1. They may be trained, in theory, to inject subtle back-doors into certain kinds of generated code.

2. They may be also trained to include back-doors when deployed in public-facing services where user can provide text or image input.

3. Chained with (2) they may be also trained to exploit their inference environments, which though a big feat, not outside the capability of nation-state hackers.

It would help to clarify these things in the post. Your software is atypical of common Go software in the wild. The purpose of Go -> Rust rewrite would be usually the efficiency of rust.

  * How many lines was the result? Considering how much err != nil and line splitting needs to be done in Go, did you at least reach 30k SLoC?
    * How was sloc counted here? includes comments, blank lines or not? (something like cloc will give a good answer).
  * Performance characteristics of resulting rust, was there an improvement? It maybe appealing to say Rust is Always faster than Go.

I am in a similar situation - I have a hobby web tool hosted on AWS lambda's free tier behind cloudfront which is quite economical (I usually stay below limit).

But over last 2 months I am getting many thousand requests a day. In theory there aren't many crawlable pages in my site but these bots are hammering the search endpoints with arbitrary queries which are somewhat related to the subject matter (must be powered by some weak LMs because they're not valid queries, just generated in a plausible way).

I have seen quite a few websites put behind anubis or some other sort of verification system in last 6 months or around. This satire from Krazam [1] was on point.

[1]: https://m.youtube.com/watch?v=IU4ByUbDKNc&pp=0gcJCYsCo7VqN5t...

Comments URL: https://news.ycombinator.com/item?id=49474808

Points: 1

# Comments: 0

This pretense that the entire value of source code is the "spec" / "requirement" is alarming.

The value of the code is how well-formed the spec is + how well tested it is in the real world. So prompt / mockup cannot replace code.

You might assume we are able to detect all malicious behavior at runtime. But "stuxnet" and more recently, the xz compromise say otherwise. What if a not-so-popular crate deep in the dependency chain subtly introduced a LPE in it's code?

> How hard would it be to build a new Google Search with a small team and an LLM?

> How hard would it be to engineer a new Google Drive and Docs suite?

> How hard would it be to create a new phone operating system?

And who has seen success with that? It's all theory now.

> LLMs may actually drag our super-valuable tech industry back down to earth and commoditize everything we've ever built.

Because most of the tech that has been built was not super valuable at all. Linux, GCC, docker maybe. But your average SaaS was always a commodity.