tends to look at things like lock free algorithms and declare it full of bugs regardless of whether it is or not.
And if it's not giving me a reason I can understand for a bug, I'm not listening to it! Mostly it is showing me I've mixed up two parameters, forgotten to initialise something, or referenced a variable from a thread that I shouldn't have.
The immediate feedback means the bug usually gets a better-quality fix than it would if I had got fatigued hunting it down! So variables get renamed to make sure I can't get them mixed up, a function gets broken out. It puts me in the mind of "well make sure this idiot can't make that mistake again!"
This does sound great, but the cost of tokens will prevent most companies from using agents to secure their code.
I don't buy it. Inference cost has dropped 300x in 3 years, no reason to think this won't keep happening with improvements on models, agent architecture and hardware. Also, too many people are fixated with American models when Chinese ones deliver similar quality often at fraction of a cost. From my tests, "personality" of an LLM, it's tendency to stick to prompts and not derail far outweights the low % digit of delt…
Supposedly humans have become “100x”™ more productive with these AI tools, but nowhere to be seen are the benefits for the wielders of said tools. Is your salary 100x higher? Are you able to spend more time with your family/friends instead of at the office? Why are we still putting up with these outdated work practices if LLMs have made everybody so much more productive?
Earlier quoted context omitted.
> Those aren't false positives; they're results he hasn't yet inspected. It's not a XOR
Yes it is. They're not not false positives until they're reported and consume maintainer time.
The hard thing is reducing detected crashes to well-formulated test cases that help rather than hinder maintainers.