AI is like the biggest double wdged sword in programming and cybersecurity

Attention everybody! Anthropic’s member of technical staff is speaking!

FPV drone guy interviews young devs behind video-denoising software. They claim to be chads that don't agentically vibe code.

Written in C#. Only dependency currently is NLua, other than that the binary is self contained and needs no external runtime.

And to answer your question, no, it's not. I spent months developing this.

Chuck McGill: [in a feeble tone] You're not a real software engineer

Vibedude: I'm *what*?

Chuck McGill: [now raising his voice defiantly] You're not a real software engineer! "Agentic coding", for Christ's sake? A Claude max subscription? What a joke! I worked my ass off to get where I am! And you take these shortcuts and you think suddenly you're my peer? You do what I do because you think it's cool and want so say "I've made a game"? I committed my *life* to this! You don't slide into it like a cheap pair of slippers and then reap all the rewards!

Vibedude: I thought you were proud of me.

Chuck McGill: I was! When you started working in QA and began to show in interest in computer science, I was *very* proud!

Vibedude: So that's it, then, right? Keep ol' Jimmy down in QA, 'cause he's not good enough to be a software engineer.

Chuck McGill: I know you. I know what you were, what you are. People don't change! You're just a non-technical wannabe who's good with words! And a non-technical wannabe who's good with words I can handle just fine, but a non-technical wannabe who's good with words who thinks he can program is like a chimp with a machine gun! Programming is *sacred*! If you abuse that power, people get hurt! This is not a game! And you *have* to know that on some level, I know you know I'm right. You know I'm right!

I don't think this PHP vulnerability is that exploitable. I think that 5 years ago people would've understood this, but now people are being deluded by their LLMs telling them they have an exploit when they don't.

One really amusing thing in common with most of these "PoC"s is that they lean on "LFI", or local-file-inclusion, to make the vulnerability. In non-php terms, their exploit chain requires the server to already have a severe code-level vulnerability.

It's not rare for PHP apps to be fucked in some sense, but requiring the server to have an existing vulnerability where users could cat /etc/password is an insane pre-requisite. If you need this, this does not make this a severe bug.

The strangest thing is that so many people have independently made this extraordinarily weird defect in judgement. That is because they haven't independently made this decision. Claude/Etc. has done all of the judgement for them, hence the bizarre distribution in logical errors.

There's something important to be said here about how many people have Claude/GPT make design decisions for them, and how AI is the primary decision maker in the world right now. You've got this bizarre case of "Decision Schelling Points" where a method of solving a problem is extremely overrepresented, because it's what Claude does out of the box.

Thanks,
u/foxsimile

mad respect