HybridStaticAnimate

@elle @GrapheneOS

We, "in the business", call this a false dichotomy.

@elle @GrapheneOS

There arent OSS equivalents. They are months behind. They are still useful, yes, but the ones they are using are currently more effective. This isnt some kind of ad, they picked the most effective tool for the job and they will pick a different one if another becomes more effective.

@elle @GrapheneOS

"Can" is irrelevant. Any bug can be found with sufficient time, but attackers are using tools that find them faster, and find vulns that humans missed. Fixating on the "can" part ignores the nuance, like how *quickly* and how *many* vulns are being discovered with these tools. If this can be done without AI, why was it not done already? Why has attacker and defender discovery of exploits accelerated exponentially? There is no substance behind the claim this was achievable with other tools.

The objective reality of how these tools work and how effective they are is not a "defense" of LLMs and GrapheneOS is not doing PR for them. For them to say something different would be a lie and to not say anything at all would be concealing information.

GrapheneOS has already said any code made with AI still needs to be understood fully by the person submitting it, and it needs to meet code quality requirements. An LLM alone is not capable of meeting these standards and a developer needs to know what the code is doing, how, and why.

@elle @GrapheneOS

It... does not have those symbols. We have been using this technology for decades. It only took off recently because there is enough processing power to handle bigger tasks (even if those tasks are generating slop, people chose to make it do that, which is an abuse of the technology). The greater issues with AI were bound to happen with something else if AI did not take off. The issues are far deeper, socially, economically, politically, and AI is a symptom of it.

The tool is just a tool, not associated with any negative imagery. Its abuse is purely the product of humans, and GrapheneOS is using it to achieve some good.

Dont get me wrong, I am incredibly anti AI, and I would rather GOS locally host and run these models, but that will take time.

@elle @GrapheneOS

It finds exploits that were otherwise unknown, which can then be patched. If they can be found and exploited by attackers, they can be found and patched by defenders. Youre asking them why they would dare to use a hammer for a nail when hammers are used to hurt people all the time.

@synnfynn @GrapheneOS

The AI catches things most have not caught. Thats why there is a huge influx of linux CVEs that werent known about for decades. This isnt something you can throw money and people at and assume it will work to the same extent.

@bekkaboo @GrapheneOS

The base audience is people seeking privacy, security, and usability. They promised to uphold this mission and not using tools that help find exploits would be counter to this mission. They are doing exactly what they promised their users they would do, even if they dont like it.

@lattera @GrapheneOS

Then you need to stop using AOSP, chromium, linux, and much more. GrapheneOS is only using it officially for code review and employed contractors must understand what they are submitting, how it works, why it works, and what it solves.

@elle @Xtreix @GrapheneOS

Relaying the reality of the situation that AI review has helped find vulnerabilities that evaded human examination does not somehow make GrapheneOS pro-AI. They dont like it. I dont like it. You dont like it. But the alternative is either lying or doing nothing. Would you rather them lie to us? What they said is objectively true. It sounds like you want them to conceal this from us and/or leave vulnerabilities unpatched.

@elle @GrapheneOS

The hardware security requirements GrapheneOS has for device support has nothing to do with this. GrapheneOS is a privacy, security, and usability project. The requirements for device support and using AI code review to find exploits both serve to further these goals.