benjiro

Frankly, i feel like the people downvoting my comment, are still using older LLMs. When Opus 4.5 entered the picture, there was a noticeable improvement in the way the LLM (for me), interacted with the code base, and the issues that it was able to find.

I ran Opus on some public source code, and lets just say that the picture was less rosy for the whole "human as security".

I understand people have a aversion to LLMs but it irked me the wrong way to see the amount of downvotes on here, because people disagree with a opinion. Its starting the become like reddit. As i stated before, its still your tasks as the person working with the LLM to guide it on security practices. But as somebody now 30 years in the industry, the amount of absolute crap i have seen produced as code (and security issues), makes LLMs frankly security wizards.

Stupid example: I have yet to see LLMs not use placeholders to prevent SQL injection (despite it being trained on a lot of bad code).

The amount of code i have seen, where humans just injected variables directly into the SQL... Yea, what a surprise that SQL database content get stolen like its nothing. When doing a security audit on some public code, one of the items always found by the LLMs, yep ... SQL injectable code everywhere.

A lot of practices are easy, but anybody can overlook something in their own code base. This is where LLMs are so great. You audit with multiple LLMs and you will find points that are weak or where you forgot something, even if you code security wse.

So yea, i have no issue doing discussions but the ridiculous downvotes on what seems to come from people with no clue, is amazing. Going to take a break from here.

> Good riddance to software subscriptions.

Counter argument ... at what point is software still profitable to be sold?

I am running my Office 2007 still, and that thing is now almost 20 years old. That was a one time sale, with no other revenue for Microsoft.

I am not condoning subscriptions but one time selling software only works good, if your a small team with low overhead. The more you sell, the more support becomes a issue. And normal customers do not pay for support.

Making software now has become easier with LLMs but the same problem keeps existing in regards to support. Sure, you can outsource this to LLMs but lets just say that is problematic (being kind).

So unless you plan on making software that is not heavily supported/updated, and keep a low single/team cost...

If you sold a program for a one time fee of ... $39.

What if somebody now sells the same for $29 with LLMs. And the next guy in China does it even cheaper because his overhead is even smaller. Eventually you get into abandonware where software is made to just eat sales from the bigger guy and that is it.

Unless you focus on companies, and they have way less issue paying for subscriptions (if it includes support). You see the issue. People kind of overlook the cost of actually running a self employed job or a company (this is a MAJOR cost the moment you need to hire somebody).

So no, i do not see subscriptions going away because companies will pay for it. And on the normal consumer level, paid support as the solution?

> I think you overestimate the ability of AI to write perfectly secure apps. Humans can't do it, and AI is trained on their work.

Ironically, AI tend to be better at securing code, because unlike the squishy human, it is much more cable of creating tons of tests and figuring out weaknesses.

Let alone the issue when lots of meatbags with different skill levels are working on the same codebases.

I have barely seen any codebase that has been in production for a long time, that did not have glaring issues.

But if you tried to do a code audit, your spending somebody their time (assuming this is a pro), for a long time. Where as a AI with the correct hints on what too look for, can do insane levels of work, testing, etc...

Ironically, when you try to secure test a codebase, and you use multiple different LLMs, you get a very interesting list of issues they can find. Many that are probably in tons of production level software.

But its up to you, as the instructor of that LLM codebase, to actually tell it to do regular security audits of the codebase.

Even something like MS Paint can turn a laptop in to a aircraft.

The issue is actually very simple. In order to gain more performance, manufactures like AMD / Intel for a long time have been in a race for the highest frequency but if you have some knowhow in hardware, you know that higher frequency = more power draw the higher you clock.

So you open your MS Paint, and ... your CPU pushes to 5.2Ghz, and it gets fed 15W on a single core. This creates a heat spike in the sensors, and your fans on laptops, all too often are set to react very fast. And VROOOOEEEEM goes your fan as the CPU Temp sensor hits 80C on a single core, just for a second. But wait, your MS Paint is open, and down goes the fan. And repeat, repeat, repeat ...

Notice how Apple focused on running their CPUs no higher then 4.2Ghz or something... So even if their CPU boosts to 100%, that thermal peak will be maybe 7W.

Now combine that with Apple using a much more tolerant fan / temp sensor setup. They say: 100C is perfectly acceptable. So when your CPU boosts, its not dumping 15W, but only 7W. And because the fan reaction threshold is so high, the fans do not react on any Apple product. Unless you run a single or MT process for a LONG time.

And even then, the fans will only ramp up slowly if your 100C has been going on for a few seconds, and while yes, your CPU will be thermal throttling while the fans spin up. But you do not feel this effect.

That is the real magic of Apple. Yes, their CPUs are masterpieces at how they get so much performance from a lower frequency, but the real kicker is their thermal / fan profile design.

The wife has a old Apple clone laptop from 2018. Thing is for 99.9% of the time silent. No fans, nothing. Because Xiaomi used the same tricks on that laptop, allowing it to boost to the max, without triggering the fan ramping. And when it triggers with a long running process, they use a very low fan rpm until it goes way too high. I had laptops with the same CPU from other brands in the same time periode, and they all had annoying fan profiles. That showed me that a lot of Apple magic is good design around the hardware/software/fan.

But ironically, that magic has been forgotten in later models by Xiaomi ... Tsk!

Manufactures think: Its better if millions of people suffer from more noise, then if we need to have a few thousand laptops that die / get damaged, from too much heat. So ramp up the fans!!!

Your forgetting a little detail ... While you do not need a lot of new stuff, companies need buyers. A lot of companies work on rather thing margins and losing potentially 10 a 20% sales can result in people getting fired, or companies shutting down.

Remember, its not just about "O, X big brands sells less, they can deal with it". But a lot of brands have suppliers who feed that system. Or PC component makers like ... heatsinks, Fans, Cases ... seeing a 20% less sales because people buy less new PCs.

People do not realize how much is linked in the industry. Smaller GPU card makers are literally saying that they may be forced to leave the industry because of drops in sales and the memory prices making the products too expensive.

We can live a long time on old hardware but hardware also limits. Hey, the wife's laptop is from 2019, just before Covid (2020 when a lot of people bought new laptops). The battery is barely holding on. Replacement? None (reputable) ... So in a year that laptop is dead.

How about phones? Same issue ... battery is the build in obsolete maker.

You see the issue. It goes beyond what what most people realize.

Wait when a recession hits when the whole AI bubble bursts and cascades down the already weakened industry. Unlike previous bubbles, the hardware being build is so specialized, that little will hit the normal consumer market. So there will not be a flood of cheap GPUs or memory being dumped on the market.

The problem is that Postgres uses something like 24B overhead per row. That is not a issue with small Tables, but when your having a few billion around, each byte starts to add up fast. Then you a need link tables that explode that number even more, etc ... It really eats a ton of data.

At some point you end up with binary columns and custom encoded values, to save space by reducing row count. Kind of doing away with the benefits of a DB.

Hot take:

If you try to reimplement something in a clean room, its a step by step process, using your own accumulated knowledge as the basis. That knowledge that you hold in your brain, all too often is code that may have copyrights on it, from the companies you worked on.

Is it any different for a LLM?

The fact that the LLM is trained on more data, does not change that when you work for a company, leave it, take that accumulated knowledge to a different company, you are by definition taking that knowledge (that may be copyrighted) and implementing it somewhere else. It only a issue if you copy the code directly, or do the implementation as a 1:1 copy. LLMs do not make 1:1 copies of the original.

At what point is trained on copyrighted data, any different then a human trained on copyrighted data, that get reimplemented in a transformative way. The big difference is that the LLM can hold more data over more fields, vs a human, true... But if we look at specializations, this can come back to the same, no?

The Steam Deck is not a Desktop ... That is like saying that every Android smartphone is a desktop. Sure, you can use it as a desktop but 99.99% of the people are using it as a handheld console.

And nice downvotes... Typical in Linux Desktop topics.

Its not ... The problem is that people do not realize that devices like Steam Deck are also considered Linux desktop devices in those numbers. Chrome tends to also inflate those numbers. Yes, they are Linux desktops but not in the way people are comparing Windows to Linux.

The real number is closer to 2.5% somewhere. What is still growth but nowhere the "year of the Linux desktop".

You tend to see a rather vocal minority that makes you feel like there is some major switch but looking here in the comments, people that switched 8 years, 12 year, 20 years ago are people that are part of the old statistics. There are some new converts but not what you expect to see despite Linux now also being more gaming compatible.

It still has minor issues (beyond anti-cheat), that involve people fixing things, less then the past. But its still not the often click and play, works under every resolution, has no graphic issue etc etc. That is the part people often do not tell you, because a lot of people are more thinkers, so a issue pops up, they fix it and forget about it.

Ironically, MacOS just dominates as the real alternative to Windows in so many aspects. If Apple actually got their act together about gaming, it can trigger a actual strong contender to Windows.

> The problem is that a paid operating system ships with ads in the first place.

You never buy a laptop or pre-build? They are often full of ads that are not Microsoft Windows build in but add-on by the OEM.

Now i agree that Ads in your OS that you paid for, is a big nono. I never understood why Microsoft threats Home and Pro as almost the exact same. Sell Home for cheaper and with Ads, but keep the more expensive Pro clean. Microsoft can do that easily because Windows Server is just that ...

But on the Linux front, i have never been happy with the desktop experience. Often a lot of small details are missing, if the DE itself not outright crashes (KDE, master in Plasma/Widget crashes!). And so many other desktop feel like they have been made in the 90s (probably are) and never gotten updated.

And i do not run W11, still on old and very stable W10. There is no reason to upgrade that i see. Did the same with W7, for years after support ended (and by that time W10 was well polished and less buggy).

The problem is, what does Linux Desktop offer me more, then a few annoyances that i can remove after a fresh install? Often a lot more trouble with the need to use the terminal for things, that are ancient in Windows. That is the problem ... With Apple, you can get insane good M-CPU hardware (yes, mem/storage is insane), for the os/desktop switch.

I noticed that often the people who switch to Linux, are more likely to send more time into finetuning their OS, tinkering around, etc... aka people with more time on their hands. But when you get a bit older, you simply want something that works and gives you no trouble. I can literally upgrade my PC here from a NVidia to AMD or visa versa, and it will simply work with the correct full performance drivers. Its that convenience that is the draw to keep using (even ifs a older) Windows.

For now 25 years every few years, i look at upgrading to Linux permanently, install a few distro's and go back. Linus Desktop does not feel like you gain a massive benefit, if that makes sense? Especially not if your like me, who simply rides out Microsoft their bad OS releases. What is the killer features that you say, hey, Linux Desktop is insane good, it has X, Y, Z that Microsoft does not have, its ... That is the issue in my book. Yes, it has no adds but that is like 5 min work on a fresh install, a 2 min job of copy/past a cleanup script to remove the spyware and other crap and your good for year. So again, killer features?

Often a lot of programs that are less developed or stripped down compared to Windows, let alone way too often 90 style feels programs. You can tell its made by developers often, with no GUI / Graphical developers involved lol

I said it a 1000 times but Linux Desktop suffers from a lot of distro redoing the same time over and over again. Resulting in this lag ...

That is my yearly Linux rant hahaha. And yes, i know, W11 is a disaster but i simply wait it out on W10, and see what the future brings when the whole AI hype dies down and Microsoft loses too much customers. I am betting that somebody is going to get scared at MS and we then get a better W12 again.

> Airport security staff being so gruff

More of a issue that power goes to their heads.

Do not get me started on airport security staff in the Netherlands that cracked some insulting jokes about my nationality. I was not amused...

Or the idiotic "remove your shoes" so we can x-ray them... What next, go naked? O, that is what those new scanners are for that see past your clothing.

If i can avoid flying, i will ... Its not the flying, its the security. You feel like being a criminal every time you need to pass and they do extra checks. Shoes, bomb test, shoes, bomb test ... and you do get targeted.

The amount of times i got "random" checked in China as a white guy, really put me off going anymore.

Arriving, 50% chance of a check. Departing, 100% sure i am getting 1 check, 50% i am getting two.... Even won the lottery with 3 ... (one in entrance in Beijing: "Random" bomb check, one for drop-off luggage, and one for security) .... So god darn tiring ...

And nothing special about me, not like i am 2m tattoo biker or something lol. But yea, they see me, and "here we go again, sigh"...

Probably a issue with PFAS contamination. Stuff was used in firefighting water, and has contaminated just about every airport and the surrounding area's groundwater, all over the world. So while microbiologically safe, it has PFAS issues.

Companies will simply give some kind of standard answer, that is legally "cover our butts" and be done with it.

Its like that cookie wall stuff, how much dark patterns are implemented. They followed the letter of the law, not the spirit of the law.

To be honest, i can also see the point from the company side. Giving a honest answer can just anger people, to the point they sue. People are often not as rational as we all like our fellow humans to be.

Even if the ex-client lose in court, that is how much time you wasted on issue clients... Its one thing if your a big corporation with tons of lawyers but small companies are often not in the position to deal with that drama. And it can take years to resolve. Every letter, every phone call to a lawyer, it stacks up fast! Do you get your money back? Maybe, depends on the country, but your time?

I am not pro companies but its often simply better to have the attitude "you do not want me as your client, let me advocate for your competitor and go there".

> AI is pretty bad at Python and Go as well.

It great in Golang IF its one shot tasks. LLMs seem to degrade a lot when they are forced to work on existing code bases (even their own). What seems to be more a issue with context sizes growing out of control way too fast (and this is what degrades LLMs the most).

So far Opus 4.5 has been the one LLM that keeps mostly coding in a, how to say, predictable way even with a existing code base. It requires scaffolding and being very clear with your coding requests. But not like the older models where they go off script way too much or rewrite code in their own style.

For me Opus 4.5 has reached that sweet spot of productivity and not just playing around with LLMs and undoing mistakes.

The problem with LLMs is a lot of times a mix of LLM issues, people giving different requests, context overload, different models doing better with different languages, the amount of data it needs to alter etc... This makes the results very mixed from one person to another, and harder to quantify.

Even the different in a task makes the difference between a person one day glorifying a LLM and a few weeks later complaining it was nerfed, when it was not. Just people doing different work / different prompts and ...

> If you assume Adams is lying, that’s your call. But if the question is what he believes happened, the obvious evidence is his own account.

You can believe something with all your heart and that believe can be a lie. People are not machines.

The idea that a manager will go "hey, we are DEI hiring Asians" in the 80s in the bank sector... No offense but that is mixing modern 2020's politics and trying to transplant it to the 80's.

Fact is, you only have one source of this "truth", and have historical data that disproves this idea of DEI hires in the 80s (unless your white and male, then yes, there was a LOT of DEI hires and promotions that bypassed women and/or people of color).

And this is still happening today. But nobody wants to talk about that too much because that is considered the traditional family and god given right to the white male ;)

I am betting your a white male, that lissen to a lot of conservative podcast/twitter etc. You can prove me wrong but we both know the truth ;)