Hacker Newsnew | past | comments | ask | show | jobs | submit | nickpsecurity's commentslogin

They're great at Python and Javascript which have lots of tooling. My idea was to make X-to-safe-lang translators, X initially being Python and Javascript. Let the tools keep generating what they're good at. The simpler translators make it safe and fast.

If translated to C or Java, we can use decades worth of tools for static analysis and test generation. While in Python and Javascript, it's easier to analyze and live debug by humans.

Multiple wins if the translators can be built.


> My idea was to make X-to-safe-lang translators, X initially being Python and Javascript.

Both of those languages are already safe. Then you talk about translating to C, so you're actually doing a safe-to-unsafe translation. I'm not sure what properties you're checking with the static analysis at that point. I think what would be more important is that your translator maintains safety.


You've never seen the full power of static analysis, dynamic analysis, and test generation. The best examples were always silo'd, academic codebases. If they were combined, and matured, the results would be amazing. I wanted to do that back when I was in INFOSEC.

That doesn't even account for lightweight, formal methods. SPARK Ada, Jahob verification system with its many solvers, Design ny Contract, LLM's spitting this stuff out from human descriptions, type systems like Rust's, etc. Speed run (AI) producing those with unsafe stuff checked by the combo of tools I already described.


Silo’d, academic codebases are not under the kind of attacks that commodity software is

The silo'd codebases I was referring to are verification tools they produce. They're used to prevent attacks. Each tool has one or more capabilities others lack. If combined, they'd catch many problems.

Examples: KLEE test generator; combinatorial or path-bases testing; CPAChecker; race detectors for concurrency; SIF information flow control; symbolic execution; Why3 verifier which commercial tools already build on.


"Each lacks capabilities" is not a strong sell for "together they can catch most problems".

Also, synthetic data and templates to help them discover new vulnerabilities or make agents work on things they're bad at. They differentiate with their prompts or specialist models.

Also, like ForAllSecure's Mayhem, I think they can differentiate on automatic patching that's reliable and secure. Maybe test generation, too, that does full coverage. They become drive by verification and validation specialists who also fix your stuff for you.


I feel like this is actually human-like but like the average human in the pretraining data. Let's look:

1. They reward short or under-developed essays. I'd say most online content, especially with high upvotes next to the post, fits that. Social media surely does.

2. If it's longer posts, the system starts nitpicking it on minor details, like grammar. We see this even on Hacker News, a community valuing quality, with some longer submissions. It's also a debate tactic to derail opponents' better arguments in many discussions which are in their pretraining data.

3. Essays with more praise get higher scores and with more criticism get lower scores. "Get on the Bandwagon" Effect. Echo chambers. One person writes a thing followed by 5-20 people confirming it. That's probably in the pretraining data. It might survive some filtering/cleaning strategies, too.

So, no, I think these AI's are acting way too human. They need to fine-tune them to act like more, reasonable humans. That will initially take RLHF data for many types of situations. Given pretraining bias, they might also have to train them to drop the bad habits the article mentions.


School-type long essays only seem to exist in academia. I took a "business communication" class in college and we didn't write essays. My life experience since then has supported the "no essays" conclusion.

A long comment online now means either two things: it's written by a crank who has strong opinions, usually only tangentially related; or someone who has deep knowledge about the subject and has a lot of detail to provide. It's usually the former.


I agree with you on how their quality is spread out. But, this...

"School-type long essays only seem to exist in academia."

Does an AI know what an essay is? Would it consider any long, descriptive post an essay? Especially if pretraining data has many people describing long posts as essays or "essay-like?" Or only actual essays? And what is an actual essay again?

I think AI's might have different interpretations due to the above questions. They might also conflate essays with longer, detailed, or argumentative posts. We'd have to put a bunch of posts into a bunch of AI's to ask how they classify them.


That we're building theories on what's left of mostly-trashed data has scientific implications. Most people hearing LHC proved something probably didn't think a preprocessor threw away most observations first. That layer of interpretation could cause errors.

I wonder how much independent review went into that step.


It's a discussion forum. Saying people are all wrong with no proof comes off as arrogant but isn't helpful. If you have links to examples, you can simply say, "Here's some prior art or previous work in this area you all might like."

People would probably upvote that.


Christians usually only believe in God, angels, humans, and animals. That would mean intelligent UFO's might be angels or demons. While that's speculation, one guy did an interesting test of it.

Non-believers are much more vulnerable to demonic activity than believers. There's also a goal where distracting them from Christ is all they nerd to stay on the road to Hell. So, UFO sightings should be much higher in areas with non-believers than areas with Christians. He shared his data here:

https://web.archive.org/web/20220521004104/https://www.godan...

(Note: I haven't peer reviewed his methodology.)


Nah, they like to lay on the laptop to eliminate their competition. They want all our attention.

Says a biased source selling AI code generators. He's also a liar because he knows many of us reject it due to principles, preferences, to stay mentally sharp, increased legal accountability for suppliers, or avoiding lawbreaking (eg copyrighted works in pretraining).

While I'd use legal AI's, I'll still be writing plenty of code by hand. Most or all if it in some projects. Double true if an inaccuracy or legal dispute would taint the outputs and maybe what they're mixed into.


Those made without agentic tooling are still better. So I don't know that what you said is true in practice even if I agree on its potential.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: