Here’s mine: the world would be a much, much better place if LLMs did not exist. Also, it would be stupid–today–to not use LLMs to find flaws in the Linux kernel. The only other option is to get your machines compromised.
Using LLMs for security auditing? Ok, but people are mad that LLM-assisted code, tons of it, is now getting into the kernel and Linus is no longer slamming the brakes…
The only other option is to use something inconvenient like OpenBSD, constantly audited for three decades, LLMs could find only very few obscure bugs.
Oh buddy… Did you not hear that not only did OpenBSD start using AI for audits but that it actually found a handful of serious issues that decades of human audits have missed?
There is a difference between an AI doing a security review (which they have become quite accomplished) and generating code that gets committed into the codebase.
Again, how does one verify that the code it has generated isn’t some verbatim chunk of copyrighted code that it happened to be trained on, and it turned out to be the best fit? There’s no guarantee that a model will not do this, even if instructed.
Also, content generated by AI models has already been deemed uncopyrightable, and this includes code. So are some larrtsmof the Linux kernel now able to be copied freely without GPL restrictions? How can you license code or executables compiled from said code if you do not hold the copyright on it?
There is a difference between an AI doing a security review (which they have become quite accomplished) and generating code that gets committed into the codebase.
I guess I should’ve quoted the whole part, as my primary point was to show that not only did AI spot niche, obscure bugs… it spotted niche, obscure bugs that HUMANS couldn’t.
Again, how does one verify that the code it has generated isn’t some verbatim chunk of copyrighted code that it happened to be trained on, and it turned out to be the best fit? There’s no guarantee that a model will not do this, even if instructed.
And what if someone has a genius idea and comes up with a piece of code, completely on their own, and it turns out to be the exact same, verbatim, character by character matching as a copyrighted piece of code?
What if AI does this? What if the model wasn’t even trained on that piece of code, but, by sheer coincidence, it puts together the same solution because it’s the most obvious and best option?
Copyright and licensing in code is already a weird topic because mechanical problems often have the same solution. There’s a finite (and in fact, usually very low) number of ways you can run the same algorithm or represent the same data. Say you have to implement a key-value storage system. No requirements on it needing to support millions of entries, historical caching, snapshotting, anything, expectations are simple: a command to add an entry (and update the value assigned to the key, if the key already exists), a command to delete an entry, and a command to get the number of stored items. Wanna bet that if you give this task to 1000 developers of the same language, a large majority will write nearly the same code? Hell, if you don’t consider inconsequential things like variable/field/property/function naming, there’s good chance 90%+ of them will write the same thing. Woukd that be plagiarism though? Would copyright apply?
On the other hand if you were to write and release a book that is verbatim the same as another, famous book, with the only difference being the names of characters and places… Well I guess you can see where I’m going with this.
Also, content generated by AI models has already been deemed uncopyrightable, and this includes code. So are some larrtsmof the Linux kernel now able to be copied freely without GPL restrictions? How can you license code or executables compiled from said code if you do not hold the copyright on it?
You could already copy small enough parts of the Linux kernel without needing to cover yours in GPL. Trivial things for example. Say you have a driver that talks to sone niche hardware in a specific data packet format. Can you copy/recreate that? Or a trivial solution like the aforementioned cache. GPL doesn’t mean you can’t copy a single line of code without your codebase becoming GPL too.
Oh btw that copyright claim is much weaker than you’d think. It didn’t specify the level of human involvement for example. Also, given the base code is GPL and human written, and GPL applies to all derivative works, it still applies.
Ok, but people are mad that LLM-assisted code, tons of it, is now getting into the kernel and Linus is no longer slamming the brakes…
I also think this is a bad idea unless we want less stability in the kernel. I’ve seen Torvalds call people all kinds of names for trying to add things to the kernel that he feels are subpar. He’s legendary for it. So I’d probably trust him more than any human alive to avoid slop.
But I also don’t think he has the power to effectively defend against it. Some badness will get through.
As always, we’ll choose the least-crappy OS to run.
Pretty much. It‘s a really shitty situation and it would be better if the world decided to not use them and sanction them. A bit like nuclear weapons that are also far more effective than alternatives but too destruktive to seriously consider. For now, many developers are doomed to use LLMs for security reasons. Because LLMs are not just a tool. They are an entire production line at the grasp of your hand. Just using complex architecture to obscure risks doesn‘t cut it anymore.
I don‘t think it‘s that wild. You could of course compare it to asbestos instead. Another „tool“ in our arsenal of things that are the best in their field but most countries have decided not to use them over other concerns.
Will you be factoring in the lives that get saved by various AI-assisted medical and other technological advances that are in the pipe as well? Or are you only considering negatives?
You’re being pedantic for the sake of the argument. AI was saving lives before anyone knew what a GPT is, and GPT won’t be saving lives until long after Altman dies
Here’s mine: the world would be a much, much better place if LLMs did not exist. Also, it would be stupid–today–to not use LLMs to find flaws in the Linux kernel. The only other option is to get your machines compromised.
Using LLMs for security auditing? Ok, but people are mad that LLM-assisted code, tons of it, is now getting into the kernel and Linus is no longer slamming the brakes…
The only other option is to use something inconvenient like OpenBSD, constantly audited for three decades, LLMs could find only very few obscure bugs.
Oh buddy… Did you not hear that not only did OpenBSD start using AI for audits but that it actually found a handful of serious issues that decades of human audits have missed?
There is a difference between an AI doing a security review (which they have become quite accomplished) and generating code that gets committed into the codebase.
Again, how does one verify that the code it has generated isn’t some verbatim chunk of copyrighted code that it happened to be trained on, and it turned out to be the best fit? There’s no guarantee that a model will not do this, even if instructed.
Also, content generated by AI models has already been deemed uncopyrightable, and this includes code. So are some larrtsmof the Linux kernel now able to be copied freely without GPL restrictions? How can you license code or executables compiled from said code if you do not hold the copyright on it?
I guess I should’ve quoted the whole part, as my primary point was to show that not only did AI spot niche, obscure bugs… it spotted niche, obscure bugs that HUMANS couldn’t.
And what if someone has a genius idea and comes up with a piece of code, completely on their own, and it turns out to be the exact same, verbatim, character by character matching as a copyrighted piece of code?
What if AI does this? What if the model wasn’t even trained on that piece of code, but, by sheer coincidence, it puts together the same solution because it’s the most obvious and best option?
Copyright and licensing in code is already a weird topic because mechanical problems often have the same solution. There’s a finite (and in fact, usually very low) number of ways you can run the same algorithm or represent the same data. Say you have to implement a key-value storage system. No requirements on it needing to support millions of entries, historical caching, snapshotting, anything, expectations are simple: a command to add an entry (and update the value assigned to the key, if the key already exists), a command to delete an entry, and a command to get the number of stored items. Wanna bet that if you give this task to 1000 developers of the same language, a large majority will write nearly the same code? Hell, if you don’t consider inconsequential things like variable/field/property/function naming, there’s good chance 90%+ of them will write the same thing. Woukd that be plagiarism though? Would copyright apply?
On the other hand if you were to write and release a book that is verbatim the same as another, famous book, with the only difference being the names of characters and places… Well I guess you can see where I’m going with this.
You could already copy small enough parts of the Linux kernel without needing to cover yours in GPL. Trivial things for example. Say you have a driver that talks to sone niche hardware in a specific data packet format. Can you copy/recreate that? Or a trivial solution like the aforementioned cache. GPL doesn’t mean you can’t copy a single line of code without your codebase becoming GPL too.
Oh btw that copyright claim is much weaker than you’d think. It didn’t specify the level of human involvement for example. Also, given the base code is GPL and human written, and GPL applies to all derivative works, it still applies.
The comment you replied to had absolutely zero to say about licensing and rights issues, yet your entire reply is only about that.
You lost?
Not everything needs to be about winning or losing
Pretty sure that was “lost” as in, “needing a map.” Not everything needs to be about winning or losing.
I also think this is a bad idea unless we want less stability in the kernel. I’ve seen Torvalds call people all kinds of names for trying to add things to the kernel that he feels are subpar. He’s legendary for it. So I’d probably trust him more than any human alive to avoid slop.
But I also don’t think he has the power to effectively defend against it. Some badness will get through.
As always, we’ll choose the least-crappy OS to run.
deleted by creator
Pretty much. It‘s a really shitty situation and it would be better if the world decided to not use them and sanction them. A bit like nuclear weapons that are also far more effective than alternatives but too destruktive to seriously consider. For now, many developers are doomed to use LLMs for security reasons. Because LLMs are not just a tool. They are an entire production line at the grasp of your hand. Just using complex architecture to obscure risks doesn‘t cut it anymore.
I’m not a huge fan of AI but comparing them to nukes is wild
I don‘t think it‘s that wild. You could of course compare it to asbestos instead. Another „tool“ in our arsenal of things that are the best in their field but most countries have decided not to use them over other concerns.
Well, I think comparing asbestos to nukes would be wild too. In any case asbestos is a more level headed comparison imo
I like to compare them to meth. Sends velocity through the roof…with just a few minor drawbacks… 😅
The environmental implications of the data centers fuelling the LLMs will undoubtedly end more lives than nuclear weapons ever have
You got a reference for that?
Pretty extreme, but okay.
Will you be factoring in the lives that get saved by various AI-assisted medical and other technological advances that are in the pipe as well? Or are you only considering negatives?
You’re being pedantic for the sake of the argument. AI was saving lives before anyone knew what a GPT is, and GPT won’t be saving lives until long after Altman dies
I mean you know about tactical nukes and uranium ammunition
I mean 5 years ago the world was shit with no llms so no ?
The world was bad, it will be worse thanks to LLM. Both things can (and IMO, are) be true at the same time.
5 years ago things were bad, therefore there’s no way LLMs can be bad. Is that the argument?
LLMs are bad but things would have been bad differently without them anyway.