You wouldn’t want him using a local model unless he was running some fancy rig that could run a high end frontier model. He might not have such a thing laying around. Using the best out there for something like this is how you help avoid bugs.
He definitely can afford it yes, but its still a big ask to want someone to spend 15-25k or whatever it would be (shits getting more expensive by the day) to use a tool that he can just do pay per use. The code is open source so its not like he’d be using a local llm to keep it private.
He’s doing it though. So that’s kind or moot. Fable is out there finding bugs in these things, so seems like if he is going to do it, using the thing that’s already making it more secure by finding multiple exploits is the right choice of what to use.
Ehh, that’s debatable. An LLM will gladly spit out a vulnerability report, but as LLMs lack any understanding or reasoning capability, there’s literally nothing guaranteeing that it has any semblance in fact or reality. They are just random text generators after all.
Going by Anthropic’s own numbers for things like Mythos, it “found” 29,439 vulnerabilities, when a human actually checked if the reports made any sense (ignoring validity) that dropped to around 6,200 reports, when they were tested for validity that further dropped to around 1,300 reports, and when it came time to actually patch the issues only 516 made the cut (i.e. the rest might have been issues, but weren’t considered exploitable, etc.).
516 out of 29,439 is a 1.75% success rate, not exactly groundbreaking.
Now to be fair, according to Greg KH at a recent talk, Mythos is seemingly improving. Of 79 vulnerabilities it reported, a solid 4 were real. That’s a 5% success rate, though it performed much better when it simply reported other developers bug fixes, something it did 11 times.
And how many security vulnerabilities have you found? 516 is still a lot. One of those had been in the Linux kernal for decades.
Edit: and many of those real ones from the 6000 group anthropic says the maintainers just didn’t want to fix as it was outside their threat model. A vulnerability in the Linux kernal, is different than one on an alarm clock app or something less serious.
If the models all go up in smoke, we still have the code (and its bugs) - so let’s get as many bugs out as possible as soon as possible and not accept a bunch of garbage code - as has always been the case, it’s just happening faster now.
Trainers (all over the world) are behaving badly, because they can get away with it. I’m not sure where that ends up, but it doesn’t change the generated code or the discovered vulnerabilities or the fixes.
The personal data has been abused for decades already, but again - now it’s easier for more actors to abuse your personal data and mine. Maybe, someday, we’ll get serious about enforcing privacy policies and not just have completely toothless theater about it.
Keep it up. I’m in Floriduh so talking to our representatives is more or less like talking to a brick wall. They may accumulate counts of how many people raise an issue, but for the most part they’re serving the federal administration’s agenda, not listening to their constituents.
People have to audit that shit to make it serviceable, which greats bigger workloads
I mostly ignored LLM code generation until around August of 2025 - it was still pretty raw back then, but it was showing potential for significant improvement, and since then there has been significant improvement. At this point, I find that if I ride herd on the LLM agent and keep it focused, structured, addressing technical debt frequently, etc. I can actually review the generated code more quickly and easily than similarly mature code by human developers. What is coming out of models like Opus 5.5 now is looking like what I would write if I had all the time in the world to cover all the edge cases, handle all the errors, do the logging and auditing and all the other “good stuff”. It does explode the code for what was a simple “happy path” thing into a much larger structure that takes the real world problems into account and gets in front of them, handling them gracefully and presenting clear messages about what went wrong when unavoidable problems happen.
I guess what I’m saying is: yeah, we’re still getting more code to review, but it’s getting easier to review and the presence of meaningful automated tests and consistent documentation and non-rotten traceability from requirements through all that is actually resulting in lower overall workloads once you look at the big picture of what it takes to maintain code in the real world with security and other issues and not just the happy insecure proof of concept and ship it world.
Breaking the spirit of mostly volunteers with such inexpertly crafted code is just not the best idea.
Yeah, if your models are giving you inexpertly crafted code, you need to keep iterating with them until it’s expertly crafted before shipping it, don’t just throw up a pull request because some bogus tests passed. And, there’s still a difference among models - they’ve all improved rather dramatically over the last 12 months, but for my purposes (coding robust, secure, safe applications) Claude’s Opus and Sonnet are still “in the lead” by a pretty good margin. Other models are better at other things…
Trainers do act badly because they weren’t regulated to hell and back
There’s not enough transparency or accountability in the global business landscape for any kind of regulation to actually work. If these regulations are going to have any chance, the first step has to be true transparency - like FOSS does with open source development repositories, and more.
people paid for their data or compensated for hammering personal websites.
Keep dreaming. It would be a wonderful world, but it’s far from where we are.
said models can be made to reproduce phrases
Like English majors can quote Keats after graduation… I’m not sure that’s proof of plagarism in their other writing.
an absolute morally compromised fool
Yeah, it’s been an interesting ride this cycle - seems like they’re trying to tear down the government institutions in preparation for something like Palpatine disbanding the Senate… destroy all confidence by blowing up every problem of the past and flaunting it as something actively done at the highest levels. If they succeed in holding power through the upcoming mid-terms the ride is only going to get more interesting…
LLMs should be used for their original purpose: Processing language, not used to generate code. Coding should stay a human activity.
That ability to see the patterns in language, particularly the ability to distill semantic meaning and make (reasonable, if imperfect) translations from one language to a variety of others, is incredibly useful in software development activities, which are basically the task of translating natural language requests into code - usually through a multi-step process of: requirements definition, design specification, application development, test development, and constant review to ensure that all those steps are in-sync, describing the same thing.
continuing to invest in humans
Always.
teaching the craft in ways that help get new programmers up to speed faster.
I’m tempted to make a “better buggy whip maker” crack here…
Anthropic literally trained on copyrighted material without permission and could be prompted to produce author’s material. It’s a bit different than a Student quoting an author.
Yeah, so Anthropic didn’t pay for legitimate textbooks when they went to school, they bought cheap, illegal, Asian photocopies instead… wrong, sure. How do you make it right now? Lobotomize the students who read illegally copied books? Fine their parents for everything they are worth? Or, hold the students liable and garnish their wages in perpetuity?
I’d definitely like someone to champion an open-weights model under 32 GB. But part of that desire is - I’m not sure they’re there, yet. Local models are only a few months behind, but hoo boy, the last few months have been big.
Coding models could be tiny, but distilled versions keep preserving pop-culture knowledge and world history, when reasoning through C++ requires essentially none of that. It needs the tokenization to recognize why a comment begins “Jesus Christ.” It’s fine for “treat the hash like Lot’s wife” to go completely over its head. Keep the weights that know a regex for e-mails, not the capitol of Florida. If it speaks a dead language I want it to be Algol.
deleted by creator
You wouldn’t want him using a local model unless he was running some fancy rig that could run a high end frontier model. He might not have such a thing laying around. Using the best out there for something like this is how you help avoid bugs.
He gets paid more than enough to afford high end hardware.
He definitely can afford it yes, but its still a big ask to want someone to spend 15-25k or whatever it would be (shits getting more expensive by the day) to use a tool that he can just do pay per use. The code is open source so its not like he’d be using a local llm to keep it private.
Wendell from Level1Techs built Greg KH a monster rig for free, I’m sure they’d be willing to build one for Linus too.
Dang, wish someone would build me one for free! Thats super cool of them though!
AMD Ryzen Threadripper 9960X
GIGABYTE TRX50 AERO D Motherboard
Samsung SSD 9100 PRO 2TB SSD
Noctua NH-U14S TR5-SP6 Cooler
Intel Arc B580 GPU
Fractal Design Torrent E-ATX Case
Seasonic PRIME TX-1600 1600W 80+
Titanium PSU
ASUS ProArt Display PA32QCV 31.5" 6K
HDR Monitor
deleted by creator
He’s doing it though. So that’s kind or moot. Fable is out there finding bugs in these things, so seems like if he is going to do it, using the thing that’s already making it more secure by finding multiple exploits is the right choice of what to use.
Ehh, that’s debatable. An LLM will gladly spit out a vulnerability report, but as LLMs lack any understanding or reasoning capability, there’s literally nothing guaranteeing that it has any semblance in fact or reality. They are just random text generators after all.
Going by Anthropic’s own numbers for things like Mythos, it “found” 29,439 vulnerabilities, when a human actually checked if the reports made any sense (ignoring validity) that dropped to around 6,200 reports, when they were tested for validity that further dropped to around 1,300 reports, and when it came time to actually patch the issues only 516 made the cut (i.e. the rest might have been issues, but weren’t considered exploitable, etc.).
516 out of 29,439 is a 1.75% success rate, not exactly groundbreaking.
Now to be fair, according to Greg KH at a recent talk, Mythos is seemingly improving. Of 79 vulnerabilities it reported, a solid 4 were real. That’s a 5% success rate, though it performed much better when it simply reported other developers bug fixes, something it did 11 times.
And how many security vulnerabilities have you found? 516 is still a lot. One of those had been in the Linux kernal for decades.
Edit: and many of those real ones from the 6000 group anthropic says the maintainers just didn’t want to fix as it was outside their threat model. A vulnerability in the Linux kernal, is different than one on an alarm clock app or something less serious.
Less with LLMs than without. https://projectdiscovery.io/blog/the-vulnerability-curve-bent-with-the-ai-curve https://www.darpa.mil/news/2025/aixcc-results
deleted by creator
If the models all go up in smoke, we still have the code (and its bugs) - so let’s get as many bugs out as possible as soon as possible and not accept a bunch of garbage code - as has always been the case, it’s just happening faster now.
Trainers (all over the world) are behaving badly, because they can get away with it. I’m not sure where that ends up, but it doesn’t change the generated code or the discovered vulnerabilities or the fixes.
The personal data has been abused for decades already, but again - now it’s easier for more actors to abuse your personal data and mine. Maybe, someday, we’ll get serious about enforcing privacy policies and not just have completely toothless theater about it.
deleted by creator
Keep it up. I’m in Floriduh so talking to our representatives is more or less like talking to a brick wall. They may accumulate counts of how many people raise an issue, but for the most part they’re serving the federal administration’s agenda, not listening to their constituents.
I mostly ignored LLM code generation until around August of 2025 - it was still pretty raw back then, but it was showing potential for significant improvement, and since then there has been significant improvement. At this point, I find that if I ride herd on the LLM agent and keep it focused, structured, addressing technical debt frequently, etc. I can actually review the generated code more quickly and easily than similarly mature code by human developers. What is coming out of models like Opus 5.5 now is looking like what I would write if I had all the time in the world to cover all the edge cases, handle all the errors, do the logging and auditing and all the other “good stuff”. It does explode the code for what was a simple “happy path” thing into a much larger structure that takes the real world problems into account and gets in front of them, handling them gracefully and presenting clear messages about what went wrong when unavoidable problems happen.
I guess what I’m saying is: yeah, we’re still getting more code to review, but it’s getting easier to review and the presence of meaningful automated tests and consistent documentation and non-rotten traceability from requirements through all that is actually resulting in lower overall workloads once you look at the big picture of what it takes to maintain code in the real world with security and other issues and not just the happy insecure proof of concept and ship it world.
Yeah, if your models are giving you inexpertly crafted code, you need to keep iterating with them until it’s expertly crafted before shipping it, don’t just throw up a pull request because some bogus tests passed. And, there’s still a difference among models - they’ve all improved rather dramatically over the last 12 months, but for my purposes (coding robust, secure, safe applications) Claude’s Opus and Sonnet are still “in the lead” by a pretty good margin. Other models are better at other things…
There’s not enough transparency or accountability in the global business landscape for any kind of regulation to actually work. If these regulations are going to have any chance, the first step has to be true transparency - like FOSS does with open source development repositories, and more.
Keep dreaming. It would be a wonderful world, but it’s far from where we are.
Like English majors can quote Keats after graduation… I’m not sure that’s proof of plagarism in their other writing.
Yeah, it’s been an interesting ride this cycle - seems like they’re trying to tear down the government institutions in preparation for something like Palpatine disbanding the Senate… destroy all confidence by blowing up every problem of the past and flaunting it as something actively done at the highest levels. If they succeed in holding power through the upcoming mid-terms the ride is only going to get more interesting…
deleted by creator
That ability to see the patterns in language, particularly the ability to distill semantic meaning and make (reasonable, if imperfect) translations from one language to a variety of others, is incredibly useful in software development activities, which are basically the task of translating natural language requests into code - usually through a multi-step process of: requirements definition, design specification, application development, test development, and constant review to ensure that all those steps are in-sync, describing the same thing.
Always.
I’m tempted to make a “better buggy whip maker” crack here…
Yeah, so Anthropic didn’t pay for legitimate textbooks when they went to school, they bought cheap, illegal, Asian photocopies instead… wrong, sure. How do you make it right now? Lobotomize the students who read illegally copied books? Fine their parents for everything they are worth? Or, hold the students liable and garnish their wages in perpetuity?
Yep…
deleted by creator
I’d definitely like someone to champion an open-weights model under 32 GB. But part of that desire is - I’m not sure they’re there, yet. Local models are only a few months behind, but hoo boy, the last few months have been big.
Coding models could be tiny, but distilled versions keep preserving pop-culture knowledge and world history, when reasoning through C++ requires essentially none of that. It needs the tokenization to recognize why a comment begins “Jesus Christ.” It’s fine for “treat the hash like Lot’s wife” to go completely over its head. Keep the weights that know a regex for e-mails, not the capitol of Florida. If it speaks a dead language I want it to be Algol.