GrapheneOS imposes a set of restrictions on how generative AI can be used in our project and community. It isn't forbidden but rather we imposed rules based on actual issues.
Posts made in our forum, chat rooms, issue tracker and the rest of our project must be written by humans. There's an exception from this rule for translation and accessibility features. That means commit messages, pull request messages, bug reports and feature requests are expected to be written by humans, not a machine.
Replying to @GrapheneOS@grapheneos.social
@GrapheneOS for an OS project that refused porting to non-PIxel h/w for so long b/c other platforms didn't meet security reqs, this pro-LLM stance is ludicrous.
~all bugs found by LLMs can likely be found by other methods using the same-or-less compute resources, especially w/ the human effort "babysitting" the LLMs to ensure they don't go off the rails.
there just aren't billionaire fascists subsidizing that compute, be honest about it.
stop covering + doing PR-by-action for LLM fascists
Replying to @elle@weathered-steel.social
"for an OS project that refused porting to non-PIxel h/w for so long b/c other platforms didn't meet security reqs, this pro-LLM stance is ludicrous."
Read or reread the thread; it might prevent you from responding with inaccuracies, but I think you did it on purpose.
Replying to @Xtreix@infosec.exchange
@Xtreix ? care to elaborate?
before you make accusations about me intentionally misinterpreting things
Replying to @elle@weathered-steel.social
"It also definitely isn't useful to do it with a free or cheap model available without either paying for it or running it on very expensive hardware"
sounds like pretty explicit, "if you're not using proprietary AI models, don't bother" AKA PR propaganda for those firms from a big-name project in the FOSS space. one that up-to-now, has a shining record for security + privacy.
@GrapheneOS have you really explored all alternatives to these models for surfacing security issues?
Replying to @elle@weathered-steel.social
"sounds like pretty explicit, "if you're not using proprietary AI models, don't bother" AKA PR propaganda for those firms from a big-name project in the FOSS space"
No, that's not the case. GrapheneOS hasn't suddenly become pro-LLM and isn't promoting big AI companies, those are the false claims you're making.
Replying to @Xtreix@infosec.exchange
"Frontier models are very good at finding bugs but it requires an experienced developer to babysit it and extract the useful portion of the output."
"The volume of real vulnerabilities being found this way ... is quite scary"
Sounds pretty pro-LLM to me. "oooo big LLM so scawy, definitely couldn't find the same bugs with equivalent compute using non-LLM tools"
the majority of bugs haven't been triaged, ones that have are shallow(-ish). this is part of the PR hypecycle
Replying to @elle@weathered-steel.social
Relaying the reality of the situation that AI review has helped find vulnerabilities that evaded human examination does not somehow make GrapheneOS pro-AI. They dont like it. I dont like it. You dont like it. But the alternative is either lying or doing nothing. Would you rather them lie to us? What they said is objectively true. It sounds like you want them to conceal this from us and/or leave vulnerabilities unpatched.
Replying to @HybridStaticAnimate@infosec.exchange
> It sounds like you want them to conceal this from us and/or leave vulnerabilities unpatched
what a strange interpretation of "bugs could be found w/ non-LLM tools using equivalent compute".
also, of course they should fix any legit bugs. does that mean they need to come out defending big-tech LLMs as "the only tools that could have found these bugs" (effectively doing PR for those companies)?
does it mean they need to use the LLMs for code gen?
@Xtreix@infosec.exchange @GrapheneOS
Replying to @elle@weathered-steel.social
"Can" is irrelevant. Any bug can be found with sufficient time, but attackers are using tools that find them faster, and find vulns that humans missed. Fixating on the "can" part ignores the nuance, like how *quickly* and how *many* vulns are being discovered with these tools. If this can be done without AI, why was it not done already? Why has attacker and defender discovery of exploits accelerated exponentially? There is no substance behind the claim this was achievable with other tools.
The objective reality of how these tools work and how effective they are is not a "defense" of LLMs and GrapheneOS is not doing PR for them. For them to say something different would be a lie and to not say anything at all would be concealing information.
GrapheneOS has already said any code made with AI still needs to be understood fully by the person submitting it, and it needs to meet code quality requirements. An LLM alone is not capable of meeting these standards and a developer needs to know what the code is doing, how, and why.
Replying to @HybridStaticAnimate@infosec.exchange
> If this can be done without AI, why was it not done already?
b/c there wasn't a multi-billion dollar, VC-funded campaign to subsidize the compute required to use other techniques?
what's the closest equivalent, OSS-fuzz from Google? also, open models, even frontier-grade, exist if you insist on using LLMs. why aren't those being utilized? why choose the ones specifically attempting to garner good PR by getting FOSS projects to use their shit?
Replying to @elle@weathered-steel.social
There arent OSS equivalents. They are months behind. They are still useful, yes, but the ones they are using are currently more effective. This isnt some kind of ad, they picked the most effective tool for the job and they will pick a different one if another becomes more effective.
Replying to @HybridStaticAnimate@infosec.exchange
@HybridStaticAnimate @GrapheneOS hmm let me check:
- being "months" behind still doing useful bug finding
- being "cutting-edge" and supporting fascists actively destroying the world for oligarchical benefit
which to choose, which to choose...
Replying to @elle@weathered-steel.social
We, "in the business", call this a false dichotomy.
Replying to @HybridStaticAnimate@infosec.exchange
no, those are the true "dichotomous" solutions that are in the same arena.
frontier-grade, open-weight LLMs that are some relatively small degree behind the proprietary models created by fascist war criminals.
you can obfuscate, and run defense for this all you want: that is the choice you or anyone else is making.
there are legit situations where there is no alternative. this ain't one. there is a viable alternative that is only slightly sub-optimal.