Stefan Sperling

The LLM topic has been all over my mastodon feed for months. I find the consequences of LLM adoption depressing overall, with all the damage resulting in several segments of our societies worldwide.

Until now, I have been ignoring LLMs, but there is increasing use of LLMs among customers of my company, which means I can no longer ignore this topic entirely.

I observe use of LLMs mostly by people who don't write programs regularly, who are using these tools to fill gaps in their own skills or available time, with variable success.

The only work item related to LLMs I have accepted so far is reviewing LLM-generated security bug reports, where someone else is running various AI tools to scan open source projects, sends us reports, and with respect for our time (unlike some other people who just spam open source projects with such reports) pays me and another open source developer to take a look at them.

Most of these reports are garbage and get discarded. About 1 or 2 in 25 reports are on to something. We write required fixes the good old fashioned way.

I have been reviewing reports from code scanners for more than a decade every now and then. The only thing which is new to me here is the entanglement of the code-scanning tool with all the harmful side-effects and consequences of its existence.

I haven't yet received significantly higher quality reports than what I have seen before LLMs. A big problem is that the severity of the bugs reported is often blown out of proportion, which can cause wrong judgement or even panic when non-experts are evaluating such reports without a sufficiently critical lens.

Reluctantly setting aside the larger issues surrounding LLMs, code-scanning is as far as I will accept going along with this, but no further.

My company is now borrowing the EU's "Certified Organic" logo to deter potential clients who would require use of LLMs. I hope this gets the point across, without having to explicitly mention LLMs or "AI", cause I am very much sick of seeing them mentioned everywhere.

Finally found out why Tx was broken with iwx(4) on Intel AX211 BZ devices. Another one of those bugs which cannot be found without persistence and some amount of good luck.

https://marc.info/?l=openbsd-cvs&m=177341485313105&w=2

#OpenBSD #WiFi

If you are using #gameoftrees (on #OpenBSD or anywhere else) please always be diligent about checking SSH host key fingerprints.

Versioned files inside the work tree's meta-data .got directory can be created during 'got checkout' or changed during 'got update'. Files in the meta-data directory should never be under version control, yet the current implementation unfortunately allows this.

Which provides a way for malicious repositories to configure remote servers stored in .got/got.conf which would then be used by the fetch and send commands. Unless you already have the bad host key stored, SSH will ask for verification of the bad server's host key fingerprint as the last line of defense against a man-in-the-middle.

The problem was reported to me by Runxi Yu about 2 hours ago. A fix for this issue is being worked on: https://marc.gameoftrees.org/mail/1778362202.49408_0.html