romaniitedomum

Because a court interpreted the law and ordered them to. And protecting companies from unlawful piracy is just as much a moral good as protecting the consumer from ransomware and threat actors. And if the DNS company can do the one, they can do the other.

> Everyone sane has the models review the choose the models wrote. Reminder these are the models which found the Jacobian and Navier-Stokes counterexamples; they’ll find holes in their own slop, too.

It's not enough, though, to just tell the model to check the code for vulnerabilities. The model has to be guided specifically to look for particular classes of problem and that takes someone experienced in security.

> Do we know the code behind these vulnerabilities were written by AI? It seems like if anything AI was used to find exisitng vulnerabilities that would otherwise be used/sold as zero days and go unreported.

I was speaking in the general sense, not of these vulnerabilities specifically. I am of the view that AIs for the foreseeable won't produce code that is any better from a security point of view than something human written, so AIs will produce new vulnerabilities at least as fast as they find them and the rest of us will be faced with massive headaches like the one in the original post.

> It was always the case that finding vulnerabilities in software was easier than writting perfect software. I'm hopeful that we can use AI to make software more secure over time. Project Zero [1] and others has shown many times the past few years (pre LLMs) that automated fuzzing and other forms of dynamic analysis are very effective, which bodes well for automated testing via LLMs!

And yet, we are not seeing a drop-off in new vulnerabilities being discovered. We keep assuming that the list of bugs is getting smaller and we'll find them all eventually, but that is not the case for any software that I know of.

> I agree that more code = more bugs overeall, but there are slow moving codebases that run some of the worlds most valuable software. Seems like using AI to find vulnerabilities in that code is a huge win across the board.

It might be, yet, as I said just above, we are not seeing a drop-off in new vulnerabilities being found. The trickle of vulnerabilities has become a flood across all open source software, and already breakages and problems are occurring as maintainers struggle to keep up. Administrators, likewise, are struggling to keep systems updated. Just a week or so ago a security patch to rsync on RHEL broke rsync so completely that it could no longer handle symbolic links.

Critical CVEs used to be relatively infrequent, but they're becoming a weekly or even daily occurrence. None of us are prepared for this eventuality.

An interesting observation that I encountered somewhere, I forget where, is that AIs when writing code introduce vulnerabilities at a rate similar to humans writing the same code. So we're looking at a massively accelerated volume of security vulnerabilities for the foreseeable future thanks to AI-assisted security research, and we can expect no reduction in new vulnerabilities from the AIs writing the code.

> I am not an AI evangelist by any means, but it does serve a purpose when used correctly.

Well, doesn't every tool? The devil is in the details of just how easy it is to use correctly versus incorrectly, and what are the consequences if it's not used correctly. A tool that, when used as its manufacturer advises, fails as often as most AI systems do has no place in systems where peoples' health and safety can be harmed.

It used to be common in some places to outsource medical transcription to India (obviously not real-time recording). I spent time in India years ago working with a company in Mumbai (not medical transcription) and there were stories in Indian newspapers about mistakes being made due to the transcribers having no medical knowledge at all. One instance that I've never forgotten is the one where the Doctor had diagnosed "phlebitis" in the patient's leg, and the transcriber had written "a flea bite his leg".

It just hides that particular entry. What I meant to say is, I see certain domains and always hit hide on them, because that's a place I don't want to see anything from.

Exactly so.

Same way as always. Open the page, glance down it to see if there's anything that interests me, hit hide on the domains that I never want to see anything from. Lather, rinse, repeat.

But I'm guessing you have more of a FOMO (Fear Of Missing Out) kind of problem, which admittedly I don't have. However, you could look at something using RSS, maybe in combination with an agent told to find and show articles based on some heuristics.

Personally, I'm OK with missing something. If it's good, I figure it'll surface somewhere else and impinge on my notice sooner or later.

> This suggests that people are drawn to AI that unquestioningly validate, even as that validation risks eroding their judgment

The obvious counterpoint is the large number of complaints about OpenAI's excessively sycophantic models back in April 2026, which led to them rolling back to a previous and less sycophantic model. I think there are those who are susceptible to model sycophancy, but it's definitely not most users. I have a vague, half-formed intuition that many of those susceptible to sycophancy are those who use AI for non-technical, non-work uses, such as inter-personal relationship questions.

As for me, as soon as I see any hint of sycophancy in a response I either stop what I'm doing or I tell the model to stop being an idiot.