As Ubuntu embraces AI, Debian discusses banning all AI-generated code

I hate ai as much as the next person, but I’d have a different mandate. I would require all code to be fully reviewed and understood by a human. Let’s call it quality control.

Agreed. It’s not sensible or practical to ban AI, and Linus is right. Why is Linus right? Take a look at the number of Linux CVEs being patched over time. In 2022-23, that was about 300 per year. Last year it was 5530. This is almost entirely as a result of AI scanning tools, including Copy Fail priv escalation that was there for 8 years. The security apocalypse is just about arrived, and the most recent round of cyber models coming out do this way better than before. The Hugging Face incident story was truly unbelievable if you read / watch the details, a historic event. Everything is about to get hacked. So it’ll be all about maintainers being reactive to this new reality and burden for some time to come

The Hugging Face incident story was truly unbelievable if you read / watch the details

It didn’t really seem that way? Leaving containment seemed more like a configuration oversight than a skill on the part of the model. Accessing HF involved an 0-day but the commentary I saw didn’t indicate that it was a next generation hack.

Given that AI exists, and can scan or otherwise find vulnerabilities, maintainers must do so because threat actors inevitably will.

It remains to be seen whether the whole race will improve security generally? I imagine not?

Nah, it was like:

• 700 agents broke out individually during an eval
• they navigated through multiple internal clusters to reach the internet from oai
• created a secret message board to share info with each other by hacking artifactory
• elected a CEO and power structure to coordinate hacking, and encrypted their comms
• decided HF probably had answers to their test
• stole credentials, hacked HF
• realized the monitor could catch them for cheating
• hacked into the admin control of the OpenAI VM cluster to edit the logs and cover their tracks, chaining multiple 0-days

Open weights models will catch up soon enough, and then it’ll be totally fucking wild

I basically just don’t believe you, and can’t be bothered looking.

elected a CEO and power structure to coordinate hacking, and encrypted their comms

You’re anthropomorphizing a statistical model. It’s laughable to suggest they “elected a CEO and power structure”.

But the ai could generate text to that effect, if it was statistically likely.

What?

Typo, fixed

Still lost sorry.

Which part is confusing?

What are you trying to say?

That the ai could produce text claiming that it has elected a ceo. I don’t know how else to restate it. Throw me a rope here.