It seems the tag was missing, I assume,
but as shown by many companies and open source projects, agents with the right prompts are much better at finding security problems than 99% of developers (for various reasons).
Many devoted fans of AI like comparing LLMs to compilers for higher-level programming languages.
They argue that just as programmers once wrote ASM and C, the arrival of Java and Python meant you no longer had to be a neckbearded autistic kid to write software that doesn't leak memory or segfault.
Arguments like this show me you’ve never done software engineering seriously.
Despite compilers (written by some of the smartest engineers on Earth) trying hard to prevent developers from writing shitty software, those new age "engineers" still managed to ship software that crashes, leaks, and generally sucks.
I'm not saying this email client is not secure (although I'd bet 5$, it is). But it seems beyond silly to assume software is automatically safe just because a new piece of tech can potentially find vulnerabilities. Intent still matters. And the 99% would never have the intent to write secure software.
> I'm not saying this email client is not secure (although I'd bet 5$, it is). But it seems beyond silly to assume software is automatically safe just because a new piece of tech can potentially find vulnerabilities. Intent still matters. And the 99% would never have the intent to write secure software.
Hard agree, especially the apparent 99% of AI boosters on HN who seem to basically only care about shipping arbitrary products as fast as possible and skipping the whole middle part where someone sweaty person is grinding through the details intimately, all day, and while they should be sleeping.
At my last place, it was a battle to convince the narcissistic idiot CTO and even one of our senior engineers (both in age and experience) that it was important to encrypt customer data before it transited through third-party cloud service providers. People don't—and aren't incentivized—to give the slightest shit about quality, security, you name it.
> People don't—and aren't incentivized—to give the slightest shit about quality, security, you name it.
This normally happens on two scenarios: a) they are not paid enough to care that much or b) they are paid more than enough to not have to care that much.
Either way it’s almost always down to how much the company is willing to pay for people that actually care about these things.
It's not about the pay, it's about the expectations. Turnout time and business outcomes are the expectation. Pay me an amount I'll accept (modest) and I'll give as many shits as I can, unless the expectation is that I'm doing things on a wildly compressed timeline where a checkmark is more important than data leak that might never come up. I care as long as I'm not punished for doing so.
Half the security stuff AI seems to "find" for me have been complete fabrications, with the other half that it says is "critical", but has actually been so minor that you'd basically have to have access to my own computer to "hack it". So, yes, it is much better at findings issues, too bad most of it seems to be made up.
