points by sreekanth850 2 days ago | 0 comments
LLMs are now unfolding decades of technical debt, poorly written code, and security vulnerabilities accumulated in software built by humans.
[–] CivBase 2 days ago
[–] sreekanth850 2 days ago
this is just one case.
[–] bigstrat2003 2 days ago
But it is the case you were leaving the comment on, which is why anyone reading it will assume you meant to apply it to this case.
[–] jdiff 2 days ago
You say that as if there aren't more just over there.
[–] sreekanth850 2 days ago
I was saying this is just one case where we can say the reason about copilot, there are dozens of reported vulnerabilities, bugs in kernel, rust. and many more elite products which were authored by so called elite developers.
[–] bigyabai 2 days ago
You willingly let "perfect" be the enemy of "good" in this case. It's absolutely possible to build software runtimes that obviate this type of nonsense. It's not grandstanding by elite developers, most of these choices are common-sense mitigations.
[–] sreekanth850 2 days ago
--Another vulnerability in ssh accounts that should never take a password at all (root, your key-only deploy user, ldap users, the default user on alpine's aws and azure images) take any password longer than 256 characters.
I guess these also belongs to your common sense mitigation category but this has been there since 2016.
-- struct's lifetime requirements can be bypassed via covariant field assignment,
11 year old rust compiler bug. how about this?
[–] imp0cat 2 days ago
Exactly. So the original quote should be updated to read:
> LLMs are now unfolding technical debt, poorly written code, and security vulnerabilities accumulated in software that they have created themselves.
[–] sreekanth850 2 days ago
i dont think kernel bugs , ssh bug, 12 year old rust compiler bug all was written by LLMs.
[–] MarchApril 2 days ago
Firearms are now exposing the inherent vulnerability of human flesh against small projectiles flying faster than the speed of sound. Before that we were just fist fighting eachother and we were trained for that. But no mo! Get your dragon's breath today at $199.99!
[–] sreekanth850 2 days ago
I understand your frustration.
[–] mock-possum 2 days ago
From the moment I understood the vulnerability of my human flesh it disgusted me.
[–] pmkary 2 days ago
Why on Earth do you have to give Paint, internet? How is that a technical debt? Making all nice little fully offline apps Internet Nightmare Slop is wag beyond debt.
[–] infinite_spin 2 days ago
It might not be paint with internet, it might be something like a packet over your network asking a computer to open an input/file, and the computer responds by opening that malicious input with paint
[–] sreekanth850 1 day ago
Yes, its related to a image file, where parsing a specially crafted image file causes the program to read outside its designated memory buffer
[–] ranger_danger 2 days ago
And yet suggesting C++ should focus more on memory safety just gets downvoted instead... I swear sometimes it's like being a crab in a barrel.
My take is that the addition of CoPilot to MS Paint is probably how this CVE got introduced.