i fucking hate these people so much man

im getting fired if i dont use this bullshit, already one person was "anonymously" shat on during a meeting for not doing so. fortunately not me

you are viewing a single comment's thread
view the rest of the comments
[–] 6 points 1 day ago* (last edited 1 day ago)

The only application of LLMs I've seen in my field where it is seemingly doing a better job than existing tools is fuzzing existing programs for security issues. This doesn't introduce slop to the code, however it does introduce slop to the review process because there are tons of false positives that we have to manually rule out, but it can more comprehensively cover common vuln paths than traditional fuzzers which can expose issues so we can patch them early. HOWEVER I dont think the improvement in coverage justifies that it is vastly more expensive, and incredibly wasteful environmentally of course. I think the solution is to make real fuzzers more dynamic to match these capabilities rather than lean into the LLMs. Also, I am of the opinion that the amount of effort people are putting into using LLMs for this and reviewing the findings could have been used to do a similarly thorough job the traditional way, but it's energy that wasn't being directed there because of a lack of hype towards it.

So in short, doesn't really make sense anywhere lol

  • source
  • parent