Hacker News

points by glennfiedler 3 days ago | 0 comments

I'm always amused when people have a distillation of all human knowledge at their fingertips and all they can do is complain.

Yes, we're going to see the bugs exposed by AI and it's going to suck a bit for a few months.

But when this is all over, software will be more secure than it has ever been before.

[–] hexapus 3 days ago

That'd be true if companies were approaching AI responsibly, and not attempting to YOLO vibecode entire platforms. But as core utilities go, I do see the value in hardening against vulnerabilities by using AI. And when sanity returns and companies start approaching its use rationally when it comes to development...develop best practices around how to build with AI, and ensure code remains reviewable and understandable by humans, limit scope creep and sprawl, and slow down a bit to think through these issues - yes, it could yield some very positive outcomes in the long run.

[–] joe_the_user 3 days ago

The problem is there is no way that you won't have someone, somewhere videcoding platforms, accumulating technical debt and benefiting short-term thereby. And once such approaches work and get semi-reliable, they'll spill over onto other areas, gradually becoming universal.

I mean, LLMs themselves come from exactly this phenomena. They are a product of finding a technology that scales and going with that no matter what. And parts of this will hit a wall and have to retrench, current players may implode but the genie isn't going back into its bottle so disruption within disruption will continue.

[–] Bassiestroep 3 days ago

I also feel like this is true. We are going to see a massive explosion of CVE's being found and patched, then it will gradually slow down. But there is also the possibility, the code being written now is written so fast, and by people that might not even understand it in the first place, that the pace of adding new vulnerabilities might explode at the same time. I'm not sure which is faster.

[–] zshrdlu 3 days ago

Well it's more like generated not written.

[–] softfalcon 3 days ago

> But when this is all over, software will be more secure than it has ever been before.

Maybe? I’m not 100% on this one.

Not trying to be a downer, but it could become a mixed bag is all I’m saying.

[–] godshatter 1 day ago

I wonder how many vulnerabilities exist in each project, and how long it will take for all of them to be patched (and any new vulnerabilities from the patches are also patched) until we get a bug-free system everywhere.

There's enough new code being written to feed the AI vulnerability finding machine that I don't see a way out of this mess anytime soon.

[–] PeterisP 3 days ago

I feel that while it's plausible that AI progress in making existing software less shitty will outweigh the increasing capabilities to exploit software and so make the existing software more secure; however, I feel that the trend is that the rate of making existing software less shitty is far, far outpaced by people releasing vast quantities of new shitty software.

[–] rwz 3 days ago

> But when this is all over, software will be more secure than it has ever been before

I don't see sufficient evidence that this is not going to be a perpetual race between people/AIs fixing existing software and more advanced and powerful next generation AIs finding new vulnerabilities and exploits.

[–] NooneAtAll5 3 days ago

sooner or later we'll converge to proof-backed code

[–] srveale 3 days ago

It's only a race if the defender can afford the tokens

[–] asdff 3 days ago

Ai only reliably returns whats in the training set with sufficient power. As you can imagine, this is a supremely limited scope of all of human knowledge and depends on data that were both recorded and made available for training.

[–] chrisjj 3 days ago

> all human knowledge

I know how to ride a bike.

Does your chatbot?

[–] npteljes 3 days ago

While no chatbot can ride a bike currently, that doesn't invalidate OP's point. "Distillation of all human knowledge" here is not a scientific claim, it's a colloquial exaggeration to emphasize its actual capabilities vs the complaint people have against it.

[–] chrisjj 3 days ago

> While no chatbot can ride a bike currently

Let us skip the strawman.

The point is knowledge not ability.

> not a scientific claim

Ain't that the truth.

> it's a colloquial exaggeration

Agreed.

[–] talon8635 3 days ago

Yes, but it cannot ride one.

[–] chrisjj 3 days ago

Odd. Claude says it does not.