Comment on A dummy's request for Nepenthes

• ShortN0te@lemmy.ml ⁨6⁩ ⁨days⁩ ago

  But still, how would verify if the config is good or not? For example if it exposes root?

  source

  • theunknownmuncher@lemmy.world ⁨6⁩ ⁨days⁩ ago

    Yeah I’m not saying its perfect and LLMs are non-deterministic so it could give you some crap. How do you verify some random stranger from the internet wasn’t an asshole and gave you malicious config? 🤷 The best answer is probably just that OP should heed the warning on the website the linked, if they have no confidence or relevant skills:

    THIS IS DELIBERATELY MALICIOUS SOFTWARE INTENDED TO CAUSE HARMFUL ACTIVITY. DO NOT DEPLOY IF YOU AREN’T FULLY COMFORTABLE WITH WHAT YOU ARE DOING.

    source

    • ShortN0te@lemmy.ml ⁨5⁩ ⁨days⁩ ago

      Yeah I’m not saying its perfect and LLMs are non-deterministic so it could give you some crap. You’re not wrong and it’s good to be aware of that. How do you verify some random stranger from the internet wasn’t an asshole and gave you malicious config? 🤷

      There is no guarantee either, but on a public forum at least a couple of eyes look at it too. Not saying that this makes it trust worthy. But a LLM usually words it output very direct and saying “this is the absolut truth” which can lead to a much higher trust relation then a stranger on a forum that writes “maybe try this”.

      I generelly would not recommend using the llm for potential security related questions (or important or professionally questions) were your own knowledge is not big enough to quickly vet the output.

      source
  • irmadlad@lemmy.world ⁨5⁩ ⁨days⁩ ago

    You could (should?) run it on a test server/VPS before committing anything to production. I have a little VPS set up just for this purpose. Spin something up on it and observe.

    source

    • ShortN0te@lemmy.ml ⁨5⁩ ⁨days⁩ ago

      You are still talking about someone that is not able to create the config themself, but that someone should be able to test everything?

      source
• irmadlad@lemmy.world ⁨6⁩ ⁨days⁩ ago

  and it doesn’t help that corpos insist on cramming LLMs into usecases that aren’t applicable to LLMs at all

  I am reminded of back in the late 60s to 70s we did a lot of studies on left handed people and our kneejerk reaction to try and change their dominant hand. We decided that left handed people were absolutely normal, leave them be and stop stressing out adolescents by trying to make them ‘normal’, because they already are. BTW the practice of changing dominant hands goes all the way back to the Catholic church during the middle ages. Anyways, when corporate America heard the news, they started producing all manner of left handed tools, which was helpful, but their motivation was $$. Same with LGBTQ+++. Corporate America capitalized on every aspect.

  However, if you plunk down your hard earned money for an AI rice cooker, you’re the idiot and P.T. Barnum would be right once again.

  source

  • theunknownmuncher@lemmy.world ⁨6⁩ ⁨days⁩ ago

    I think the feeling is the same, but the cause is a bit different. It is more similar to the dot-com bubble, where investors (for some reason?) are hyped to throw their money into AI. So if you can market yourself as AI, you can get big investments. Now that you have all that investor cash, you need to justify it somehow by using AI somewhere, anywhere.

    source

    • irmadlad@lemmy.world ⁨6⁩ ⁨days⁩ ago

      I’ve dealt with VC back when I ran an internet radio station. There is pressure to incorporate their wishes, because, well, they want an ROI on their investment.

      source