AI is finding security bugs faster than maintainers can fix them.
I want to disagree with the entire premise on a technical basis.
Wouldnt it be more costly, in terms of tokens, either local or service provided, to analyze a code base and exploit the vulnerability remotely, than it would for a maintainer of said code, to analyze their code base and issue a patch ?
They should both have equal analysis capabilities. Playing field seems level there.
Exploiting is surely more costly than patching ?
Couldn't a well funded repo entity like github just do this by default, in the background, and send a notice to the maintainer of every single repo ?
3 comments
[ 0.21 ms ] story [ 20.9 ms ] threadI want to disagree with the entire premise on a technical basis.
Wouldnt it be more costly, in terms of tokens, either local or service provided, to analyze a code base and exploit the vulnerability remotely, than it would for a maintainer of said code, to analyze their code base and issue a patch ?
They should both have equal analysis capabilities. Playing field seems level there.
Exploiting is surely more costly than patching ?
Couldn't a well funded repo entity like github just do this by default, in the background, and send a notice to the maintainer of every single repo ?