6 ms·

I wonder how long software projects will even be able to ban LLM use in an age where exploits are found by LLMs. Like, if you have two forks of Debian and one u

I wonder how long software projects will even be able to ban LLM use in an age where exploits are found by LLMs. Like, if you have two forks of Debian and one uses LLMs to fix exploitable bugs and the other one doesn't, the level of security they can offer will be worlds apart. And noone in their right mind would want to use the less secure one. Similar to how noone would want to drive a car that was 100% hand built by humans when we know that machines do a much better job at precision tasks. LLMs are just another tool in the end.

goodmythical 3mo ago
There are a few of these "maintainer said no AI pulls, so we forked it" in the wild already and I am really interested to see how it all pans out. Like, okay, sure, maintainer says AI bug monitoring is cumbersome. One fork stops reading the AI bug monitoring, the other leans in. Isn't the latter more likely to find/fix critical/performance/security issues? >Similar to how noone would want to drive a car that was 100% hand built by humans Though, of course, this highlights that the market will fragment itself given that there are in fact many humans who will outright refuse machine driven cars despite mounting evidence that they are vastly safer and more efficient in a growing number of situations. We'll likely see both "individual who won't use AI assisted software gets hacked" and "individual who won't get in a robo-taxi kills jay-walker in broad daylight"
- cuu508 3mo ago
  I think the viability of the fork primarily depends on whether it has enough people motivated to maintain it long term. A turtle can win a distracted hare.
  - calvinmorrison 3mo ago
    Or maybe we stop hard forks and just automate rebasing unless there's significant deviation
- sigmoid10 3mo ago
  >given that there are in fact many humans who will outright refuse machine driven cars Are there though? I feel a lot of this hate is concentrated on Tesla and most of that is probably just a projection of hate on Elon. These may be the most vocal people online, but I doubt they even drive that much. Everyone who's had to drive a lot for work knows that any kind of assist on the road is extremely valuable.
- mrtx01 3mo ago
  "maintainer said no AI pulls, so we forked it" They should call it: debAIn
- setopt 3mo ago
  > There are a few of these "maintainer said no AI pulls, so we forked it" in the wild already and I am really interested to see how it all pans out. There are also forks that go in the other direction, i.e. forking to avoid AI contributions upstream: https://drewdevault.com/blog/Forking-vim/ https://drewdevault.com/blog/Forking-vim/ And promises to do so if it becomes necessary: https://human-emacs.org/ https://human-emacs.org/ Will indeed be interesting to see how it all pans out.
  - DaSHacka 3mo ago
    It's already been quite interesting to witness the birth of the 'Digital Amish' throughout the past few years.
AlexeyBrin 3mo ago
> I wonder how long software projects will even be able to ban LLM use in an age where exploits are found by LLMs. You can use an LLM to scan your human written code for exploits and patch the relevant ones yourself without any LLM code generation. An LLM is a tool, you can chose how you use it.
- throw101010 3mo ago
  The proposal A doesn't limit it to "use" only: > with the use or assistance Don't ask me how they would know you've used a LLM to "assist" you to find the exploit... I don't even know how they would definitely know if you used a LLM for the code to fix it either.
  - pixl97 3mo ago
    [flagged]
- __bjoernd 3mo ago
  That's quite naive. We're looking at 50 years of legacy software running Unix/Linux environments. If the attacker with an LLM finds one in minutes it might take you hours to even comprehend the finding. Guess what the attacker with the LLM will do in that time?
- deleted 3mo ago
  [deleted]
vouaobrasil 3mo ago
> And noone in their right mind would want to use the less secure one. I mean, this is a perfect description of the prisoner's dilemma. Ins't it a shame that we keep playing that game? There's something seriously wrong if we just keep creating these new arms race scenarios. It's sickening.
- DaSHacka 3mo ago
  > There's something seriously wrong if we just keep creating these new arms race scenarios. It's sickening. You mean technology?
trollbridge 3mo ago
All the proposals allowed LLMs in upstream packages.

goodmythical 3mo ago

There are a few of these "maintainer said no AI pulls, so we forked it" in the wild already and I am really interested to see how it all pans out. Like, okay, sure, maintainer says AI bug monitoring is cumbersome. One fork stops reading the AI bug monitoring, the other leans in. Isn't the latter more likely to find/fix critical/performance/security issues? >Similar to how noone would want to drive a car that was 100% hand built by humans Though, of course, this highlights that the market will fragment itself given that there are in fact many humans who will outright refuse machine driven cars despite mounting evidence that they are vastly safer and more efficient in a growing number of situations. We'll likely see both "individual who won't use AI assisted software gets hacked" and "individual who won't get in a robo-taxi kills jay-walker in broad daylight"

cuu508 3mo ago
I think the viability of the fork primarily depends on whether it has enough people motivated to maintain it long term. A turtle can win a distracted hare.
- calvinmorrison 3mo ago
  Or maybe we stop hard forks and just automate rebasing unless there's significant deviation
sigmoid10 3mo ago
>given that there are in fact many humans who will outright refuse machine driven cars Are there though? I feel a lot of this hate is concentrated on Tesla and most of that is probably just a projection of hate on Elon. These may be the most vocal people online, but I doubt they even drive that much. Everyone who's had to drive a lot for work knows that any kind of assist on the road is extremely valuable.
mrtx01 3mo ago
"maintainer said no AI pulls, so we forked it" They should call it: debAIn
setopt 3mo ago
> There are a few of these "maintainer said no AI pulls, so we forked it" in the wild already and I am really interested to see how it all pans out. There are also forks that go in the other direction, i.e. forking to avoid AI contributions upstream: https://drewdevault.com/blog/Forking-vim/ https://drewdevault.com/blog/Forking-vim/ And promises to do so if it becomes necessary: https://human-emacs.org/ https://human-emacs.org/ Will indeed be interesting to see how it all pans out.
- DaSHacka 3mo ago
  It's already been quite interesting to witness the birth of the 'Digital Amish' throughout the past few years.

AlexeyBrin 3mo ago

> I wonder how long software projects will even be able to ban LLM use in an age where exploits are found by LLMs. You can use an LLM to scan your human written code for exploits and patch the relevant ones yourself without any LLM code generation. An LLM is a tool, you can chose how you use it.

throw101010 3mo ago
The proposal A doesn't limit it to "use" only: > with the use or assistance Don't ask me how they would know you've used a LLM to "assist" you to find the exploit... I don't even know how they would definitely know if you used a LLM for the code to fix it either.
- pixl97 3mo ago
  [flagged]
__bjoernd 3mo ago
That's quite naive. We're looking at 50 years of legacy software running Unix/Linux environments. If the attacker with an LLM finds one in minutes it might take you hours to even comprehend the finding. Guess what the attacker with the LLM will do in that time?
deleted 3mo ago
[deleted]

vouaobrasil 3mo ago

> And noone in their right mind would want to use the less secure one. I mean, this is a perfect description of the prisoner's dilemma. Ins't it a shame that we keep playing that game? There's something seriously wrong if we just keep creating these new arms race scenarios. It's sickening.

DaSHacka 3mo ago
> There's something seriously wrong if we just keep creating these new arms race scenarios. It's sickening. You mean technology?

trollbridge 3mo ago

All the proposals allowed LLMs in upstream packages.