New details about what we found, and how agentic harnesses are now able to reproduce real bugs and dismiss false positives.
  • nomad@infosec.pubEnglish
    1 day

    i know the author personally. We went to the same university for IT security. His skills are undeniable. Ignoring a legitimately working tool that finds legitimate security problems is just asking for trouble. For all its flaws there are some legitimate uses of LLMs and this is one of them.

    maintainers of critical Software can’t afford to be that ignorant.

    • Repple (she/her)@lemmy.worldEnglish
      1 hour

      4.6 Opus was a huge jump from earlier models and the first that was actually useful for things like this from my experience (and 4.7 is significantly worse for some reason).

      I have made many anti-LLM posts here and I remain pretty negative on them, but they have absolutely become useful. Part of the problem is the truth is really somewhere between the insane promises and the dismissals.

      My problems are many fold though, from being propped up by insane subsidies, the massive power usage to the thing I most care about: taking more power from the masses. The more useful they get, the more power gets concentrated to those able to afford the data centers.

      Computers used to be at least somewhat democratizing, sure there were some things like weather modeling that an ordinary person couldn’t do, but a random person on thier computer could put something together to change the world.

      What happens when the breakthroughs are available only for the wealthiest? Regular folks can buy tokens at a reasonable price today, but running cutting edge models on consumer hardware isn’t really feasible. We’ve ceded too much control.

    • General_Effort@lemmy.worldEnglish
      23 hours

      Yes. I hesitated to post this because I understand that many here would prefer not to know. But, at least, people need a chance to learn the facts and make their own decisions. The amount of anti-AI disinformation is crazy.

      • SilentKnightOwl@slrpnk.netEnglish
        22 hours

        I’m anti LLM for a lot of applications, for a lot of reasons, but there are obviously things that it is useful for, and I think this is one of them. If a cybersecurity specialist reviews the flaws flagged by the LLM, confirms they are legitimate, and uses that data to fix them, I don’t see an issue.

        • ranzispa@mander.xyzEnglish
          19 minutes

          A very useful thing I found is the following: take a couple hours thinking about interesting research ideas. Work out with chatgpt existing solutions and identify key publications. Use Claude code to modify existing software to do something new. In one day of work you got a proof of concept of whether your idea may work. Of course from there on you have to work it out and make it good, but having a confirmation quickly completely changes the fact that you normally have to go through dozens of papers and take several months to review existing publications on the topic.

      • nomad@infosec.pubEnglish
        19 hours

        I agree people turn a blind eye to a breakthrough just to be left behind when its used against them. Inform yourself so you can be an informed member of society.

      • XLE@piefed.socialEnglish
        18 hours

        @[email protected] thoughts, now that you read this? I hope you and your friend don’t turn a blind eye. Mozilla’s ethical stance is important.

        • nomad@infosec.pubEnglish
          15 hours

          Its not the tool that is evil, but the intent its used with. That’s all I’m gonna say on that topic.

          • XLE@piefed.socialEnglish
            8 hours

            I’m learning a lot about Mozilla’s ethics today.

            It sounds like you and your friend believe they are outmoded. Anthropic is not just a toolmaker, they host the thing that was used to decide to kill children, and its CEO Dario Amodei has expressed desire to continue building war weapons.

            In retrospect, do you and your friend believe that the product made by a homophobe such as Brendan Eich is just a tool too?

            • XLE@piefed.socialEnglish
              5 hours

              @[email protected] if you’re going to interact, please remember that you were accepted by the Firefox fan community as a spokesperson for your Mozilla employee friend. How deeply are you and friend burying your heads? Surely your ethics hasn’t degenerated into no longer believing the thing you said a few hours ago, I hope.

  • Nighed@feddit.ukEnglish
    20 hours

    It would be interesting to know the token cost for all of this. I think they are getting lots free as advertising for Anthropic, would it be feasible otherwise?

    • General_Effort@lemmy.worldEnglish
      19 hours

      They are supporting some projects with free tokens. Their own people are also helping to find and patch bugs. The latter is probably more to help improve the model and harness than PR. I don’t think they have to worry about advertising anymore. Mind that there certainly would be a major outcry if something important got hacked with help by their service. They might even have to pay damages. But I wouldn’t put it past them that they are being responsible as a matter of principle.

  • greyscale@lemmy.grey.oooEnglish
    1 day

    I don’t care about your usage of the slopmachine.

    As a user of your products, I wish you’d stop. There are scant few browsers for me to leave to.