Technology

remember when their servers were still vulnerable 20 years later... to a virus written in the 1990s/2000s all because they never updated their own systems?

I've said this a million times. The llms are not better, than us they are infinatly faster. It's like putting 1000 engineers full time on looking for vulnerabilities for 10 years. Sure you can do that. Or pay for the tokens instead and do the same effort overnight.

It it is unsafe to code, full stop.

The things we're expecting our code to handle, with the lack of formal verification testing we're expecting our code to ship with, there's no such thing as safe. It took 50 years to "build the stack" to where we're at, and we did it fast and cheap. There's so many bugs hiding in the lasagna it's amazing it doesn't eat itself.

If you re-build your system from first principles, open source silicon with peer review and constant scrutiny, then the BIOS, then the OS, then the application compilers, and the libraries, all open AND reviewed by multiple concerned parties with formal demonstration of correctness all the way up - the entrenched bug filled lasagna stack owners will smother you, they can't withstand that kind of competition on an open playing field, your project will die of financial starvation, regulation, buyouts and treachery.

Didn't they use LLMs to code Win11 though?

Bragging about how product is at doing something is the easiest way to advertise product. No conspiracy theories needed.

They want you to use their LLM to screen your code for bugs. When you do that, you see how surprisingly well it works now and that leads to you wanting to also use it for generating code. That is when you realize that the 20 bucks starter subscription isn't enough to actually use it professionally... which means, you upgrade and they get moar money.

its great at creating this busy work but not so much with fixing it

Actually, if you know what needs fixing, LLMs can accelerate the fixing process quite a bit too.

The problem is: LLMs don't know what they don't know, so they'll declare "good enough" and it's up to the LLM operator to call BS and give them additional context to ensure they keep going until ALL the applicable concerns are addressed.

That's not what they're saying. They're saying llms are getting so good at revealing vulnerabilities that they have to put focus and effort on finding and fixing them before external malicious actors do.

Yeah it's faster to find a bug than to refactor a whole codebase to fix it, they're still using llms to speed up fixing the bugs. If you believe them, anyway.

I do. Their software stacks were so shit and bloated and had many owners with different visions and understanding of what code does what and why and they rely on being closed source to survive penetration, I do believe llms are finding vulnerabilities left and right, and focused refactoring to address legacy human slop can take time, even for a super competent llm that does it correctly in one shot.

microsoft products half vibe coded

They have a long tradition of not mastering the huge complexity of their own software. Deep security flaws, broken updates, degrading performance etc. are well known companions on any M$ user's journey.

The vibe coding has mostly added speed to the problem, but not changed the principle itself.

Certainly seems that way.

There's a new bug or eminently shitty feature almost every day, or at least it seems that way.

Aren't they legally mandated to do that when they scan books? That way the amount of copies doesn't go up technically.

Also unfortunately it's easier to scan without the bindings.

I do hope the paper gets recycled at least.

Yeah, I can already find more bugs than can be fixed on schedule just by looking in the Jira backlog.

It seems to me that they're converting at about the same percentage rate bugs->exploits as before, they're just getting a lot more press than the old bug reports did.

I've had a subscription to Anthropic/Claude for a bit over 8 months now, and I just added Google's Gemini Pro - While Gemini today is a bit better than Claude was last November, it's far far behind where Claude is now.

One threat: people using the models are finding bugs and the more rare exploits at a much faster rate than before, perhaps 10x. This means that zero-day exploits are coming into the hands of the kinds of people who use them for bad purposes about 10x faster than they used to. It also means the white hats are creating these CVEs faster and people addressing the CVEs are able to do so faster, with the same manpower... so... if either side slows down, it will shift the balance we currently have toward their opponents.

• There are common techniques that can be used broadly to get results with LLMs.
• Some source code is floating around out there, like it is mentioned in the article.
• Yes, decompilation techniques are something that cannot be prevented and are sped up by LLMs.
• There are only so many devs patching bugs, while there might be millions trying to break in - they mentioned the chaining of multiple "low"-priority bugs to escalate the severity, and if you need months to even get the really dangerous stuff fixed, it's a free-for-all bonanza as soon as those models hit the public, and these people don't even need to know anything about cybersecurity - Joe Shmoe can tell Mythos to "go hack Onedrive" and that's all that is needed from Joe Shmoe.

Yes, and AI probably helps with that.