Comment on: SQLite Critical CVEs or LLM Slop?
> LLMs are text-prediction engines. They are not Artificial Intelligence, and shouldn’t not be treated in any form or fashion as if they possess intelligence.I agree that humans must verify LLM-produced facts, but strongly disagree with these kinds of "stochastic parrot therefore dumb" arguments.Yes, an LLM is a "stochastic parrot". No, that doesn't imply that it is dumb. Enough to look at how Terence Tao asks ChatGPT to help him understand a solution that nobody had ever discussed before [1], or how a random guy asks ChatGPT in a handful of words to disprove a 30-year-old conjecture, with zer
Comment on: SQLite Critical CVEs or LLM Slop?
> If you take an even closer look- what exactly does that mean?Here is one example: "Critical Vulnerability Exclusion
We will not pay you under the cyber and data risks section of cover where your legal liability or any loss that you suffer arises from a cyber attack that exploits a critical vulnerability within your computer equipment.
However this exclusion will only apply where a patch or fix for any critical vulnerability exploited has been available for 21 days prior to the date of the incident and has not been applied to your computer equipment.
Critical Vulnerability m
Comment on: SQLite Critical CVEs or LLM Slop?
The point is you can not trust that people patch stuff like this in time. So practically you have to make it really hard, in a CTF of course it is easy. Defense is in depth. There are architectural issues, e.g. we only allow one upload per instance., and sanitation is done away from initial upload handling and processing. I would say that even local root is not that bad if you play your cards correctly. (What ever root mean nowdays with CAP dropping etc)Enterprise security can be good if people are paranoid when they build the infra, but as is highlighted in this thread many patch requirements