deleted
replyPerhaps eventually, they can finally live up to their namesake. On January 1 2029, we will move to a "Full 0" policy where vulnerabilities are disclosed after (looks at camera) zero days.
replyIf AI is doing all the work I could see that; same day remediation.
replyWhich means developers must trust AI blindly since there is no time to review the fix. Which also means that developers are completely unneeded
replyNo, that's not what it means. It just means that the benefit must outweigh the risk, as always. Making surgical patches to existing code is also quite different to introducing features, which is what developers typically spend their time on. Not that same-day patching would imply literally zero time to review either.
replyThat does not follow. Somebody stills needs to set it up. And maybe to sign off. The AI could instantly diagnose and summarize the problem and its remediation and you say the word.
replyAnd someone who understands the whole thing needs time to validate that the remediation is indeed what it's supposed to be.
replyNo, they're not - they can just release and wait for another vulnerability disclosure. Then the loop between [Vendors] and Project Zero needs no humans in it.
reply“Someone” being another AI agent.
replyIt’s agents all the way down.
If AI is doing all the work then why would remediation be needed at all? Why can't the software AI produces be vuln-free if the same AI is used to detect them?
replyBecause the people finding the vulns aren't the people running the services.
replyWhy aren't they? The people running the services can use the AI to find the vulnerabilities before they release.
replyYou talk as though there is one AI model that is perfect and capable of identifying all potential flaws with no mistakes or omissions, and that access is free and unlimited.
replyReality is more complicated than that.
Exactly. That's super irresponsible to knowingly release software that you haven't used AI to check if it had any vulns. There's zero (heh) excuse to release vulnerable software at that point.
replyCatching lots of bugs in software written with poor methodology is the new norm and that is not the same as releasing software that is not vulnerable. That is releasing software that needs increasing technological improvements or luck to
find remaining vulnerabilities.
replyIs the AI in the room with you right now?
replyThe Machine is everywhere. Watching us with ten thousand eyes. Listening with a million ears.
reply