I wonder how many people understands that using LLMs for chasing CVEs is a double edged sword.
Like I agree with them it's an actual useful thing! (if you ignore the destruction of the environment, the corrupt and evil companies and the massive infringement of licenses those models were built on).
But the problem comes around when everyone can use those, now it's a race on who gets it first, the maintainers or the hackers.
1/4
And it's not even a natural response, it feels completely on purpose, like this companies selling you the cure for the illness they made in the first place.
If you don't use it you're more likely to get clapped by slop hackers, and regular hackers, and this is because the same models are available to everyone willing to pay, it's absurd and stupid
2/4
You didn't help people make safer software, you put them on a stalemate where they have to depend on your product or be destroyed, it's basically a ransom! And some people are okay with this!!!
And the worst part, we could have gone to the route of safer code and software just by improving compilers and actual tools, tools that actually require you to know what you're doing!
But noooo, all the investment and interest has to go to the stupid slop machine!
3/4
And the worst part is that they still have chances of making you waste time with errors that are not there, like, it's not even 100% accurate.
And to people who tell me "well at least it's great this made it more available to the average dev" shut up.
Cybersecurity is specialized for a reason, it's the same dumb discourse of "democratizing x", NOT EVERYONE NEEDS TO KNOW EVERYTHING!
4/4
@NullTheFool this feels so eerily familiar. Like… “the only thing that can stop a bad guy with an llm is a good guy with an llm, so you should all buy an llm!”