Comment by cortesoft
7 hours ago
It feels like the only solution is going to be proactively running your own AI agents looking for patches and applying them.
7 hours ago
It feels like the only solution is going to be proactively running your own AI agents looking for patches and applying them.
Does any one know of good feeds that we should be pulling or scraping from? I think the proactive nature here is seriously important.
The issue is where to direct the LLM's attention.
Prompting the LLM to "look for vulnerabilities in PHP's multipart upload handling code" is going to find stuff that "look for vulnerabilities in PHP" won't.
I was more talking about staying up on security issues with your stack after they are patched. We will need to check for security updates constantly, or risk being exploited in the gap between a security release and you finding out that you need to update your software.
Yes, so who will pay for that? Open source so far meant you would use your brains and your creativity, now you need to use your money too if you want to keep pace. From a 'guts, credits & glory' proposition to 'slop processor if you can afford it' is not really an upgrade.
Or, you know, use client certificates so the bots can’t hit you.
Those can leak / be stolen of course, but a bunch of my clients php apis survived as without a cert they’re told to fuck right off.
It does make their client onboarding a bit harder but it’s a trade off which seems to have been the right one.
This doesn’t help you if you need to run a public website.