3 ms·

>AFAICT, they're AI generated. What is the "tell"? I'm not saying they are or aren't, but... people say this about literally everything now and it's typically

by jfindper 10mo ago

>AFAICT, they're AI generated. What is the "tell"? I'm not saying they are or aren't, but... people say this about literally everything now and it's typically some flimsy reasoning like "they used a bullet point". I don't see anything in particular that makes me think ai over a standard template some junior fills out. >the vulnerability was not found by a Wiz employee at all I've re-read the Wiz article a few times. Maybe I'm just dumb, but where did Wiz claim to have found this vulnerability?

tensegrist 10mo ago
the tl;dr definitely came out of an llm presentation and formatting aside the constant attempts to manufacture legitimacy and signal urgency are a classic tell. everything is "near-100%" reliable, urgent, critical, reproducible, catastrophic. siren emoji
- deleted 10mo ago
  [deleted]
- jfindper 10mo ago
  The authors have said it isn't. I can't believe saying a security vulnerability is "reproducible", "critical", etc. is a "classic tell of ai". I've used "reproducible" and "critical" in my deliverables since well before ai was a thing.
  - deleted 10mo ago
    [deleted]
  - rvnx 10mo ago
    Is it so important ? It's a mix of AI and human-written. It's normal nowadays and perfectly acceptable. + it is maybe 10% AI max, which seems to be for the structure / readability, and there is legit information under.
    - jfindper 10mo ago
      >Because author says it, it doesn't mean that it is true. And because random HNer says it is ai doesn't mean it is ai. >But still, is it so important? Not to me, no. If the information is useful/entertaining/etc., I don't really care. But having to read "it's ai!" comments on literally every article/blog posted for the next 10 years is going to be super annoying. Especially if the reasoning provided is "they used the word critical". At least you pointed to something kind of interesting with the quotation marks (although, certainly not definitive of anything), rather than saying some extremely common word = ai.
      - rvnx 10mo ago
        Absolutely, anyway you'll have critical judgment to make your own opinion. What bothers me about the Wiz post is why they want to hide this HTTP request is actually not helpful in terms of security. On the plus side, they help getting the word out there, so at least something.
    - nostrademons 10mo ago
      So smart quotes is now an LLM tell? You know that a lot of people write in word processors that automatically replace standard quotes with smart quotes (like, say, MS Word), and that these word processors can then export HTML straight into your block or preserve the smart quotes across a copy & paste? Several blog WYSIWYG editors will also directly insert them as well.
      - NitpickLawyer 10mo ago
        I think what they're saying is that having both in a document is the tell.
        nostrademons 10mo ago
        The document doesn't have both in it. It's possible it was edited, but someone else in the thread posted the archive.org original version, and it also doesn't have smart quotes: https://web.archive.org/web/20251203162416/https://www.wiz.io/blog/critical-vulnerability-in-react-cve-2025-55182 https://web.archive.org/web/20251203162416/https://www.wiz.i... (Note also that you can end up with mismatched quotes if you paste in a segment of text from some other source that uses them, which is pretty common in journalism for a fast-changing story.)
mmsc 10mo ago
Hackernews' submission guidelines clearly state: "Please submit the original source. If a post reports on something found on another site, submit the latter." [0] The Wiz post has significantly changed since it was first published (and how it looked when first posted to HN), FYI -- see [1]. When it was published, it was a summary of the React announcement, and was somehow longer than the original and yet provided less useful information than the original. In any case, the "tell" is the syntactic structure (as Chomsky would say) and certain phrases used in the post. [0]: https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html [1]: https://web.archive.org/web/20251203162416/https://www.wiz.io/blog/critical-vulnerability-in-react-cve-2025-55182 https://web.archive.org/web/20251203162416/https://www.wiz.i...
- jfindper 10mo ago
  [flagged]
  - deathanatos 10mo ago
    > It just comes off as condescending. Or, … they're just citing the source for the information, so that, in case you aren't aware as to where to find them, now you are. I think that's a doubly reasonable thing to do, given that your account is new, too.
    - jfindper 10mo ago
      >in case you aren't aware as to where to find them The guidelines are linked at the bottom of every page, and directly underneath the comment box on new accounts. I also, perhaps surprisingly, know how to google "hn guidelines". Or ask chatgpt. Or reply "where's that piece of information from?". >I think that's a doubly reasonable thing to do, given that your account is new, too. People link the guidelines and, like, wikipedia to accounts that are 10 years old with 30,000 karma. It's a weird quirk of HN. If you're talking to someone in real life, or professional emails, or whatever and you provide citations for commonly known things/definitions/etc.... you're being condescending.
karimf 10mo ago
When I saw "WIZ Research - Critical Vulnerabilities in React and Next.js" on the big image banner, I immediately thought that Wiz found the vulnerability.
- jfindper 10mo ago
  When Reuters has an article that says "Reuters Business - Interest rates going up", do you think Reuters made the interest rates go up themselves or that they are reporting on the interest rates?
  - acdha 10mo ago
    Reuters isn’t a bank. Wiz is a security company so they have a greater responsibility to distinguish between their own original work and discoveries made by other researchers.
    - jfindper 10mo ago
      They do that by saying "we discovered this" when they discover it.

tensegrist 10mo ago

the tl;dr definitely came out of an llm presentation and formatting aside the constant attempts to manufacture legitimacy and signal urgency are a classic tell. everything is "near-100%" reliable, urgent, critical, reproducible, catastrophic. siren emoji

deleted 10mo ago
[deleted]
jfindper 10mo ago
The authors have said it isn't. I can't believe saying a security vulnerability is "reproducible", "critical", etc. is a "classic tell of ai". I've used "reproducible" and "critical" in my deliverables since well before ai was a thing.
- deleted 10mo ago
  [deleted]
- rvnx 10mo ago
  Is it so important ? It's a mix of AI and human-written. It's normal nowadays and perfectly acceptable. + it is maybe 10% AI max, which seems to be for the structure / readability, and there is legit information under.
  - jfindper 10mo ago
    >Because author says it, it doesn't mean that it is true. And because random HNer says it is ai doesn't mean it is ai. >But still, is it so important? Not to me, no. If the information is useful/entertaining/etc., I don't really care. But having to read "it's ai!" comments on literally every article/blog posted for the next 10 years is going to be super annoying. Especially if the reasoning provided is "they used the word critical". At least you pointed to something kind of interesting with the quotation marks (although, certainly not definitive of anything), rather than saying some extremely common word = ai.
    - rvnx 10mo ago
      Absolutely, anyway you'll have critical judgment to make your own opinion. What bothers me about the Wiz post is why they want to hide this HTTP request is actually not helpful in terms of security. On the plus side, they help getting the word out there, so at least something.
  - nostrademons 10mo ago
    So smart quotes is now an LLM tell? You know that a lot of people write in word processors that automatically replace standard quotes with smart quotes (like, say, MS Word), and that these word processors can then export HTML straight into your block or preserve the smart quotes across a copy & paste? Several blog WYSIWYG editors will also directly insert them as well.
    - NitpickLawyer 10mo ago
      I think what they're saying is that having both in a document is the tell.
      - nostrademons 10mo ago
        The document doesn't have both in it. It's possible it was edited, but someone else in the thread posted the archive.org original version, and it also doesn't have smart quotes: https://web.archive.org/web/20251203162416/https://www.wiz.io/blog/critical-vulnerability-in-react-cve-2025-55182 https://web.archive.org/web/20251203162416/https://www.wiz.i... (Note also that you can end up with mismatched quotes if you paste in a segment of text from some other source that uses them, which is pretty common in journalism for a fast-changing story.)

mmsc 10mo ago

Hackernews' submission guidelines clearly state: "Please submit the original source. If a post reports on something found on another site, submit the latter." [0] The Wiz post has significantly changed since it was first published (and how it looked when first posted to HN), FYI -- see [1]. When it was published, it was a summary of the React announcement, and was somehow longer than the original and yet provided less useful information than the original. In any case, the "tell" is the syntactic structure (as Chomsky would say) and certain phrases used in the post. [0]: https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html [1]: https://web.archive.org/web/20251203162416/https://www.wiz.io/blog/critical-vulnerability-in-react-cve-2025-55182 https://web.archive.org/web/20251203162416/https://www.wiz.i...

jfindper 10mo ago
[flagged]
- deathanatos 10mo ago
  > It just comes off as condescending. Or, … they're just citing the source for the information, so that, in case you aren't aware as to where to find them, now you are. I think that's a doubly reasonable thing to do, given that your account is new, too.
  - jfindper 10mo ago
    >in case you aren't aware as to where to find them The guidelines are linked at the bottom of every page, and directly underneath the comment box on new accounts. I also, perhaps surprisingly, know how to google "hn guidelines". Or ask chatgpt. Or reply "where's that piece of information from?". >I think that's a doubly reasonable thing to do, given that your account is new, too. People link the guidelines and, like, wikipedia to accounts that are 10 years old with 30,000 karma. It's a weird quirk of HN. If you're talking to someone in real life, or professional emails, or whatever and you provide citations for commonly known things/definitions/etc.... you're being condescending.

karimf 10mo ago

When I saw "WIZ Research - Critical Vulnerabilities in React and Next.js" on the big image banner, I immediately thought that Wiz found the vulnerability.

jfindper 10mo ago
When Reuters has an article that says "Reuters Business - Interest rates going up", do you think Reuters made the interest rates go up themselves or that they are reporting on the interest rates?
- acdha 10mo ago
  Reuters isn’t a bank. Wiz is a security company so they have a greater responsibility to distinguish between their own original work and discoveries made by other researchers.
  - jfindper 10mo ago
    They do that by saying "we discovered this" when they discover it.