2026-02-08 18:34 UTC
@varx@infosec.exchange For sure, the test I mentioned above was in response to a known use-after-free in Firefox. That said, I find it interesting that a lot of people seem to be saying, "AI can do _other_ people's job, but the thing I'm a specialist at? No way." This could be construed as a variant of the Gell-Mann amnesia effect (experts can spot the BS) or just cope.
I'm not sure, but I do know that many people at the security company I work for are taking claims like this seriously: https://socket.dev/blog/the-next-open-source-security-race-triage-at-machine-speed
Replies (1)
-
@varx@infosec.exchange 2026-02-08 22:02
@nolan@toot.cafe I mean, I definitely think it can do an awful lot of jobs... badly. :-) The question for me is whether companies are actually OK with that reduction of quality. I'm concerned that they will be, at least in the short to medium term. I do think that LLMs can often find vulns, and *in the hands of an expert* can assist in securing software. Otherwise it's just a flood of crap, as the article notes. But coming back to my original question: Is that code you generated usable? - Would you feel comfortable if your daily browser used this generated code instead of hand-written? Would you install it on your family's computers? - If no, what would it take for your answer to change?