alt Hacker NewsDamned if you do, damned if you don't. Do you prefer they not engage in helping finding vulns at all? Do you not think there are parts of the company interested in security and doing it for the sake of that?
I feel like taking every action these companies take as part of some larger strategy is kind of conspiracy-minded.
Replies
Disclaimer: I work as a sec engineer and part of my job includes finding vulnerabilities.
I think the effort is misplaced. We should be exploring ways to make our systems more resilient and I would expect those companies* to focus on that front. Vulnerability research is important, and we should aim to remove as many bugs as we can from our codebases but the pace of software development is increasing and so is the introduction of new bugs.
* I would also expect an increase on relevant research regarding novel paradigms of securing systems.
Why didn't OAI go back to non-profit again?
Where's the conspiracy. There is no moat. The technology is easily reproducible. Deepseek unwound an entire business model yesterday.
This is a false binary. There are a range of other options. They could voluntarily log every action with a clear warning that users are financially and criminally liable for use of AI. The company could convert to a partnership like law firms and investment banks used to be so that the executives are personally liable for harm their products cause. Hard to imagine they would be as flippant with risk if they would lose everything in the event of a Cyber attack. We could set up a parallel internet for AI that is physically separate from human internet and limit ai to text messages with all tool execution on the sandboxed internet.
I could give 15 more examples of things that could be done other than “make the world use our tools to patch software”.