alt Hacker NewsLong term we will end up with software with no low hanging fruit exploits left. But right now we are in a period where low hanging fruit is everywhere and it's easier to exploit systems than ever before.
Replies
I fear the vast majority of projects never went with any kind of code review but somebody high on Red Bulls at 9 PM looking at the code and saying “looks good to me”.
And this is the best of cases. I fear many times in a smaller projects it was “it compiles at last, let’s see if anybody complains”. That’s why LLM’s are so damn effective today.
(been there, done that – I’m not pointing fingers, but we are human, we get tired, and we don’t have the NASA budget to complete things and ship them)
That’s assuming we’re not adding software defects at the same pace, but I imagine we are generating a lot more defects than are being discovered at the moment.
That relies on a major assumption that current systems are finding the vast majority of all possible exploits out there. This assumption itself would assume that either current LLMs are near perfect, or that the peak difficulty for exploits was just above human capability (which is where LLMs currently are). I think both of those assumptions are very likely false. If so then we'll see indefinitely ongoing exploit discovery as LLMs improve their capabilities.
Long term I suspect that the purpose of the digital domain is going to end up being rethought. For instance connecting critical infrastructure to the internet has always been a terrible idea, and LLMs will just make that even more clear.