Comment Re:LLM driven security is a scam (Score 1) 7
I do know about the increase in CVEs. But since I have some actual understanding of the matter, I can see it is NOT a good thing. LLMs massively advantage attackers, while helping defenders very little.
And, quite frankly, some of these newly found vulnerabilities are just the result of shoddy coding and no tool use. For example, use-after-free is NOT something that only an LLM or manual review finds. It is not something that is even exploitable with reasonable coding practices. Even frigging plain GCC has an option for finding these days. But people have no clue how to use it, apparently and no clue how to write secure and robust code. So, for a time, LLMs will find vulnerabilities that should have been found before by other tools, but that will die down. Except for attackers, that can ask for vulnerabilities in code in a million different ways (which the defenders cannot do) and that need to find just one (while the defenders need to find all of them).