5 ms·

> Then there was AWS re:Inforce – the annual security conference – which was themed “Security in the era of generative AI”. This tagline is representative of e

> Then there was AWS re:Inforce – the annual security conference – which was themed “Security in the era of generative AI”. This tagline is representative of every part of the hype around GenAI. It makes it sound like security has fundamentally changed and we all need to re-learn what we know. Everything to do with GenAI is treated like this: we need new security plans, we need AI Engineers as a new job title, we need to completely reevaluate our corporate strategies. Security in the world of generative AI is not substantially different than infosec has been for a while now: User prompts are untrusted input. Model outputs are untrusted input. Treat untrusted input appropriately, and you'll be fine. The same goes for "AI engineers", who are in the business of wiring up APIs to each other like any other backend engineer. We take data from one black box and transfer it to another black box. Sometimes a black box takes a very long time to respond. It's what we've always done with many different kinds of black boxes, and the engineering challenges are mostly solved problems. The only thing that's really new is that the API of these new black boxes is a prompt instead of a deterministic interface. Don't get me wrong, there will be things that will be different in the post-LLM world. But my goodness do the current crop of companies overestimate how large that difference will be.

sylens 2y ago
While that was indeed billed as the theme of reInforce, there were plenty of sessions and workshops that did not involve GenAI at all. There was a great chalk talk about the underpinnings of how the AWS IAM service works across services and regions, for example.
- Aeolun 2y ago
  I’d be interested in knowing why it takes +/- 10 seconds after I create/update a role before I can actually use it.
  - blitzar 2y ago
    If you have navigated far enough to create/update a role you are already aware of the bloat and mess that ties all their services together.
  - sylens 2y ago
    IAM is eventually consistent. And they do a lot of derivations of hashing off an original signature and distributing individual, bespoke versions to services in different regions to limit the blast radius of a compromised credential. If you go to an AWS event in the future, the name of the chalk talk was "The Life of an IAM Policy"
throwaway8481 2y ago
> Model outputs are untrusted input. I think the problem is they're trying to introduce nuance and a narrow path to allow this. They want an acceptable level of risk to using untrusted model output for the efficiency/productivity gains it will bring, notwithstanding hallucinations. Generative AI would not have flown in the security theater of Yesteryear, but CTOs see productivity multipliers.
- usea 2y ago
  > CTOs see productivity multipliers The CTOs are hallucinating as much as the LLMs are.
  - marcosdumay 2y ago
    The GP didn't state the multiplier's value. Those things absolutely are productivity multipliers...
- lolinder 2y ago
  Right, but that's not a new problem either. We want to allow people to send emails with some acceptably-low level of risk that spam will get through. We want an acceptably-low risk that our image upload feature won't be hosting CSAM. And we want it while still getting the benefits of allowing our real customers to pay us for the services we offer. Businesses have been figuring out the balance of risk:reward for as long as infosec has been a concept.
q7xvh97o2pDhNrh 2y ago
As a person replying to your comment in the era of generative AI, I'm inclined to agree the hype is a bit much, even considering how impressive the technology can (sometimes) be. Another big area of hype is "prompt engineering." That one seems to have calmed down slightly, but for a while, there were large swaths of the Internet who were amazed that the set intersection of "talk like a decent human being" and "be precise in your communication" could generally lead to good results. In many ways, "AI" right now is magic marketing sprinkles that you can put on anything to make it more delicious. (Or, if you're inside a big company, it's magic prioritization sprinkles.)
- bongodongobob 2y ago
  Maybe the prompt engineering should have caught on more. I'm convinced that the large swaths of people commenting here and elsewhere "I don't get AI, it's just a parrot and it's always wrong and hallucinates, it's not useful" just don't understand that the prompt matters and the idea isn't to one shot everything. It writes good code for me every day, so I can only assume they're asking "Write me an OS from scratch" and then throwing their hands up when it obviously fails.
  - lolinder 2y ago
    I think that calling it "prompt engineering" is what made it fail to catch on. We didn't call it "Google engineering" back in the day when you could actually craft a Google search to turn up useful results, we called it "Google-fu" [0]. "Google-fu" sounds like a fun skill to learn and acquire, where "prompt engineering" sounds either like something well out of reach or like pretentious nonsense depending on the audience. [0] https://blog.codinghorror.com/google-fu/ https://blog.codinghorror.com/google-fu/
    - fzzzy 2y ago
      Prompt-fu sounds cool
      - dvfjsdhgfv 2y ago
ijidak 2y ago
My favorite was when everyone was looking for prompt engineers. I was trying to understand what prompt engineering was, because I thought there is no way this is a discipline for how to ask ChatGPT questions... And then I realized it was... Sure, I get that there is much to learn regarding formulating effective prompts, but a new career path?
- fuzztester 2y ago
  hype is the deeply engrained norm in our industry, bro. just sit it out. as that famous saying says, "this too shall pass.". until the next one, of course. ;) for example, in rough order, some past hype trends: 3GLs, structured programming, initial AI (then AI winter), expert systems, CASE tools, 4GLs, OOP/OOAD, UML and round trip engineering, design patterns, dot com boom (and bust), agile, functional programming, Web 2.0, SaaS, crypto, Web 3.0, big data, data science, ML/AI. most of them had or have some actual benefits, but nothing like the hype parrotted, by those with and without vested interests. been there, seen them, from the third or fourth one onwards.
  - fuzztester 2y ago
    also, see this cperciva comment, and Google who he is before replying: https://news.ycombinator.com/item?id=40957064 https://news.ycombinator.com/item?id=40957064 somewhat corroborates what I said above.
  - fuzztester 2y ago
    just had a small insight and did some quick mental arithmetic. hold on to your seat: i counted, it's about 20 hype trends that i listed above (and don't forget that I may have missed some). it is roughly 6 decades since the computer industry started, taking a start year of 1960. so, 20 / 6 gives us an average rate of over 3 hype trends per decade !!! about one every 3.3 years. I myself would have thought it would be less often. even if you make it 7 decades, 20 / 7 is nearly 3, so is still in the same ball park. phew.
    - defrost 2y ago
sciencesama 2y ago
Security for a long time has been log parsing and auditing for compliance (pdf reports) and some tooled posture report !! It took a while security team to do this tedious task now an ai with 1/10 price can do this !! And can make big companies rich !! Do it once and give it to all !!

sylens 2y ago

While that was indeed billed as the theme of reInforce, there were plenty of sessions and workshops that did not involve GenAI at all. There was a great chalk talk about the underpinnings of how the AWS IAM service works across services and regions, for example.

Aeolun 2y ago
I’d be interested in knowing why it takes +/- 10 seconds after I create/update a role before I can actually use it.
- blitzar 2y ago
  If you have navigated far enough to create/update a role you are already aware of the bloat and mess that ties all their services together.
- sylens 2y ago
  IAM is eventually consistent. And they do a lot of derivations of hashing off an original signature and distributing individual, bespoke versions to services in different regions to limit the blast radius of a compromised credential. If you go to an AWS event in the future, the name of the chalk talk was "The Life of an IAM Policy"

throwaway8481 2y ago

> Model outputs are untrusted input. I think the problem is they're trying to introduce nuance and a narrow path to allow this. They want an acceptable level of risk to using untrusted model output for the efficiency/productivity gains it will bring, notwithstanding hallucinations. Generative AI would not have flown in the security theater of Yesteryear, but CTOs see productivity multipliers.

usea 2y ago
> CTOs see productivity multipliers The CTOs are hallucinating as much as the LLMs are.
- marcosdumay 2y ago
  The GP didn't state the multiplier's value. Those things absolutely are productivity multipliers...
lolinder 2y ago
Right, but that's not a new problem either. We want to allow people to send emails with some acceptably-low level of risk that spam will get through. We want an acceptably-low risk that our image upload feature won't be hosting CSAM. And we want it while still getting the benefits of allowing our real customers to pay us for the services we offer. Businesses have been figuring out the balance of risk:reward for as long as infosec has been a concept.

q7xvh97o2pDhNrh 2y ago

As a person replying to your comment in the era of generative AI, I'm inclined to agree the hype is a bit much, even considering how impressive the technology can (sometimes) be. Another big area of hype is "prompt engineering." That one seems to have calmed down slightly, but for a while, there were large swaths of the Internet who were amazed that the set intersection of "talk like a decent human being" and "be precise in your communication" could generally lead to good results. In many ways, "AI" right now is magic marketing sprinkles that you can put on anything to make it more delicious. (Or, if you're inside a big company, it's magic prioritization sprinkles.)

bongodongobob 2y ago
Maybe the prompt engineering should have caught on more. I'm convinced that the large swaths of people commenting here and elsewhere "I don't get AI, it's just a parrot and it's always wrong and hallucinates, it's not useful" just don't understand that the prompt matters and the idea isn't to one shot everything. It writes good code for me every day, so I can only assume they're asking "Write me an OS from scratch" and then throwing their hands up when it obviously fails.
- lolinder 2y ago
  I think that calling it "prompt engineering" is what made it fail to catch on. We didn't call it "Google engineering" back in the day when you could actually craft a Google search to turn up useful results, we called it "Google-fu" [0]. "Google-fu" sounds like a fun skill to learn and acquire, where "prompt engineering" sounds either like something well out of reach or like pretentious nonsense depending on the audience. [0] https://blog.codinghorror.com/google-fu/ https://blog.codinghorror.com/google-fu/
  - fzzzy 2y ago
    Prompt-fu sounds cool
    - dvfjsdhgfv 2y ago

ijidak 2y ago

My favorite was when everyone was looking for prompt engineers. I was trying to understand what prompt engineering was, because I thought there is no way this is a discipline for how to ask ChatGPT questions... And then I realized it was... Sure, I get that there is much to learn regarding formulating effective prompts, but a new career path?

fuzztester 2y ago
hype is the deeply engrained norm in our industry, bro. just sit it out. as that famous saying says, "this too shall pass.". until the next one, of course. ;) for example, in rough order, some past hype trends: 3GLs, structured programming, initial AI (then AI winter), expert systems, CASE tools, 4GLs, OOP/OOAD, UML and round trip engineering, design patterns, dot com boom (and bust), agile, functional programming, Web 2.0, SaaS, crypto, Web 3.0, big data, data science, ML/AI. most of them had or have some actual benefits, but nothing like the hype parrotted, by those with and without vested interests. been there, seen them, from the third or fourth one onwards.
- fuzztester 2y ago
  also, see this cperciva comment, and Google who he is before replying: https://news.ycombinator.com/item?id=40957064 https://news.ycombinator.com/item?id=40957064 somewhat corroborates what I said above.
- fuzztester 2y ago
  just had a small insight and did some quick mental arithmetic. hold on to your seat: i counted, it's about 20 hype trends that i listed above (and don't forget that I may have missed some). it is roughly 6 decades since the computer industry started, taking a start year of 1960. so, 20 / 6 gives us an average rate of over 3 hype trends per decade !!! about one every 3.3 years. I myself would have thought it would be less often. even if you make it 7 decades, 20 / 7 is nearly 3, so is still in the same ball park. phew.
  - defrost 2y ago

sciencesama 2y ago

Security for a long time has been log parsing and auditing for compliance (pdf reports) and some tooled posture report !! It took a while security team to do this tedious task now an ai with 1/10 price can do this !! And can make big companies rich !! Do it once and give it to all !!