this post was submitted on 17 Sep 2026
161 points (94.5% liked)
Technology
88745 readers
2375 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 3 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
I will say, we've been deployed on Ubuntu 18.04 for 8 years now and tracking the CVEs against our configuration watching for potential exploits that could really matter to our systems, and it wasn't until the past few months that those exploits actually started to get meaningful ability to compromise us.
What that says to me is: the LLMs are finding meaningful vulnerabilities that "the best minds" missed for years and years. And they're also generating functional patches for these vulnerabilities far faster and more easily than the patches came out in the past.
I'm not loving the changed landscape, but I have to acknowledge that LLMs are making a significant difference.
Yeah I got to this in the blog and stopped:
" I don't think that we're any safer than before. That's because finding vulnerabilities has never been the bottleneck in information security. The bottleneck isn't even verifying a vulnerability report and validating its severity, as time consuming as that is. The bottleneck isn't determining the fix, creating the patch, or publishing a new release. The bottleneck is still, as ever before, getting the goddamn packages updated. "
Dude thinks security through obscurity is valid and thinks running
sudo apt update && sudo apt upgrade -y
Is the really hard part.
That's not the hard part to do, it's the hard part to get other people to do, particularly those who can't just run the package manager or let in-doze play patch roulette every Tuesday.
Security through obscurity isn't going to cut it in the future, much less than it already didn't in the past.
Security through air-gapping is still pretty good.
It isn't even the LLM. Its the data scraped from the internet wholesale and users contributing to corps by use. Not to mention the staggering amount of engineers turning that raw data into better output. The LLM just spits those billions of dollars of effort back out. I only pick this nit because too many people see local LLM and think that's where the magic happens. It is just a flash in the pan. you need an internal combustion engine, transmission, wheels, chassis, cabin, and probably some seats if you want to get anywhere with it. That said, it is the concentration of effort. Individuals can't really rival that. I wonder if there are any initiatives in the open source community with this mindset...