Comment by digitaltrees
9 hours ago
Hey world, we created this problem, and it will hurt all of you whether you use it or not. The good thing is there is a solution: if you pay us a lot of money we can try to fix it. The only problem is you’d better hurry because we are releasing the dangerous stuff as fast as we can so you’d better pay us to put the safety measures in place because we are the only people that can fix it and time is running out because, like I said, we are moving fast.
So how many tokens can I put you down for.
That’s like blaming white hat security researchers that want to be paid for finding vulnerabilities, for all the bugs that have been found. Before professional security researchers existed, far fewer vulns were found.
The vulnerabilities exist and many have for decades. Find them or leave them for someone more dangerous, just don’t shoot the messengers.
Personally I’d rather we went through a short and sharp improvement and embedded a faster response cycle, than wish it away. It’s the reality of the situation; so adapt.
I’d like to dialogue/debate you on a video call if you’re interested. I don’t think I agree with you but you’re thoughtful and I may have something to learn. Let me know if you’re interested
> That’s like blaming white hat security researchers that want to be paid for finding vulnerabilities, for all the bugs that have been found.
Last I checked, white hat security researchers weren't making their livings selling superhuman hacking tools to unknown entities as part of ~$1T businesses desperate to offload their shares onto the public before a potential bubble pop.
If you want to argue what they're doing is fine regardless, be my guest, but using this comparison as the justification is a little ridiculous.
You’re missing the point. The white hat researchers in your example would need to also be the black hat hackers selling the tools to do the exploit in the first place. There is a conflict of interest when you create the problem and then solve it. I don’t think anyone would tolerate a white hat security team releasing the exploit publicly so they could sell more services rather than taking it to the affected company to patch.
Why are you framing it like this? Did they create this vuln and how did they force people to pay for a fix?
Because it is a reasonable logical inference from the facts.
1. OpenAI started the current AI cycle
2. That cycle has exposed exponentially more security vulnerabilities due to agentic coding
3. OpenAI is rushing as fast as they can to reach the singularity even while acknowledging that they lack the ability to ensure reasonable safety.
4. They launch an initiative to “address” the security vulnerabilities by using their coding tools.
Am I missing something? There is a broad range of motives and responses.
In this case (the PHP bug), the "AI cycle" may have exposed the security vulnerability but it did not create it. If someone released a non-AI-based static analysis tool that was really good at exposing vulnerabilities I wouldn't expect that person to foot the bill of fixing the exposed vulnerabilities
6 replies →
No, vulns have been created by waves of leads clinging to their personas of “computer sorcerers”, gatekeeping, excluding anyone sounding the alarm or more humbly attempting to fix the mess. Whenever I hear “with great power comes great responsibility” (and the implication that the speaker is condescendingly containing the irresponsible) I cringe so hard that my teeth crack
Let he that has never created potential vulns cast the first stone.
Imagine a world full of locks that humans can only rarely pick.
Then, someone releases a pick that works for many more locks humans couldn't pick.
And says: You can't stop the progress. Now pay us to upgrade your locks (no-no, they won't be doctored to fit our next-gen picks, trust us!)
That last bit is unnecessary. If pick development is accelerating, the lockmakers can do their very best in good faith to build the best, most pick-proof locks possible, no doctoring involved. And still those locks will be pickable eventually.
Your comments in other threads suggest an devotion to the frontier labs. In another thread when I suggested they lied to investors and that constitutes securities fraud you questioned it in an overly dismissive manner. I would love to understand where you are coming from. I am open to being persuaded that my opinion is incomplete and I should be more charitable to openAI and anthropic.
> Your comments in other threads suggest an devotion to the frontier labs.
I don't use these models much I just don't like unfair criticism.
> In another thread when I suggested they lied to investors and that constitutes securities fraud you questioned it in an overly dismissive manner.
I'm confused, are you posting under two identities?
The user Frieren claimed that this post constituted securities fraud. To which I responded: "You're claiming this is securities fraud?"
Is that dismissive? It was a genuine question, I don't get how it's even accurate say that they are lying in the post and I especially don't get how it is securities fraud.
Your post doesn't have anything to do with the blogpost. Once again, I'm not against criticism just unfair/weak criticism. I don't think it helps anything.
1 reply →
>we created this problem
No, the people who wrote the original code with security vulnerabilities created the problem, or those who architected their language/framework/SDK to not have easy forwards compatibility.
>we are releasing the dangerous stuff
No, they are disclosing its existence, not releasing it.
If I build a fence out of wood, knowing its flammable, but the only risk is natural forest fire and then some sells flame throwers to teenagers along with drones equipped with fence seeking vision and then tells me I need to pay for their proactive defense drone equipped with a flamethrower and drone seeking vision then maybe you’d understand the situation here.
OpenAI released the tool that FINDs the exploits. They don’t need to publish them to be complicit.
there was a post recently on a guy that was posting fake stats in order to prove that llms can be tricked
similarly OpenAI was born out of the idea that the tech will exist and that they should be the oned to decide how it exists instead of other bad guys
I think if you do something you did it, imagining another bad guy doing it is not a great defense.
didn't think we'd win the race to the bottom of rent-seeking, but humanity's ingenuity for self-destruction continues to astound me. Einstein was right as always.
Before I forget: Sam Altman will need a lock of your hair, a blood sample, and first you will need to breathe into this tube and say “my voice is my passport.”
I assure you this is perfectly formal, and for your… “safety”.