Nope. The problem here is that YOU cannot read.

You do know that insults where the other side has strong proof they are not true do not work, right? Well, probably that is already beyond you. This is Kindergarten level though and not flattering for you. You may at least want to try to be a bit original, not completely dumb in your attempts to insult. This is just boring.

Ah, yes, the last defense of the mentally incapable: "Academics know nothing!". In actual reality it is almost always academics that brought an area to the level where it actually became possible to "do".

Nope, except occasionally by accident. They find things like use-after-free, which is so simple even "gcc -fanalyzer" finds them. LLMs cannot do complex reasoning. And that means they cannot generally find complex bugs. Your believe in magic does not change actual reality.

You also seem to be confused as to what "complex" means. It does not mean "unusual" and it does not mean "esoteric". It means "requires a complex reasoning chain" and LLMs cannot generally do those.

I mostly agree, although it will be bugs found by humans that remain. In highly visible software, humans still find a lot more than even the "frontier" models. And they find _different_ problems. LLMs cannot do logical reasoning. That limits what they can find and the fake reasoning they use instead has very limited reasoning depth. The same limit is not present ins smart humans. (Dumb ones, like the cult-of-the-LLM members, have the same limitation....)

The second thing that will likely happen is that software security will be taken a lot more serious and secure-by-construction will become a thing, because anything insecure will get exploited fast now. The bottleneck of not enough time on the attacker side is mostly gone. And attackers do not need reliability or security or maintainability in attack code. They can also very easily test whether attack code works, at least if they do not care about possibly being detected. That is the most common situation.

And that is the problem here. While LLMs generally do not find complex bugs, they find simple bugs that humans have somehow overlooked. (Yes, that is a thing.) And for the black-hats they can do that fast. Even worse is the situation that LLMs can generate (crappy) exploit code from patches. Crappy exploit code still works. With high security requirements (as a kernel has), you want to patch even non-exploitable things fast now, because they could become exploitable later and then you run into this new patching problem. As Kernels generally practice defense-in-dept, having situations were security mechanisms are broken, but the whole thing is not exploitable because of redundancy, is a common situation.

1. That is not what I wrote. A simple mind could mistake it for that though.
2. What is true is that LLMs generally only find simple bugs. I have actual research on this.

There is ignorance and then there is ignorance. You have the second kind.

One reason I run my own kernels is that the module system is a vulnerable spot. Hence I run monolithic kernels. Has saved me a couple of times from having to patch fast. Not that big a thing, but the effort is low.

Indeed. Also, LLMs are completely unsuitable to do a full code review. They miss a lot of critical things.

Seriously, have you read what I wrote? Something can be a security problem and NOT be exploitable.

Smoking and alcohol are primarily banned for children because they do A LOT more damage in children. For example, smoking before you are 16 or so has significant lifelong negative effects. If you smoke as an adult, and then stop, after a few years the effects are gone. Similar effects for alcohol. Similar effects for weed. Nobody knows for social media.

This is a teensy bit more complicated.

Your problem is that you are "full of shit". Since you cannot see that, you dump on others pointing things out that are inconsistent with your misconceptions. You also massively oversimplify things and hence do not see what is actually going on. Common mistake.

For reference, I teach this stuff to a larger number of students, many with professional experience, every semester. And there is an evaluation every semester. Seriously, I KNOW where I stand. You do not.

No, I meant there may not be known exploits. Using an LLM does not change that. The thing is, many potential security bugs are really "risks" and it is not clear whether they are exploitable. May require special circumstances that are unknown. May actually be prevented by something else, but that something else can break in the future. May require a race-condition with really low probability and that is only there on some hardware. May not be exploitable at all, but better be careful. In a kernel, defensive coding and redundant security ("defense in depth") is critical.

Nope. The illusion just got better. The computing power did not. Stop believing in magic.

You do understand what "intentional" means, right?