Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LLM Usage in Debian: Three Proposals

debian.org

Post reply on HN
Print view View original

81–90 of 228 posts

Re: LLM Usage in Debian: Three Proposals

#81

Post by AlexeyBrin »

sigmoid10 wrote: post #68
clcaev wrote: post #27

Earlier quoted context omitted.

Of the 3 proposals, the 2nd/B seems to be more of an “informed consent” model while the other two are seeking a comprehensive exclusion. I hope earnest dialogue and driving to a broad consensus among significant contributors is forthcoming. Notable are the endorsements, which are balanced over all three options, perhaps indicating only 1/3 are supportive of a more permissive position. If this represents core contribu…

I wonder how long software projects will even be able to ban LLM use in an age where exploits are found by LLMs. Like, if you have two forks of Debian and one uses LLMs to fix exploitable bugs and the other one doesn't, the level of security they can offer will be worlds apart. And noone in their right mind would want to use the less secure one. Similar to how noone would want to drive a car that was 100% hand built…

> I wonder how long software projects will even be able to ban LLM use in an age where exploits are found by LLMs.

You can use an LLM to scan your human written code for exploits and patch the relevant ones yourself without any LLM code generation. An LLM is a tool, you can chose how you use it.

Re: LLM Usage in Debian: Three Proposals

#82

Post by potsandpans »

mappu wrote: post #71
prologic wrote: post #20

This set of proposals, are (sorry) just stupid. It's like saying to someone, you are not allowed to saw wood using an electric saw, you must do it by hand. What are we doing here?! LLM(s) are just a tool. Use it as such. You should own the work anyway.

Linus Torvalds said last week that LLMs were just a tool. Lorenzo Stoakes had the impeccable rebuttal that "it's a tool in the same way a nuclear bomb is just a tool" - of course it's useful but there is clearly more to it than that. I'm happy for Debian to at least consider the other aspects of social impact, ethics, copyright, and maintainability.

You wouldn't program a computer with a nuclear bomb!!!

Re: LLM Usage in Debian: Three Proposals

#83

Post by sanxiyn »

prologic wrote: post #78
runarberg wrote: post #77

Earlier quoted context omitted.

The tool makes the food taste bad in ... say ... 20% of the cases, and in 5% of the cases it contaminates the food with salmonella. Yes you can have the chefs taste the food before serving, and test it for salmonella. But it would be completely reasonable for a regulator to ban such a tool, and even more reasonable for restaurants to have a strict policy against using this tool.

You may as well ban every technological advancement in society then. There are risks to everything we do, build and support. Ban 'em all! Let's go back to the dark ages where everything is safe!

WTF. Food safety is just a reasonable thing for a mature civilization to do. It has nothing to do with banning technological advancement.

Re: LLM Usage in Debian: Three Proposals

#85

Post by throw101010 »

AlexeyBrin wrote: post #81
sigmoid10 wrote: post #68

Earlier quoted context omitted.

I wonder how long software projects will even be able to ban LLM use in an age where exploits are found by LLMs. Like, if you have two forks of Debian and one uses LLMs to fix exploitable bugs and the other one doesn't, the level of security they can offer will be worlds apart. And noone in their right mind would want to use the less secure one. Similar to how noone would want to drive a car that was 100% hand built…

> I wonder how long software projects will even be able to ban LLM use in an age where exploits are found by LLMs. You can use an LLM to scan your human written code for exploits and patch the relevant ones yourself without any LLM code generation. An LLM is a tool, you can chose how you use it.

The proposal A doesn't limit it to "use" only:

> with the use or assistance

Don't ask me how they would know you've used a LLM to "assist" you to find the exploit... I don't even know how they would definitely know if you used a LLM for the code to fix it either.

Re: LLM Usage in Debian: Three Proposals

#86

Post by pixl97 »

throw101010 wrote: post #85
AlexeyBrin wrote: post #81

Earlier quoted context omitted.

> I wonder how long software projects will even be able to ban LLM use in an age where exploits are found by LLMs. You can use an LLM to scan your human written code for exploits and patch the relevant ones yourself without any LLM code generation. An LLM is a tool, you can chose how you use it.

The proposal A doesn't limit it to "use" only: > with the use or assistance Don't ask me how they would know you've used a LLM to "assist" you to find the exploit... I don't even know how they would definitely know if you used a LLM for the code to fix it either.

[flagged]

Re: LLM Usage in Debian: Three Proposals

#87

Post by prologic »

sanxiyn wrote: post #83
prologic wrote: post #78

Earlier quoted context omitted.

You may as well ban every technological advancement in society then. There are risks to everything we do, build and support. Ban 'em all! Let's go back to the dark ages where everything is safe!

WTF. Food safety is just a reasonable thing for a mature civilization to do. It has nothing to do with banning technological advancement.

Let's just put this argument to bed shall we? Let's consider another case. Leatherman pocket knives. It has a ~20% chance of cutting you, a 5% change of killing you if it pieces the wrong place in your body. I'm speaking from experience, where I sliced my thumb open (by accident of course!), but it was quite bad that I severed a nerve.

Needless to say, I don't feel compelled to take a moral or ethical stance on the use of such tools -- in this case; pocket knives and their inherent dangers.

Every time no matter how sophisticated or the no. of safeguards you put in place, can still inherently pose risks.

I'm not even arguing about food safety. Just think about the many restaurants that prepare and cook up the Japanese pufferfish. That's not even a tool problem right there, that's a skill and trianing problem. That shit™ will can can kill you if not done right.

Re: LLM Usage in Debian: Three Proposals

#88

Post by pixl97 »

mappu wrote: post #71
prologic wrote: post #20

This set of proposals, are (sorry) just stupid. It's like saying to someone, you are not allowed to saw wood using an electric saw, you must do it by hand. What are we doing here?! LLM(s) are just a tool. Use it as such. You should own the work anyway.

Linus Torvalds said last week that LLMs were just a tool. Lorenzo Stoakes had the impeccable rebuttal that "it's a tool in the same way a nuclear bomb is just a tool" - of course it's useful but there is clearly more to it than that. I'm happy for Debian to at least consider the other aspects of social impact, ethics, copyright, and maintainability.

An LLM is a tool.

A nuclear bomb is a tool.

And programmers are the biggest tools of them all.

/ba dum tis

Re: LLM Usage in Debian: Three Proposals

#89

Post by pixl97 »

sanxiyn wrote: post #23
prologic wrote: post #20

This set of proposals, are (sorry) just stupid. It's like saying to someone, you are not allowed to saw wood using an electric saw, you must do it by hand. What are we doing here?! LLM(s) are just a tool. Use it as such. You should own the work anyway.

It's more like: food processing tool A is known to be defective. We ask employees of this restaurant and supply chains to avoid food processing tool A. This seems eminently reasonable. The question is whether the tool is in fact defective.

Why don't you come back to talking about software rather than using terrible analogies.

LLMs write bad code / so do people, a lot of really bad code.

LLMs write security bugs / so do people, so many god damned security bugs.

Re: LLM Usage in Debian: Three Proposals

#90

Post by pixl97 »

preg_match wrote: post #76
aabhay wrote: post #24

Earlier quoted context omitted.

I’m curious what makes you believe that this distinction is precise or meaningful. What exactly is the difference?

The difference is LLMs are extremely good at analyzing code under the careful hand of an engineer. This is how most vulnerabilities are found now. Prohibiting that might mean that security falls off. And, if the concern is code quality, then everything before the code writing shouldn’t matter. A good engineer using an LLM for analysis and then writing a patch by-hand might create a better patch.

A rather mean counter troll to this is rather than submitting any bugs/security flaws to Debian, just immediately zero day them and say it's because of their LLM policy, since the bugs were found by an LLM.

I'm guessing after a few dozen serious risks that are found some people might think twice.

Post reply on HN