• rowinxavier@lemmy.world
    link
    fedilink
    English
    arrow-up
    3
    arrow-down
    1
    ·
    16 hours ago

    I think this is the distinction of uses I canost get behind. If you find an attack using any tool, whether that be a CVE, a script kiddy, or an LLM, then you can go on to understand how the vulnerability works and patch it. This leaves the understanding part to the programmer, but not the arduous task of trying to find problems. If you use vibecoding to do the actual fixing you never have the understanding of how the code works and therefore what the changes will actually do.

    LLMs can be useful in a lot of ways, but they should never replace thinking and understanding. Just like you do need to memorise some things but not others, there are cognitive tasks you don’t have to do all the time but others you really have to in order to actually be a good programmer. If you outsource thinking you stop doing it and get weaker at it. If you outsource meaningless tasks or use systems to reduce the need for them that is actually useful for freeing up your mind for tasks which cannot be automated.

    So in my view using these tools to find bugs in code can be useful. Knowing that if a bug is found it may not be disclosed to you by the tool because the provider of the tool wants to keep some bugs hidden is something people should consider, I mean that is exactly what the NSA has been going for decades with zero day exploits in various operating systems and platforms, why would they not do so now?