Microsoft being slow to fix bugs isn’t news.
remember when their servers were still vulnerable 20 years later… to a virus written in the 1990s/2000s all because they never updated their own systems?
This whole software bug spiel is to convince everyone that it is unsafe to code without using an LLM. Effectively forcing companies to use LLMs.
It it is unsafe to code, full stop.
The things we’re expecting our code to handle, with the lack of formal verification testing we’re expecting our code to ship with, there’s no such thing as safe. It took 50 years to “build the stack” to where we’re at, and we did it fast and cheap. There’s so many bugs hiding in the lasagna it’s amazing it doesn’t eat itself.
If you re-build your system from first principles, open source silicon with peer review and constant scrutiny, then the BIOS, then the OS, then the application compilers, and the libraries, all open AND reviewed by multiple concerned parties with formal demonstration of correctness all the way up - the entrenched bug filled lasagna stack owners will smother you, they can’t withstand that kind of competition on an open playing field, your project will die of financial starvation, regulation, buyouts and treachery.
All the shortcut technical debt is coming due, especially now that there’s a tool able to undertake mass analysis with fairly general rules.
It’s getting bad out there, and it’s not visible on the surface but a tsunami of bug reports and patches has been sweeping the internet and drowning anything unable to swim.
For anything that sinks underwater, metaphorically, they’re getting grabbed by automated sharks that are now actively on the attack. If you’re not rapidly fixing everything and monitoring everything closely you’re probably being eaten alive without knowing.
My approach: I don’t expose anything (that can’t handle it) to the internet. So so many things are “out there” that don’t need to be, shouldn’t be…
Bragging about how product is at doing something is the easiest way to advertise product. No conspiracy theories needed.
They want you to use their LLM to screen your code for bugs. When you do that, you see how surprisingly well it works now and that leads to you wanting to also use it for generating code. That is when you realize that the 20 bucks starter subscription isn’t enough to actually use it professionally… which means, you upgrade and they get moar money.
Didn’t they use LLMs to code Win11 though?
Aren’t microsoft products half vibe coded at this point anyway? Look at all these fires I put out, says fireman with trunk full of flares and gasoline.
microsoft products half vibe coded
They have a long tradition of not mastering the huge complexity of their own software. Deep security flaws, broken updates, degrading performance etc. are well known companions on any M$ user’s journey.
The vibe coding has mostly added speed to the problem, but not changed the principle itself.
Tiny little example: Azure DevOps supports ssh key access, but only the old - now considered insecure/inadvisable for continued use - RSA ssh keys.
Their priorities for providing that kind of convenient secure access lie elsewhere, in activities that generate more revenue for them.
Certainly seems that way.
There’s a new bug or eminently shitty feature almost every day, or at least it seems that way.
Microsoft Is Struggling to Fix Them Fast Enough.
Microsoft has always been struggling to fix their own bugs fast enough.
In the end, LLM’s will find and fix those same bugs autonomously, people will do the final sign off and software will be simultaneously more secure and less secure as software continues to be tested worldwide wide
While these models can find more bugs, it seems that these bugs do not convert to exploits to a higher rate than before
It seems to me that they’re converting at about the same percentage rate bugs->exploits as before, they’re just getting a lot more press than the old bug reports did.
The Epsteins and their Corps seem to be organizing/manipulating the information sphere to create fear/hype around their top models. It seem to be centrally coordinated and different US tech Corps/players enters and leave. We keep getting either exaggerated/fake or ‘woopsie’ security narratives thrown at us.
The normal purpose is to create fear/anger before a false-flag operation, so we’ll likely see many claims about AI-hacking and a single great hit (the flag) against the Merican people, that will point towards one of the nations that the US/Epsteins have manufactured consent to attack - likely Iran. Old playbook stuff with a new topic…
Wild that so many people are still stuck believing the information from the Epstein class’ owned information sphere.
…on the other hand, I wouldn’t want to BE the Epstein class when ~250M Mericans finally discover they got mind-raped for their entire lives…
Can anybody help me understand the threat of these advanced models once the public and adversaries have access to them? I understand they can find software bugs and vulnerabilities and I get that US tech companies are using it to make their software more secure, but all of these companies have the benefit of their source code being available as an input to the model. Everybody else only has compiled binaries. Do the bad guys use the models to decompile or reverse engineer the code first?
One threat: people using the models are finding bugs and the more rare exploits at a much faster rate than before, perhaps 10x. This means that zero-day exploits are coming into the hands of the kinds of people who use them for bad purposes about 10x faster than they used to. It also means the white hats are creating these CVEs faster and people addressing the CVEs are able to do so faster, with the same manpower… so… if either side slows down, it will shift the balance we currently have toward their opponents.
