Meh, its less exciting whenever Claude Code is involved; I am wondering how many undetected bugs will sneak into the kernel. If he was going to use an LLM, he could at least use something local and not connected to one of the many nasty big corps that are ruining shit.
You wouldn’t want him using a local model unless he was running some fancy rig that could run a high end frontier model. He might not have such a thing laying around. Using the best out there for something like this is how you help avoid bugs.
He definitely can afford it yes, but its still a big ask to want someone to spend 15-25k or whatever it would be (shits getting more expensive by the day) to use a tool that he can just do pay per use. The code is open source so its not like he’d be using a local llm to keep it private.
Honestly, his mind and the community is probably one of the best things out there at the moment. They live the Linux Kernel, while that thing he used does not think or understand anything. Eh, it would be better if they moved with care instead, as that is a good way to avoid bugs too. I don’t have a lot of faith in gassed up LLMs.
He’s doing it though. So that’s kind or moot. Fable is out there finding bugs in these things, so seems like if he is going to do it, using the thing that’s already making it more secure by finding multiple exploits is the right choice of what to use.
Ehh, that’s debatable. An LLM will gladly spit out a vulnerability report, but as LLMs lack any understanding or reasoning capability, there’s literally nothing guaranteeing that it has any semblance in fact or reality. They are just random text generators after all.
Going by Anthropic’s own numbers for things like Mythos, it “found” 29,439 vulnerabilities, when a human actually checked if the reports made any sense (ignoring validity) that dropped to around 6,200 reports, when they were tested for validity that further dropped to around 1,300 reports, and when it came time to actually patch the issues only 516 made the cut (i.e. the rest might have been issues, but weren’t considered exploitable, etc.).
516 out of 29,439 is a 1.75% success rate, not exactly groundbreaking.
Now to be fair, according to Greg KH at a recent talk, Mythos is seemingly improving. Of 79 vulnerabilities it reported, a solid 4 were real. That’s a 5% success rate, though it performed much better when it simply reported other developers bug fixes, something it did 11 times.
Yeah, but you are still relying on models that are going to go up in smoke when the bubble fucking crashes. As people are rightfully hesitant to pay the real price for these things, these things are controlled by mega-corps which is ultimately a bad thing because a centralized authority sets the terms of engagement with their services. They are the ones actively scraping open source projects so much that it acts as a DDoS attack, hovering up personal data of other people as if it were candy. Not to mention the other effects it is having on jobs, AI systems being central to massive data breaches, etc. A few positives don’t outweigh the massive negatives that come with the technology.
If the models all go up in smoke, we still have the code (and its bugs) - so let’s get as many bugs out as possible as soon as possible and not accept a bunch of garbage code - as has always been the case, it’s just happening faster now.
Trainers (all over the world) are behaving badly, because they can get away with it. I’m not sure where that ends up, but it doesn’t change the generated code or the discovered vulnerabilities or the fixes.
The personal data has been abused for decades already, but again - now it’s easier for more actors to abuse your personal data and mine. Maybe, someday, we’ll get serious about enforcing privacy policies and not just have completely toothless theater about it.
Yeah, personal data has in fact been abused for years, it’s just getting worse though…With all the latest breaches that have leaked a lot of shit. It’s why I am constantly fighting all the bad bills whenever they are being talked about, making sure I am a pest to my representatives. Making sure my voice and opinion are loud and clear, also making sure others speak up too. That makes a difference. We just have to fight harder for more bills with teeth and consequences for the various entities that handle data and let it spill. Like actual business ending fines and real punishments. Setting actual standards that are sane, secure, can be optimized and built upon.
That code is still suspect to me, as random code generators aren’t known for creating maintainable code…People have to audit that shit to make it serviceable, which greats bigger workloads. Breaking the spirit of mostly volunteers with such inexpertly crafted code is just not the best idea.
Yeah, Trainers do act badly because they weren’t regulated to hell and back early on…With clear and decisive lines that shouldn’t be crossed. With rules that needed to be followed, people paid for their data or compensated for hammering personal websites. A lot of the data gets data laundered and put in training sets, but can be found in models, said models can be made to reproduce phrases. It’s honestly nasty work, that should’ve never been allowed to get out of control like it has. However, it was doomed to be this way because an absolute morally compromised fool is sitting in the White House so the major US creatures…Are going to get away with a lot for as long as possible. As for other countries, well, they don’t seem too keen on regulating so called “AI” as much as they should be. They are coo coo for corporate lies.
I’d definitely like someone to champion an open-weights model under 32 GB. But part of that desire is - I’m not sure they’re there, yet. Local models are only a few months behind, but hoo boy, the last few months have been big.
Coding models could be tiny, but distilled versions keep preserving pop-culture knowledge and world history, when reasoning through C++ requires essentially none of that. It needs the tokenization to recognize why a comment begins “Jesus Christ.” It’s fine for “treat the hash like Lot’s wife” to go completely over its head. Keep the weights that know a regex for e-mails, not the capitol of Florida. If it speaks a dead language I want it to be Algol.
Meh, its less exciting whenever Claude Code is involved; I am wondering how many undetected bugs will sneak into the kernel. If he was going to use an LLM, he could at least use something local and not connected to one of the many nasty big corps that are ruining shit.
You wouldn’t want him using a local model unless he was running some fancy rig that could run a high end frontier model. He might not have such a thing laying around. Using the best out there for something like this is how you help avoid bugs.
He gets paid more than enough to afford high end hardware.
He definitely can afford it yes, but its still a big ask to want someone to spend 15-25k or whatever it would be (shits getting more expensive by the day) to use a tool that he can just do pay per use. The code is open source so its not like he’d be using a local llm to keep it private.
AMD Ryzen Threadripper 9960X
GIGABYTE TRX50 AERO D Motherboard
Samsung SSD 9100 PRO 2TB SSD
Noctua NH-U14S TR5-SP6 Cooler
Intel Arc B580 GPU
Fractal Design Torrent E-ATX Case
Seasonic PRIME TX-1600 1600W 80+
Titanium PSU
ASUS ProArt Display PA32QCV 31.5" 6K
HDR Monitor
Honestly, his mind and the community is probably one of the best things out there at the moment. They live the Linux Kernel, while that thing he used does not think or understand anything. Eh, it would be better if they moved with care instead, as that is a good way to avoid bugs too. I don’t have a lot of faith in gassed up LLMs.
He’s doing it though. So that’s kind or moot. Fable is out there finding bugs in these things, so seems like if he is going to do it, using the thing that’s already making it more secure by finding multiple exploits is the right choice of what to use.
Ehh, that’s debatable. An LLM will gladly spit out a vulnerability report, but as LLMs lack any understanding or reasoning capability, there’s literally nothing guaranteeing that it has any semblance in fact or reality. They are just random text generators after all.
Going by Anthropic’s own numbers for things like Mythos, it “found” 29,439 vulnerabilities, when a human actually checked if the reports made any sense (ignoring validity) that dropped to around 6,200 reports, when they were tested for validity that further dropped to around 1,300 reports, and when it came time to actually patch the issues only 516 made the cut (i.e. the rest might have been issues, but weren’t considered exploitable, etc.).
516 out of 29,439 is a 1.75% success rate, not exactly groundbreaking.
Now to be fair, according to Greg KH at a recent talk, Mythos is seemingly improving. Of 79 vulnerabilities it reported, a solid 4 were real. That’s a 5% success rate, though it performed much better when it simply reported other developers bug fixes, something it did 11 times.
Less with LLMs than without. https://projectdiscovery.io/blog/the-vulnerability-curve-bent-with-the-ai-curve https://www.darpa.mil/news/2025/aixcc-results
Yeah, but you are still relying on models that are going to go up in smoke when the bubble fucking crashes. As people are rightfully hesitant to pay the real price for these things, these things are controlled by mega-corps which is ultimately a bad thing because a centralized authority sets the terms of engagement with their services. They are the ones actively scraping open source projects so much that it acts as a DDoS attack, hovering up personal data of other people as if it were candy. Not to mention the other effects it is having on jobs, AI systems being central to massive data breaches, etc. A few positives don’t outweigh the massive negatives that come with the technology.
If the models all go up in smoke, we still have the code (and its bugs) - so let’s get as many bugs out as possible as soon as possible and not accept a bunch of garbage code - as has always been the case, it’s just happening faster now.
Trainers (all over the world) are behaving badly, because they can get away with it. I’m not sure where that ends up, but it doesn’t change the generated code or the discovered vulnerabilities or the fixes.
The personal data has been abused for decades already, but again - now it’s easier for more actors to abuse your personal data and mine. Maybe, someday, we’ll get serious about enforcing privacy policies and not just have completely toothless theater about it.
Yeah, personal data has in fact been abused for years, it’s just getting worse though…With all the latest breaches that have leaked a lot of shit. It’s why I am constantly fighting all the bad bills whenever they are being talked about, making sure I am a pest to my representatives. Making sure my voice and opinion are loud and clear, also making sure others speak up too. That makes a difference. We just have to fight harder for more bills with teeth and consequences for the various entities that handle data and let it spill. Like actual business ending fines and real punishments. Setting actual standards that are sane, secure, can be optimized and built upon.
That code is still suspect to me, as random code generators aren’t known for creating maintainable code…People have to audit that shit to make it serviceable, which greats bigger workloads. Breaking the spirit of mostly volunteers with such inexpertly crafted code is just not the best idea.
Yeah, Trainers do act badly because they weren’t regulated to hell and back early on…With clear and decisive lines that shouldn’t be crossed. With rules that needed to be followed, people paid for their data or compensated for hammering personal websites. A lot of the data gets data laundered and put in training sets, but can be found in models, said models can be made to reproduce phrases. It’s honestly nasty work, that should’ve never been allowed to get out of control like it has. However, it was doomed to be this way because an absolute morally compromised fool is sitting in the White House so the major US creatures…Are going to get away with a lot for as long as possible. As for other countries, well, they don’t seem too keen on regulating so called “AI” as much as they should be. They are coo coo for corporate lies.
I’d definitely like someone to champion an open-weights model under 32 GB. But part of that desire is - I’m not sure they’re there, yet. Local models are only a few months behind, but hoo boy, the last few months have been big.
Coding models could be tiny, but distilled versions keep preserving pop-culture knowledge and world history, when reasoning through C++ requires essentially none of that. It needs the tokenization to recognize why a comment begins “Jesus Christ.” It’s fine for “treat the hash like Lot’s wife” to go completely over its head. Keep the weights that know a regex for e-mails, not the capitol of Florida. If it speaks a dead language I want it to be Algol.