weagle05

This is my observation based on working with AI. AI seems to mature just like people mature. It has progressed from an intern into a staff or senior level engineer. I still see it making bad decisions on security (mostly errors of omission) and the quality is still greatly dependent on the the instructions. I do think this continues to get more advanced over time. What I am looking forward to understanding is what does a code base look like that's been 99% developed by agents over a long period of time. These early agents may be technical debt engines at scale.

I know many people who say they're "off" social media but they're still scrolling. They may post less or not at all, but the algorithm still has them.

I laughed for a solid 5 minutes at the video of grabbing a plate.

By going the way of pipedpiper do you mean Son of Anton?

Gemini is all over the place for me. Nano Banana produces some great images. Today I asked Gemini to design a graphic based on the first sheet in a Google sheet. It produced a graphic with a summary of the data and a picture of a bed sheet. Nailed it.

I was in the same boat in December. My 2013 MBP was starting to show its age and I was hesitant to go with a new MBP because of the new processors. I ty

I too would be interested to view these models. Coming from a rural background, people in my hometown still have gardens and hunt/fish. We're one, maybe two, generations removed from people producing most of their own food. I don't see how cities deal when they can't refrigerate food and the supply chain is interrupted.

I think we disagree on the bigger problem. In my view the bigger problem is the erosion of trust for open source. Over the last 10-ish years there has been a flood of research and marketing around open source software security. I wrote a white paper about it back in 2011. We know there are risks in open source and we know vulnerabilities are created both intentionally and accidentally. We also know open source maintainers are overworked and human. There will be mistakes and we must prepare for them. This is the reason why the fine folks at Sonatype, Snyk, and WhiteSource have jobs.

These grad students wanted to make a splash and went after one of the most important code bases on the planet. It stopped being an ethical problem when the kernel maintainers had to manually search for vulnerabilities. They are using hours that could be used elsewhere. The Linux Foundation is paying Greg Kroah-Hartman to solve this problem, so they have a financial loss due to the actions of these grad students. There's your civil liability. They "knowingly cause(d) the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer" so there's your criminal liability from the Computer Fraud and Abuse Act. There's probably criminal liability in the state where they live as well.

I remember taking business ethics in college. The professor told us to keep a dirt file on our bosses in case we ever needed to retaliate. He got really upset when I challenged him on it. I understood his point but I found it extremely ironic.

I'm giving you an upvote. Look around your house and count the number of linux kernels running. My count is 6 that I know about. I haven't seen the actual vulnerable code submitted to know how critical the vulnerabilities are but I believe these grad students are liable both civilly and criminally. Not advocating for mob justice but there needs to be more than a slap on the wrist. For those of us who live and breath software security everyday this is kind of a big deal.