this post was submitted on 19 Sep 2026
158 points (98.8% liked)

Linux

19204 readers
177 users here now

Welcome to c/linux!

Welcome to our thriving Linux community! Whether you're a seasoned Linux enthusiast or just starting your journey, we're excited to have you here. Explore, learn, and collaborate with like-minded individuals who share a passion for open-source software and the endless possibilities it offers. Together, let's dive into the world of Linux and embrace the power of freedom, customization, and innovation. Enjoy your stay and feel free to join the vibrant discussions that await you!

Rules:

  1. Stay on topic: Posts and discussions should be related to Linux, open source software, and related technologies.

  2. Be respectful: Treat fellow community members with respect and courtesy.

  3. Quality over quantity: Share informative and thought-provoking content.

  4. No spam or self-promotion: Avoid excessive self-promotion or spamming.

  5. No NSFW adult content

  6. Follow general lemmy guidelines.

founded 3 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
[–] keisatsu@infosec.pub 0 points 5 days ago (3 children)

don't hope too much, they have admitted they are vibing it

[–] wilmo@lemmy.ml 21 points 5 days ago (1 children)

They specifically aren't vibing it though.

As they say it's useful to find vulnerabilities which is true.

And as far as code they said:

Frontier models are very good at finding bugs but it requires an experienced developer to babysit it and extract the useful portion of the output. Important bugs are often found but mixed in with a bunch of low quality output.

Which is the opposite of vibe coding.

It's fair to dislike any LLM usage. But it can have value. But it's often coming from unethical entities like OpenAI and Anthropic etc

[–] rowinxavier@lemmy.world 2 points 5 days ago

I think this is the distinction of uses I canost get behind. If you find an attack using any tool, whether that be a CVE, a script kiddy, or an LLM, then you can go on to understand how the vulnerability works and patch it. This leaves the understanding part to the programmer, but not the arduous task of trying to find problems. If you use vibecoding to do the actual fixing you never have the understanding of how the code works and therefore what the changes will actually do.

LLMs can be useful in a lot of ways, but they should never replace thinking and understanding. Just like you do need to memorise some things but not others, there are cognitive tasks you don't have to do all the time but others you really have to in order to actually be a good programmer. If you outsource thinking you stop doing it and get weaker at it. If you outsource meaningless tasks or use systems to reduce the need for them that is actually useful for freeing up your mind for tasks which cannot be automated.

So in my view using these tools to find bugs in code can be useful. Knowing that if a bug is found it may not be disclosed to you by the tool because the provider of the tool wants to keep some bugs hidden is something people should consider, I mean that is exactly what the NSA has been going for decades with zero day exploits in various operating systems and platforms, why would they not do so now?

[–] trevor@lemmy.blahaj.zone 5 points 5 days ago (1 children)
[–] keisatsu@infosec.pub 2 points 5 days ago

Their mastodon profile is talking at length about it.

[–] lambalicious@lemmy.sdf.org -1 points 5 days ago

Shit, well that pretty much seals the deal on no Motophene for me. As if the Epstein Class price tag was not doing enough as a disincentive.