Post #4167712
2026-07-28 15:40 UTC
@mttaggart@infosec.exchange I don't disagree about the infeasibility of alternate paths to massively increasing the resource budget for infosec, but I guess we don't need to keep putting increasingly finer points on the aforementioned waste.
I think it's bad to build an infosec dependency on LLMs for the same reasons I think it's bad to build an app development dependency on LLMs, but admittedly vuln discovery is one area where there is a big enough asymmetry to make this a real question.
Replies (1)
-
@glyph@mastodon.social 2026-07-28 15:44
@mttaggart@infosec.exchange Ironically, the best argument for bypassing this question of "should we use them" rather than an up or down yes/no decision, comes from an anthropic employee: https://alexgaynor.net/2026/jul/15/you-cant-bugfix-your-way-out-of-the-vulnpocalypse/ Right now, the LLM vulnpocalypse is overwhelming the entire open source community with big piles of vulnerabilities, increasing maintainer burnout, etc. But the path out of this is going to need to be less reactive: eliminating vuln classes, rather than fixing vulns.