I hate ai as much as the next person, but I’d have a different mandate. I would require all code to be fully reviewed and understood by a human. Let’s call it quality control.
Agreed. It’s not sensible or practical to ban AI, and Linus is right. Why is Linus right? Take a look at the number of Linux CVEs being patched over time. In 2022-23, that was about 300 per year. Last year it was 5530. This is almost entirely as a result of AI scanning tools, including Copy Fail priv escalation that was there for 8 years. The security apocalypse is just about arrived, and the most recent round of cyber models coming out do this way better than before. The Hugging Face incident story was truly unbelievable if you read / watch the details, a historic event. Everything is about to get hacked. So it’ll be all about maintainers being reactive to this new reality and burden for some time to come
The Hugging Face incident story was truly unbelievable if you read / watch the details
It didn’t really seem that way? Leaving containment seemed more like a configuration oversight than a skill on the part of the model. Accessing HF involved an 0-day but the commentary I saw didn’t indicate that it was a next generation hack.
Given that AI exists, and can scan or otherwise find vulnerabilities, maintainers must do so because threat actors inevitably will.
It remains to be seen whether the whole race will improve security generally? I imagine not?
Much more probably: they developed a cyberweapon and tested it in the wild. The victim caught them so they invented a cyberpunk history to increase the interest of potential buyers for that weapon.
If you placed me in the position of those models in that sandbox, I wouldn’t have been able to escape the sandbox to save my life. Let alone hack hugging face.
Yes and no. The ability to “understand” code that makes AI capable of finding security bugs, is correlated with AI’s ability to write code. AI is just really good at code related tasks, and categorically banning all AI usage is shooting yourself in the foot.
I hate ai as much as the next person, but I’d have a different mandate. I would require all code to be fully reviewed and understood by a human. Let’s call it quality control.
How would you enforce that?
How do you enforce code is not AI generated? I don’t see how one is more easily enforceable than the other.
Well it depends who you are. An employer could enforce it.
But it was serious question. If you’re going to have a rule then there should be a way to enforce it, otherwise it means nothing.
And also have high readability standards, ideally higher than before LLMs.
Read the article, that is one of the two options they are voting on.
Agreed. It’s not sensible or practical to ban AI, and Linus is right. Why is Linus right? Take a look at the number of Linux CVEs being patched over time. In 2022-23, that was about 300 per year. Last year it was 5530. This is almost entirely as a result of AI scanning tools, including Copy Fail priv escalation that was there for 8 years. The security apocalypse is just about arrived, and the most recent round of cyber models coming out do this way better than before. The Hugging Face incident story was truly unbelievable if you read / watch the details, a historic event. Everything is about to get hacked. So it’ll be all about maintainers being reactive to this new reality and burden for some time to come
It didn’t really seem that way? Leaving containment seemed more like a configuration oversight than a skill on the part of the model. Accessing HF involved an 0-day but the commentary I saw didn’t indicate that it was a next generation hack.
Given that AI exists, and can scan or otherwise find vulnerabilities, maintainers must do so because threat actors inevitably will.
It remains to be seen whether the whole race will improve security generally? I imagine not?
Nah, it was like:
Open weights models will catch up soon enough, and then it’ll be totally fucking wild
You are believing a notorious bunch of liars.
Much more probably: they developed a cyberweapon and tested it in the wild. The victim caught them so they invented a cyberpunk history to increase the interest of potential buyers for that weapon.
I basically just don’t believe you, and can’t be bothered looking.
You’re anthropomorphizing a statistical model. It’s laughable to suggest they “elected a CEO and power structure”.
But the ai could generate text to that affect, it it was statistically likely.
If you placed me in the position of those models in that sandbox, I wouldn’t have been able to escape the sandbox to save my life. Let alone hack hugging face.
Have you read all the code on the planet?
If not, don’t feel bad about it.
There is a difference between using AI scanning tools and generating code for production
Yes and no. The ability to “understand” code that makes AI capable of finding security bugs, is correlated with AI’s ability to write code. AI is just really good at code related tasks, and categorically banning all AI usage is shooting yourself in the foot.