3 ms·
It's crazy to me how just a year or so after xz people were willing to say "sure I'll take this giant black box so unauditable that even it's creators don't rea
by bandrami 6mo ago
It's crazy to me how just a year or so after xz people were willing to say "sure I'll take this giant black box so unauditable that even it's creators don't really know what's in it and run all my data through it"
- CoastalCoder 6mo agoI'm guessing it ultimately comes down to the legal / financial / career incentives. My impression is that the market currently rewards visible software functionality with little concern for invisible risk. If we flipped the script, and investors were personally, criminally, and civilly liable for computer breaches, I imagine this problem would disappear almost overnight.
- bandrami 6mo agoI'm at a defense contractor so the whole scene is alien to me. I don't really even get the desire to produce code more quickly since for us client verification and approval is always the slow part. Producing software more quickly would just make that problem worse.
- CoastalCoder 6mo agoI'm curious if LLMs would be useful for code understanding and for bug hunting in an environment like that. Are there any good models for those tasks that can work in an air-gapped enclave?
- bandrami 6mo agoWe do have a phi4 installation in the compartment though it's separately compartmented from the rest of the network. It seems pretty good at doing call graphs. It's slower than ctags but can pull more context with it.