For about a year as a hobby I've been writing an app that scratches several itches that I've had with the fediverse (multiple accounts at once, supporting both microblog- and threaded-style content, synthetic/hybrid feeds, etc.) and for the past month or so have been using it exclusively on the desktop and about 50% of the time on mobile (Voyager is my main mobile client and source of inspiration here). I'd like to open source the whole thing. But the code is mine, therefore buggy and bad. Normally I'd not worry too much about that, but in the age of LLM attacks I don't want to contribute more security vulnerabilities to the world. Should I use an LLM security tool to analyze my code and point out security issues so I can patch them before releasing the code? If so that would more or less be the only AI contribution. I'm a practical-minded person and use AI tools at work so it doesn't bother me, but I know lots of people here have strong (and often helpful) opinions on the matter.

you are viewing a single comment's thread
view the rest of the comments

[–] ravenaspiring@sh.itjust.works 6 points 16 hours ago

I'd actually go one step further an set up a harness or job which regularly reviews it against CVE and known vulnerabilities, as frankly they come so fast these days it's worth making a regular automated review with at least some intelligence, vs us human who might remember to take the trash out on trash day. We are better at some elements of this, but adding intelligence to security reviews against the intelligent intruders seems like a necessity.