For about a year as a hobby I've been writing an app that scratches several itches that I've had with the fediverse (multiple accounts at once, supporting both microblog- and threaded-style content, synthetic/hybrid feeds, etc.) and for the past month or so have been using it exclusively on the desktop and about 50% of the time on mobile (Voyager is my main mobile client and source of inspiration here). I'd like to open source the whole thing. But the code is mine, therefore buggy and bad. Normally I'd not worry too much about that, but in the age of LLM attacks I don't want to contribute more security vulnerabilities to the world. Should I use an LLM security tool to analyze my code and point out security issues so I can patch them before releasing the code? If so that would more or less be the only AI contribution. I'm a practical-minded person and use AI tools at work so it doesn't bother me, but I know lots of people here have strong (and often helpful) opinions on the matter.

you are viewing a single comment's thread
view the rest of the comments

[–] keisatsu@infosec.pub 4 points 19 hours ago (1 children)

An AI security tool can't substitute for a real security audit. Especially if you don't have the necessary know-how to verify the outcome. If you don't have extensive experience performing manual security code audits, don't even bother. You might just as well release it with a disclaimer that it hasnt been vetted and leave it up to whoever want to test it to review it.

If you do opt for a scan, please disclose it properly. Many will never consider code that has been touched by an LLM in any shape or form, but it's better to be honest about it.

Finally, if you pay the frontier labs for their models you are supporting their business practices including training models on stolen data, the destruction of the environment and further inflation of the AI bubble. A local model is not much better, all things considered, but at least Scam Altman and Wario Amodei won't benefit.

[–] artifex@piefed.zip 4 points 19 hours ago

Yep. honestly it doesn't bother me if nobody else uses it (for ideological reasons or otherwise), I just figured if it's useful to me it might be useful to others as well.