cortesoft

You say that now, but you don't know what the future models will be capable of. If models get ridiculously good, you might not be perfectly fine with that.

There are no content owners that have close to as deep of pockets as the big AI companies

I feel like this is one of those things that isn’t surprising to Factorio players

Who is 'they'?

> The value of money, and the ability for average people to have influence on future events, ultimately is tied to the fact that the labor of an average person has inherent value.

We also have the power of the vote, at least for now. I understand that that is limited, but it isn't nothing.

There is also just the power of having a lot of people. We don't yet have the technology where one person with a lot of machines can dominate a society. It still takes people.

Then use an http header like we do with CORS or something, which lets a domain set a cookie for another domain that opts in. Or, you can just include the necessary cookie info in the redirect.

They should have never allowed cross subdomain access for cookies. Every subdomain should be treated as completely unrelated to all other subdomains.

So you are therefore arguing for the author's point.

The entire exercise is to counter the claim that AI means every script kiddie with tokens can just have their AI create an exploit, and then have their AI scour the internet for vulnerable endpoints. If that were true, then the exploit has very little value, because everyone could make one.

In addition, the claim is that these exploits will all immediately have a thousand bots using them to exploit every possible website, and you can't leave your website vulnerable for a second or it will immediately be owned.

The fact that that hasn't happened to this server already proves the point. Whether professionals can create an exploit from the vulnerability was never the question.

Whether it is a trap or not doesn't change the OP's point... they are trying to push back on the idea that all servers that have this vulnerability are going to be instantly hacked by bot swarms. If AIs are at the point now where they can all instantly create an exploit from a known vulnerability, then you would have no need to keep your exploit secret because everyone would already have one.

The fact that you keeping your exploit secret means anything already proves their point.

The difference between investment and debt is that debt has a senior claim and fixed returns. You can't be forced to sell from investments.

You say they aren't even close to being an answer, and then give basically the same answer...

> they also ask questions, and if they are good, they ask the right questions, something LLMs still have a problem with.

Sure, but LLMs do ask some questions already, and there is no reason to think they can’t keep getting better at knowing the right questions to ask.

Humans also often fail to do this well, and I think we all have experience with developers who do a very poor job at understanding what is actually being asked of them.

Maybe LLMs will never become as good as an expert developer at being able to suss out what someone is actually trying to do when they make a request, but it is certain LLMs will become better at it, and there is no reason to currently believe they couldn’t eventually become as good as the best humans eventually.

This is how gossip and urban legends and other myths have always spread. The difference is the size of the network and how much distance a myth can travel in a very short time.

Now, the entire world can share the same piece of gossip, and it takes on an entirely different quality when it is global instantly.

This doesn’t help you if you need to run a public website.

I was more talking about staying up on security issues with your stack after they are patched. We will need to check for security updates constantly, or risk being exploited in the gap between a security release and you finding out that you need to update your software.