this confirms what i just said in reply to a different comment: most cases of ai "success" are actually curated by real people from a sea of bullshit

And if Gutenberg had just written faster, he would've produced more books in the first week?

Problem is motivation. As someone with ADHD I definitely understand that having an interesting project makes tedious stuff much more likely to get done. LOL

I meant one-off that it worked on this code base rather than how many times it found the issue. I don't expect it to work eight out of a hundred times on any and all projects.

Curated by experts, specifically. Seeing a lot of people use this stuff and flop, even if they're not doing it with any intention to spam.

I think the curl project gets a lot of spam because 1) it has a bug bounty with a payout and 2) kinda fits with CVE bloat phenomenon where people want the prestige of "discovering" bugs so that they can put it on their resumes to get jobs, or whatever. As usual, the monetary incentive is the root of the evil.

It matters, because it's a tool. That means it can be used correctly or incorrectly . . . and most people who don't understand a given tool end up using it incorrectly, and in doing so, damage themselves, the tool, and/or innocent bystanders.

True AI ("general artificial intelligence", if you prefer) would qualify as a person in its own right, rather than a tool, and therefore be able to take responsibility for its own actions. LLMs can't do that, so the responsibility for anything done by these types of model lies with either the person using it (or requiring its use) or whoever advertised the LLM as fit for some purpose. And that's VERY important, from a legal, cultural, and societal point of view.

i feel like people are misunderstanding your point. yes, generative ai is bullshit, but it doesn't need to be good in order to replace workers

I don't know if you read the article, but in there it says AI is becoming smarter. My comment was a response to that.

Irrespective of that, you raise an interesting point "it's about the impact AI has on the world". I'd argue it's real impact is quite limited (mind you I'm referring to generative AI and specifically LLMs rather than AI generally), it has a few useful applucations, but the emphasis here is on few. However, it's being pushed by all the big tech companies and those lobbying for them as the next big thing. That's what's really leading to the "impact" you're perceiving.

Yes, but:

To get to this point, OpenAI had to suck up almost all data ever generated in the world. So in order for it to become better, lets say it has to have 3 times as much data. That alone would take more than 3 Lifetimes to get the data alone, IF we don´t consider the AI slop and assume that all data is still Human made, which is just not true.

In other words: What you describe will just about never happen anymore, at least as long as 2025 will still be remembered

No, it's not. It's a word predictor trained on most of the web. On its own it's a pretty bad search engine because it can't reliably produce the training data (that would be overfitting). What it's kind of good at is predicting what the result would look like if someone asked a somewhat novel question. But then it's not that good at producing the actual answer to that question, only imitating what the answer would look like.

That's why we really shouldn't call them "AI" imo

Maybe I misunderstood but the vulnerability was unknown to them but the class of vulnerability, let's say "bugs like that", are well known and published by the security community, aren't there?

My point being that if it's previously unknown and reproducible (not just "luck") is major, if it's well known in other projects, even though unknown to this specific user, then it's unsurprising.

Edit: I'm not a security researcher but I believe there are already a lot of tools doing static and dynamic analysis. IMHO It'd be helpful to know how those perform already versus LLMs used here, namely across which dimensions (reliability, speed, coverage e.g. exotic programming languages, accuracy of reporting e.g. hallucinations, computation complexity and thus energy costs, openness, etc) is each solution better or worst than the other. I'm always wary of "ex nihilo" demonstrations. Apologies if there is benchmark against existing tools and if I missed that.