5 ms·
Surprisingly, no. The reason I got into security in the 90s was because I saw hackers as a check on the absolute dominion of tech enabled institutions, and a bi
by motohagiography 3y ago
Surprisingly, no. The reason I got into security in the 90s was because I saw hackers as a check on the absolute dominion of tech enabled institutions, and a big part of that was always being the exception and finding a way to remain smarter than weaponized AI. We're going to see some truly awesome AI malware, and it will devalue some skills people and hackers have heavy sunk costs in, but we prevail.
Short term, cyber security is governance with a high technical competency bar to entry at any serious level, and the reason we're still in demand and these problems aren't solved is because competence at managing dynamics and risk is still irreducible. Every model and formalization creates a dynamic with whatever it models and formalizes, which creates an opportunity to exploit and manage it. AI mainly creates manageable dynamics and demand for governance, which means no matter what you're going to need hackers unless we're all livestock.
Long term, security as we understand it today will go the way of the Orange book, and it will evolve as a variation what it really is, a purer understanding and way of relating to tech. Fundamentally, hacking is the logic of an idea that we can apply to anything, where instead of goodguy/badguy, or oppressor/oppressed, we have true/false, where something is only true within the domain of its assumptions, and when you change those, you get understanding and leverage. It's all the things that work in practice just not in theory. AI is a figment of aggregated and nested assumptions, so all I see is opportunity. It will be as pernicious as human conceit, and I'm pretty sure it's going to kill a lot of people, but I'd say if you don't have the practice, you don't know what you don't know about our advantages over it. We're good. :)
- c0pium 3y ago[flagged]
- czbond 3y agoMaybe you're not experienced enough to understand it? I clearly understood what this parent post is saying.
- c0pium 3y agoThat’s not what word salad means. Don’t worry, one day you’ll have the experience to understand that.
- deleted 3y ago[deleted]
- ofjcihen 3y agoI understood the parent perfectly fine.
- mpeg 3y agoI'm only into infosec as a hobby, but I already find LLMs extremely useful and (annoyigly!) better than me at certain things. For instance, I can analyse some obfuscated malware code manually but it takes time and a bit of trial and error. I have used GPT4 to instantly give me the gist of what some custom JS vm is doing, or to analyse a smart contract and give me some bullet points to focus on While I agree with you the hacker mindset and related skillsets will survive and can be applied to other domains – the pure technical skills I used to take pride on are now commoditised. It's a scary new world.
- moonchrome 3y agoIf it's anything like LLM for code review then I'd say it's not very potent. No doubt it's good at paraphrasing code, deobfuscation sound like a good usecase. Other than that I've seen it mostly come up with bullshit : - random opinions stated as fact (x makes code readable, y makes code simpler to understand, yada yada) - it's like a review from a mid level dev that finished reading Uncle Bob or some crap like that and suddenly there's 8 functions where there should be 2 - suggests changes that make the code subtly incorrect - like rewriting code with a different container type and messing up result ordering - state false information like suggesting that a dictionary will be faster than array search (for fixed size/small array), or that some approach is faster because it doesn't allocate (but original didn't allocate either and the new approach actually does, it just hides it in a container), etc. - can't catch complex logic bugs for shit, even with leading follow-up questions (once I figured out the problem and went back to see how long it would take GPT to figure it out)
- mistrial9 3y agorespectfully disagree here - not entirely, but rather the axis upon which the split is discussed. AI at this time mostly involves natural human language (typed first) interface to knowledge, enacted in code. The failure of Prolog and that era of AI was said succinctly by IBM's Sriram Raghavan (sp?) as "determined by rules and facts, and who is going to type in all those rules? so it went nowhere" At this go-round, some semblance of understanding of questions, plus really a lot more data on tap, changes the equation. An "AI" freed of needing pre-built if-then-if-then could possibly work at speeds of iteration, or speeds in response times, that will startle even those prepared for this. So in the "John Henry race against the steam engine" [0] sense, no contest. [0] https://en.wikipedia.org/wiki/John_Henry_(folklore) https://en.wikipedia.org/wiki/John_Henry_(folklore) What humans will retain, and build, is authority. A signature authority is a ticket to an easy life, as many in law and health care know well. "executives" of all kinds, and even the lowly salesmen, will retain that signature authority despite any competency of any other, human or machine, because it is adversarial in the first instance. The contest of will and locks will not be ceded, but the contest of erudition and good taste, will be lost by the human in most cases. That is a suggestion for the axis upon which to measure the future fates of humans in markets and governance. AI is a surveillance state wet dream in the making. It is the humans we have to watch out for, starting yesterday IMHO.