regardless of whatever else you think about AI, it’s a good idea to be very wary about security-sensitive apps that are written using LLMs.

there’s a self-hostable S3 replacement called RustFS, with development that leans heavily on LLMs.

they had a security vulnerabilty last year.

one LLM-written commit added a complete authentication bypass to the code. literally, you could just send rustfs rpc as the auth token instead of an actual token.

it was fixed in a pull request named fix: Prevent panic in GetMetrics gRPC handler on invalid input which claimed to fix a different auth problem and just coincidentally removed the hardcoded auth token.

security stuff is hard, and LLMs are prone to over-confidence. that’s a bad combo.

I am basing that on both what I see on the news and what is happening to people all around me.

what news sources are you consuming?

because if you’re getting the message from the news that economic collapse is imminent and all currencies are going to be worthless and we will need to fall back to a barter-based economy…that is a function of choices you’ve made in your news diet, much more than it has anything to do with anything actually happening in the real world.

and what specifically is happening to people around you that you’re referring to? do you have a pen-pal in Weimar-era Germany who you’re communicating with through a time portal? or are you talking with other people who have the same news diet as you do and forming a self-reinforcing worldview?