Post #1253935

2026-04-09 17:39 UTC

So here's the other thing that bothers me about all this. Regardless of the eventual results, this thing they're doing is *incredibly* resource intensive. They routinely spend billions of dollars on training these models, and billions more on operating them. It's not simple to parse out what fraction of that is directly attributable to the massive scale vuln finder/fabricator. But for the sake of argument lets just pick a plausible number, and call it 50-100 million dollars. What could we have gotten for 50-100 million dollars of sponsorship for security audits? Prior to this, the largest single investment into FOSS security I'm aware of was the 2015 audit of openssl, after the heartbleed incident. It's hard to find precise costs for that, but I found a few sources estimating 1.2 million dollars, and that is arguably the most security critical piece of software in the world. But suddenly there's 100x more resources available to do this work, now that producing the artifact can be done with stolen labor? Now that they can externalize the cost of false positives onto the already mostly unpaid maintainers of these projects? Even if their claims are true, which we have no reason to believe and very good reason not to, it's still a travesty

Replies (5)

@sci_photos@troet.cafe 2026-04-09 17:41

@jenniferplusplus 😔

Open ##1253978
@datarama@hachyderm.io 2026-04-09 17:46

@jenniferplusplus 100 million dollars of sponsorship for FOSS project security audits doesn't sell a promise that soon all the humans can be fired.

Open ##1253979
@mnl@hachyderm.io 2026-04-09 17:49

@jenniferplusplus while I agree with the "AI companies are mostly full of shit" part, this would be the first kind of announcement like this I am taking semi-seriously. Here's what's been happening the last couple of months, and this is with _current_ models. There are step functions at play, and I think the step function from "at least some skill needed to wield an LLM to find security issues" to "everybody with a $200 can exploit every OS/browser out there" should be considered very carefully. Nicholas Carlini saying he found more bugs in 2 weeks than in his entire career with Mythos is not something I can dismiss. Or daniel stenberg, certainly someone with actual authority and experience compared to me showing the current situation: https://mastodon.social/@bagder/116373716541500315 https://mastodon.social/@bagder/116362046377975050

Open ##1253980
@integerpoet@sfba.social 2026-04-09 17:58

@jenniferplusplus OpenSSL is important to the world. Software for which a CTO might be held responsible is important to that CTO. There should be more overlap, but there isn’t.

Open ##1253990
@yeahyeahyens@det.social 2026-04-09 22:11

@jenniferplusplus They want to get rid of us. The price doesn't matter.

Open ##1253992