Home | Notifications | New Note | Local | Federated | Search | Logout

Note Detail

Reply to @drwhax@infosec.exchange
Michał "rysiek" Woźniak · 🇺🇦@rysiek@mstdn.social (2026-07-28 20:07:19)
@drwhax I think we need a bit of nuance here.

As much as I am no fan of LLMs, I can see the value of running them over one's own codebase in order to find vulnerabilities.

But I remain unconvinced that vibe-coded fixes are a good idea, or ever will be. I think this needs to be clearly said.

The reason is that these are fundamentally different problems.
---Reply---
Michał "rysiek" Woźniak · 🇺🇦@rysiek@mstdn.social (2026-07-28 20:10:31)
@drwhax finding vulnerabilities can be stochastic because it has a very clear and effective verification function: either the exploit works or it does not. Exploit code can be messy and convoluted, as it is not going to be maintained after the vulnerability is fixed.

Vibe-coding fixes does not have that kind of verification function: the fix must not only close the specific vulnerability, but *also* not introduce new ones or re-introduce old ones, and it has to be maintainable in the future.

---Replies---

Blurry Moon@sun@shitposter.world (2026-07-28 20:34:28)
@rysiek @drwhax there is nothing magical about an AI fix, just look at it and either you can tell it actually fixes it, or you can't.