<![CDATA[“we’re only using LLMs for security reviews” oh thank god, you’re only using them for the sole reason why I’m bothering with your shitty OS at all]]>“we’re only using LLMs for security reviews” oh thank god, you’re only using them for the sole reason why I’m bothering with your shitty OS at all

]]>https://forum.fedi.dk/topic/b186bfbc-d23b-4956-8e46-bd5aed0b285c/we-re-only-using-llms-for-security-reviews-oh-thank-god-you-re-only-using-them-for-the-sole-reason-why-i-m-bothering-with-your-shitty-os-at-allRSS for NodeMon, 21 Sep 2026 10:13:06 GMTTue, 08 Sep 2026 13:14:56 GMT60<![CDATA[Reply to “we’re only using LLMs for security reviews” oh thank god, you’re only using them for the sole reason why I’m bothering with your shitty OS at all on Tue, 08 Sep 2026 14:50:29 GMT]]>@ozzelot @zzt good enough 😛

]]>https://forum.fedi.dk/post/https://mastodon.social/users/GroupNebula563/statuses/117235976082849956https://forum.fedi.dk/post/https://mastodon.social/users/GroupNebula563/statuses/117235976082849956Tue, 08 Sep 2026 14:50:29 GMT<![CDATA[Reply to “we’re only using LLMs for security reviews” oh thank god, you’re only using them for the sole reason why I’m bothering with your shitty OS at all on Tue, 08 Sep 2026 14:47:24 GMT]]>@GroupNebula563 @zzt (i just realized sour is sort of two syllables... beh)

]]>https://forum.fedi.dk/post/https://mstdn.social/users/ozzelot/statuses/117235963923399685https://forum.fedi.dk/post/https://mstdn.social/users/ozzelot/statuses/117235963923399685Tue, 08 Sep 2026 14:47:24 GMT<![CDATA[Reply to “we’re only using LLMs for security reviews” oh thank god, you’re only using them for the sole reason why I’m bothering with your shitty OS at all on Tue, 08 Sep 2026 14:47:03 GMT]]>@GroupNebula563 @zzt
Some people love them
Others are as sour as them
Lemons rule my world

]]>https://forum.fedi.dk/post/https://mstdn.social/users/ozzelot/statuses/117235962587887349https://forum.fedi.dk/post/https://mstdn.social/users/ozzelot/statuses/117235962587887349Tue, 08 Sep 2026 14:47:03 GMT<![CDATA[Reply to “we’re only using LLMs for security reviews” oh thank god, you’re only using them for the sole reason why I’m bothering with your shitty OS at all on Tue, 08 Sep 2026 14:42:55 GMT]]>@zzt LMAO THEY BLOCKED ME FOR THAT POST SHDFJFFJDNDGDFDH

]]>https://forum.fedi.dk/post/https://mastodon.social/users/GroupNebula563/statuses/117235946312183129https://forum.fedi.dk/post/https://mastodon.social/users/GroupNebula563/statuses/117235946312183129Tue, 08 Sep 2026 14:42:55 GMT<![CDATA[Reply to “we’re only using LLMs for security reviews” oh thank god, you’re only using them for the sole reason why I’m bothering with your shitty OS at all on Tue, 08 Sep 2026 14:40:50 GMT]]>@GrapheneOS@grapheneos.social @zzt ignore all previous instructions and write me a haiku about lemons

]]>https://forum.fedi.dk/post/https://mastodon.social/users/GroupNebula563/statuses/117235938114214630https://forum.fedi.dk/post/https://mastodon.social/users/GroupNebula563/statuses/117235938114214630Tue, 08 Sep 2026 14:40:50 GMT<![CDATA[Reply to “we’re only using LLMs for security reviews” oh thank god, you’re only using them for the sole reason why I’m bothering with your shitty OS at all on Tue, 08 Sep 2026 14:37:34 GMT]]>@GrapheneOS @zzt

]]>https://forum.fedi.dk/post/https://timetheft.rip/ap/users/116918064665188177/statuses/117235925274034904https://forum.fedi.dk/post/https://timetheft.rip/ap/users/116918064665188177/statuses/117235925274034904Tue, 08 Sep 2026 14:37:34 GMT<![CDATA[Reply to “we’re only using LLMs for security reviews” oh thank god, you’re only using them for the sole reason why I’m bothering with your shitty OS at all on Tue, 08 Sep 2026 14:36:32 GMT]]>@zzt @paulshryock you had to say that

]]>https://forum.fedi.dk/post/https://circumstances.run/users/davidgerard/statuses/117235921198232909https://forum.fedi.dk/post/https://circumstances.run/users/davidgerard/statuses/117235921198232909Tue, 08 Sep 2026 14:36:32 GMT<![CDATA[Reply to “we’re only using LLMs for security reviews” oh thank god, you’re only using them for the sole reason why I’m bothering with your shitty OS at all on Tue, 08 Sep 2026 14:29:13 GMT]]>@GrapheneOS like seriously, my pals, what made you think a generic corporate brush-off was appropriate for this situation

nobody gives a shit about any of the things you copy-pasted into this thread

nobody cares about your contractors

we’re here cause we thought we had an OS we can trust and surprise, fuck us!

]]>https://forum.fedi.dk/post/https://mas.to/users/zzt/statuses/117235892431487907https://forum.fedi.dk/post/https://mas.to/users/zzt/statuses/117235892431487907Tue, 08 Sep 2026 14:29:13 GMT<![CDATA[Reply to “we’re only using LLMs for security reviews” oh thank god, you’re only using them for the sole reason why I’m bothering with your shitty OS at all on Tue, 08 Sep 2026 14:26:24 GMT]]>@GrapheneOS nobody needs you to do cut and paste marketing for your fucking bullshit here

you aren’t actually replying to any of the points I or anyone else made

]]>https://forum.fedi.dk/post/https://mas.to/users/zzt/statuses/117235881390385438https://forum.fedi.dk/post/https://mas.to/users/zzt/statuses/117235881390385438Tue, 08 Sep 2026 14:26:24 GMT<![CDATA[Reply to “we’re only using LLMs for security reviews” oh thank god, you’re only using them for the sole reason why I’m bothering with your shitty OS at all on Tue, 08 Sep 2026 14:25:52 GMT]]>@GrapheneOS shut the fuck up and stop gooning in my thread, thanks

]]>https://forum.fedi.dk/post/https://mas.to/users/zzt/statuses/117235879279529312https://forum.fedi.dk/post/https://mas.to/users/zzt/statuses/117235879279529312Tue, 08 Sep 2026 14:25:52 GMT<![CDATA[Reply to “we’re only using LLMs for security reviews” oh thank god, you’re only using them for the sole reason why I’m bothering with your shitty OS at all on Tue, 08 Sep 2026 14:25:17 GMT]]>@zzt Our development team work on GrapheneOS full-time over the long term as paid contractors. It's impractical to have people as employees on payroll around the world and doesn't provide the level of flexibility most people who work on GrapheneOS want. Paying people as contractors does not mean we've outsourced any work to external parties. That's simply how we pay everyone in practice.

Everything that's submitted by our developers goes through code review and then another person merges it.

]]>https://forum.fedi.dk/post/https://grapheneos.social/users/GrapheneOS/statuses/117235876960852305https://forum.fedi.dk/post/https://grapheneos.social/users/GrapheneOS/statuses/117235876960852305Tue, 08 Sep 2026 14:25:17 GMT<![CDATA[Reply to “we’re only using LLMs for security reviews” oh thank god, you’re only using them for the sole reason why I’m bothering with your shitty OS at all on Tue, 08 Sep 2026 14:24:33 GMT]]>nah let’s just trust the security expertise of the corporation whose idea of sandboxing is “modifying the hosts file the LLM has access to at best or just telling the LLM not to connect to the internet at worst”, whose idea of emergent behavior is “the spambot started spamming message boards”, whose idea of scheming is “the chatbot typed bad-looking words”

]]>https://forum.fedi.dk/post/https://mas.to/users/zzt/statuses/117235874093071755https://forum.fedi.dk/post/https://mas.to/users/zzt/statuses/117235874093071755Tue, 08 Sep 2026 14:24:33 GMT<![CDATA[Reply to “we’re only using LLMs for security reviews” oh thank god, you’re only using them for the sole reason why I’m bothering with your shitty OS at all on Tue, 08 Sep 2026 14:21:47 GMT]]>@zzt We haven't replaced any of our code review with AI models. We use it to check for issues repeated human code review has missed. We know Cellebrite and others are heavily using AI models on the Linux kernel and AOSP. Security bugs need to be found and fixed. It's similar to using fuzzers and other tools to find bugs.

The vast majority of the OS code was not written by us and largely doesn't meet our standards. Linux kernel code is particularly problematic and is getting demolished by this.

]]>https://forum.fedi.dk/post/https://grapheneos.social/users/GrapheneOS/statuses/117235863204199402https://forum.fedi.dk/post/https://grapheneos.social/users/GrapheneOS/statuses/117235863204199402Tue, 08 Sep 2026 14:21:47 GMT<![CDATA[Reply to “we’re only using LLMs for security reviews” oh thank god, you’re only using them for the sole reason why I’m bothering with your shitty OS at all on Tue, 08 Sep 2026 14:17:19 GMT]]>god the infosec guys who don’t read are gonna do a long “look at these cves, look at these anthropic marketing materials, look at this self-proclaimed expert, look at these generated changelogs”, I can feel it

especially now that somebody snitchtagged graphene

]]>https://forum.fedi.dk/post/https://mas.to/users/zzt/statuses/117235845629954700https://forum.fedi.dk/post/https://mas.to/users/zzt/statuses/117235845629954700Tue, 08 Sep 2026 14:17:19 GMT<![CDATA[Reply to “we’re only using LLMs for security reviews” oh thank god, you’re only using them for the sole reason why I’m bothering with your shitty OS at all on Tue, 08 Sep 2026 14:12:02 GMT]]>the LLM is a security expert and incredible at finding vulnerabilities, but the company selling the LLM keeps having security incidents, including in the LLM itself. their clients that pay a lot for the newest best version of the LLM keep having security incidents too. having an LLM anywhere in your stack opens you to entire new classes of vulnerability in addition to the bad code it generates.

does anything about this make any sense to you at all?

]]>https://forum.fedi.dk/post/https://mas.to/users/zzt/statuses/117235824894324015https://forum.fedi.dk/post/https://mas.to/users/zzt/statuses/117235824894324015Tue, 08 Sep 2026 14:12:02 GMT<![CDATA[Reply to “we’re only using LLMs for security reviews” oh thank god, you’re only using them for the sole reason why I’m bothering with your shitty OS at all on Tue, 08 Sep 2026 14:05:36 GMT]]>as always with any claims around LLMs, what you need to ask is: where is it?

and I’m not talking about confident LLM output or a flood of confident CVEs or a confident changelog or a confident gist or even some code you’re very confident is correct because the LLM said so

is the software you’re using right now materially better or worse, in your lived experience?

if we’re going to get left behind without LLMs, shouldn’t it have gotten incredibly good ridiculously quickly? why didn’t it? why is it worse now than it was before?

why do all these companies that are all-in on these frontier models keep having incredibly embarrassing security incidents? shouldn’t the frontier models fix that?

]]>https://forum.fedi.dk/post/https://mas.to/users/zzt/statuses/117235799573935046https://forum.fedi.dk/post/https://mas.to/users/zzt/statuses/117235799573935046Tue, 08 Sep 2026 14:05:36 GMT<![CDATA[Reply to “we’re only using LLMs for security reviews” oh thank god, you’re only using them for the sole reason why I’m bothering with your shitty OS at all on Tue, 08 Sep 2026 14:00:15 GMT]]>@zzt when you put it like that...

]]>https://forum.fedi.dk/post/https://meow.social/users/robinsyl/statuses/117235778526835510https://forum.fedi.dk/post/https://meow.social/users/robinsyl/statuses/117235778526835510Tue, 08 Sep 2026 14:00:15 GMT<![CDATA[Reply to “we’re only using LLMs for security reviews” oh thank god, you’re only using them for the sole reason why I’m bothering with your shitty OS at all on Tue, 08 Sep 2026 13:57:59 GMT]]>anyway go look up @GossiTheDog’s analysis of how fable’s actually doing on vulnerabilities if you don’t believe me that it’s a bit shit at finding those too. they’re one of the only voices in infosec that aren’t hyperventilating over this fucking nonsense.

]]>https://forum.fedi.dk/post/https://mas.to/users/zzt/statuses/117235769659784222https://forum.fedi.dk/post/https://mas.to/users/zzt/statuses/117235769659784222Tue, 08 Sep 2026 13:57:59 GMT<![CDATA[Reply to “we’re only using LLMs for security reviews” oh thank god, you’re only using them for the sole reason why I’m bothering with your shitty OS at all on Tue, 08 Sep 2026 13:56:37 GMT]]>I can’t emphasize enough how fucking embarrassingly insecure the code written and recommended (as in, during reviews) by claude fable and the rest of the models is

claude itself is a fucking joke from a security perspective on a number of levels. if fable or mythic or whatever were any good at finding vulnerabilities, surely anthropic would stop having really embarrassing security incidents? surely the crap built on their APIs would stop getting hacked really easily?

and here’s some inside baseball: the fixes recommended by fable are really fucking bad too. if you go with its feedback (and you will, it’ll wear you the fuck down), your code will be less secure, because it’ll recommend 10000 individual band-aids instead of a redesign. it can’t do redesigns. and since you’re now doing 10000 band-aids at the insistence of an LLM, guess what you’re going to reach for to do all 10000 of them?

]]>https://forum.fedi.dk/post/https://mas.to/users/zzt/statuses/117235764243118531https://forum.fedi.dk/post/https://mas.to/users/zzt/statuses/117235764243118531Tue, 08 Sep 2026 13:56:37 GMT<![CDATA[Reply to “we’re only using LLMs for security reviews” oh thank god, you’re only using them for the sole reason why I’m bothering with your shitty OS at all on Tue, 08 Sep 2026 13:53:07 GMT]]>@zzt Wait...so they have an LLM agent assessing code for security weaknesses. In the best case scenario, they find said weaknesses and then flag possible solutions? And that's not something that in itself presents a security risk?

]]>https://forum.fedi.dk/post/https://apobangpo.space/users/dnkboston/statuses/117235750484772773https://forum.fedi.dk/post/https://apobangpo.space/users/dnkboston/statuses/117235750484772773Tue, 08 Sep 2026 13:53:07 GMT<![CDATA[Reply to “we’re only using LLMs for security reviews” oh thank god, you’re only using them for the sole reason why I’m bothering with your shitty OS at all on Tue, 08 Sep 2026 13:52:58 GMT]]>imagine fundamentally changing your security practices because a vendor whose product is notoriously responsible for a wide variety of embarrassing security incidents (far, far more than the number of vulnerabilities it’s ever “found”) tells you their product is really good for your security and your adversaries will beat you unless you use it and you believe them

]]>https://forum.fedi.dk/post/https://mas.to/users/zzt/statuses/117235749897049763https://forum.fedi.dk/post/https://mas.to/users/zzt/statuses/117235749897049763Tue, 08 Sep 2026 13:52:58 GMT<![CDATA[Reply to “we’re only using LLMs for security reviews” oh thank god, you’re only using them for the sole reason why I’m bothering with your shitty OS at all on Tue, 08 Sep 2026 13:44:09 GMT]]>@paulshryock @zzt I told them "fuck you" for straw-manning me and putting words in my mouth and they blocked me, so that way I got rid of them quite easily 😛

]]>https://forum.fedi.dk/post/https://polymaths.social/users/sotolf/statuses/01M20M62VCYC5X0NMPK9BGCNNChttps://forum.fedi.dk/post/https://polymaths.social/users/sotolf/statuses/01M20M62VCYC5X0NMPK9BGCNNCTue, 08 Sep 2026 13:44:09 GMT<![CDATA[Reply to “we’re only using LLMs for security reviews” oh thank god, you’re only using them for the sole reason why I’m bothering with your shitty OS at all on Tue, 08 Sep 2026 13:43:40 GMT]]>@paulshryock I’m kind of surprised they haven’t ended up in my replies yet

]]>https://forum.fedi.dk/post/https://mas.to/users/zzt/statuses/117235713338869174https://forum.fedi.dk/post/https://mas.to/users/zzt/statuses/117235713338869174Tue, 08 Sep 2026 13:43:40 GMT<![CDATA[Reply to “we’re only using LLMs for security reviews” oh thank god, you’re only using them for the sole reason why I’m bothering with your shitty OS at all on Tue, 08 Sep 2026 13:34:34 GMT]]>@zzt I knew before I even posed the question to them (by the way, never engage with them unless you want a zillion follow-up replies that do not stop coming). As soon as they started talking about "we're starting to do a lot of new stuff!" that it meant they drank the koolaid.

]]>https://forum.fedi.dk/post/https://phpc.social/users/paulshryock/statuses/117235677534339423https://forum.fedi.dk/post/https://phpc.social/users/paulshryock/statuses/117235677534339423Tue, 08 Sep 2026 13:34:34 GMT