5 ms·

That supposes that LLMs can write secure software. Also, if we assume that finding bugs is easier that not creating them (reasonable I would say), the supply of

That supposes that LLMs can write secure software. Also, if we assume that finding bugs is easier that not creating them (reasonable I would say), the supply of bugs will never be exhausted.

socalgal2 3mo ago
It does not suppose that LLMs can write secure software
jeremyjh 3mo ago
How can it be easier to find them than to not create them? Whatever you do to find them, you could do before you release.
- cuu508 3mo ago
  You can accidentally create a bug that you yourself cannot find.
- sureglymop 3mo ago
  Because the behaviour of software changes over the time of development and that's how many bugs happen in the first place. Especially if you use AI, let's say you have it implement a feature and then change your mind. In my experience AI makes as many if not more bugs than a human.
zulban 3mo ago
> That supposes that LLMs can write secure software. I think we're at the point that the best LLMs can indeed write software that's far more secure than your average programmer. Partly because the average is so terrible.
xboxnolifes 3mo ago
What's the difference between finding bugs and not making? Just run the bug finding in during CICD.
- klabb3 3mo ago
  It’s not necessarily symmetrical, and in fact would be very surprising if it was. It’s a probabilistic algorithm on both sides, so the energy use to find any working program vs all bugs in a working program are fundamentally different search spaces. Not to mention the false positive rate and the human verification effort. Then even the idea of incremental security checks is potentially flawed since many security issues are non-local (ie not localized to a single module).
NichoPaolucci 3mo ago
I think I’m on this side. I find it exceedingly unlikely that we just start producing “perfect” software all the time for everything, and at the same time start generating an order of magnitude MORE software.

That supposes that LLMs can write secure software. Also, if we assume that finding bugs is easier that not creating them (reasonable I would say), the supply of bugs will never be exhausted.

socalgal2 3mo ago

It does not suppose that LLMs can write secure software

jeremyjh 3mo ago

How can it be easier to find them than to not create them? Whatever you do to find them, you could do before you release.

cuu508 3mo ago
You can accidentally create a bug that you yourself cannot find.
sureglymop 3mo ago
Because the behaviour of software changes over the time of development and that's how many bugs happen in the first place. Especially if you use AI, let's say you have it implement a feature and then change your mind. In my experience AI makes as many if not more bugs than a human.

zulban 3mo ago

> That supposes that LLMs can write secure software. I think we're at the point that the best LLMs can indeed write software that's far more secure than your average programmer. Partly because the average is so terrible.

xboxnolifes 3mo ago

What's the difference between finding bugs and not making? Just run the bug finding in during CICD.

klabb3 3mo ago
It’s not necessarily symmetrical, and in fact would be very surprising if it was. It’s a probabilistic algorithm on both sides, so the energy use to find any working program vs all bugs in a working program are fundamentally different search spaces. Not to mention the false positive rate and the human verification effort. Then even the idea of incremental security checks is potentially flawed since many security issues are non-local (ie not localized to a single module).

NichoPaolucci 3mo ago

I think I’m on this side. I find it exceedingly unlikely that we just start producing “perfect” software all the time for everything, and at the same time start generating an order of magnitude MORE software.