Comment by refulgentis

Comment by refulgentis a day ago

2 replies

I don't mean to aggravate you. I do mean to offer some insight in the mindset of the people the person I was replying to was puzzled by. I'm calmed by the fact that if we're both here, we both value one of the HN sayings I'm very fond of: come with curiosity.

> Do you believe AI is at the core of these security analyzers?

Yes.

> If so, why the personal story blogpost?

When I am feeling intensely, and people respond to me as I'm about to respond to you, I usually get very frustrated. Apologies in advance if you suffer from that same part of being human, I don't mean anything about you or your positions by this:

I don't know what you mean.

Thus, I may be answering wrong with the following: the person I replied to indicated all downvoters must know every detail, and as the, well lets use your phrasing, personal story blogpost, I just assume you mean my comment, leads with: "I believe there's a little more going on than everyone knowing every detail already, or presumably, being wrong to downvote. Full case study of a downvoter at work:"

> Claiming to work for Google

I claimed the opposite! I'm a jobless hack :) (quit in 2023)

> does not work as an authority card for me,

Looking at it, the thing isn't "I worked at Google therefore AI good" it's "I worked at Google and on a specific well-known project, the company's design language, used AI pre-ChatGPT to great effect. It's unclear to me why this use case would be unbelievable years later"

> you still have to deliver a solid argument.

What are we arguing? :) (I'm serious! Apologies, again, if it comes off as flippant. If you mean I need to deliver a solid argument the tools must have AI, I assume if said details were available you would have found them, you seem well-considered and curious. I meant to explain the mind of a downvoter who yet cannot recite details as yet unavailable to the public to the person I replied to, not to verify the workflow step by step.)

alganet a day ago

The argument is that these high-quality security analyzers seem to use AI as a triage mechanism, and the quality of the analysis is still capped by the quality of the static analysis tool.

One of the tools provide a whitepaper, that you can read here:

https://corgea.com/blog/whitepaper-blast-ai-powered-sast-sca...

It seems to explicitly put AI in this coadjuvant role, contradicting the HN title "found by AI".

Neither me or the other commenter actually dismissed AI as useless. I can't speak for him, but to me, it seems actually useful in this arrangement. However, not "I'll pay for a subscription" levels of useful.

Since it's just triage, it seems that trying to reproduce the idea using free tools might be worth a shot (and that's the idea of finding out where the AI component lies in the system). What I said is very doable (plug the output of traditional tools into vanilla coding LLMs prompts). It also looks a lot like this Corgea schematic:

https://framerusercontent.com/images/EtFkxLjT1Ou2UTPACObJbR2...

I mean, it's very brave to explain a downvote, but in this case, it seems that you missed the opportunity to make sense.

  • [removed] 8 hours ago
    [deleted]