3 ms·
This is signed off primarily by RedHat, and they tend to be pretty serious/corporate. I suspect their concern is not so much whether users have own the copyrig
by ants_everywhere 1y ago
This is signed off primarily by RedHat, and they tend to be pretty serious/corporate.
I suspect their concern is not so much whether users have own the copyright to AI output but rather the risk that AI will spit out code from its training set that belongs to another project.
Most hypervisors are closed source and some are developed by litigious companies.
- duskwuff 1y agoI'd also worry that a language model is much more likely to introduce subtle logical errors, potentially ones which violate the hypervisor's security boundaries - and a user relying heavily on that model to write code for them will be much less prepared to detect those errors.
- ants_everywhere 1y agoGenerally speaking AI will make it easier to write more secure code. Tooling and automation help a lot with security and AI makes it easier to write good tooling. I would wager good money that in a few years the most security-focused companies will be relying heavily on AI somewhere in their software supply chain. So I don't think this policy is about security posture. No doubt human experts are reviewing the security-relevant patches anyway.
- tho23i4234324 1y agoI'd doubt this very much - LLMs hallucinate API calls and commit all sorts of subtle errors that you need to catch (esp. if you're on proprietary problems which it's not trained on). It's a good replacement for Google, but probably nothing close to what it's being hyped out to be by the capital allocators.
- OtherShrezzing 1y agoWhile LLMs are really good at generating content, one of their key weaknesses is their (relative) inability to detect _missing_ content. I'd argue that the most impactful software security bugs in the last couple of decades (Heartbleed etc) have been errors of omission, rather than errors of inclusion. This means LLMs are: 1) producing lots more code to be audited 2) poor at auditing that code for the most impactful class of bugs That feels like a dangerous combination.
- guappa 1y ago> Generally speaking AI will make it easier to write more secure code In my personal experience, not at all.
- latexr 1y ago> Generally speaking AI will make it easier to write more secure code. https://www.backslash.security/press-releases/backslash-security-reveals-in-new-research-that-gpt-4-1-other-popular-llms-generate-insecure-code-unless-explicitly-prompted https://www.backslash.security/press-releases/backslash-secu...
- duskwuff 1y agoHeh. Yup. And I'd be especially concerned about code written for QEMU, as it's an unusual type of application. There's lots of example code and other writings about security in web applications which a language model is likely to have encountered in its training; hypervisors are much less frequently discussed.
- blibble 1y ago> but rather the risk that AI will spit out code from its training set that belongs to another project. this is everything that it spits out
- ants_everywhere 1y agoThis is an uninformed take
- Groxx 1y agoIt is a legally untested take
- otabdeveloper4 1y agoNo, this is an uninformed take.
- golergka 1y agoWhen model trained on trillions of lines of code knows that inside of a `try` block, tokens `logger` and `.` have a high probability of being followed by `error` token, but almost zero probability of being followed by `find` token, which project does this belong to?
- make3 1y agoEven with an interpretation of LLMs where they only learn through some debatable level of generalization in "pattern matching", they do show some fairly strong ability to contextualize and adapt their outputs to the situation through more than copy-pasting, otherwise they would be completely useless. I get wanting to hate GenAI, for different valid reasons. But this take is incorrect.