Post by @Merovius@chaos.social
Let me be advocata diaboli here:
AI is the democratic equalizer, that lifts the general IT crowd to the level of (malicious) state actors and it doesn’t wait to be invited to the party by anybody.
How wrong is that pov?
@AwetTesfaiesus@mastodon.social
Ich versuche, die Rolle von KI bei #php2shell einzuordnen. Ist es das Fieber oder das Fieberthermometer?
Mir scheint: letzteres.
Liege ich falsch?
@AwetTesfaiesus Given that running it requires compute and compute costs money, I would say pretty wrong.
@Merovius that I don’t understand. Compute and money seems to be exactly what state actors have plenty of
@AwetTesfaiesus Huh? Yes, that is exactly my point. AI is not a "democratic equalizer", because for that, everyone would need to have the same access to it. I could never run, say, a frontier model on all of GitHub. A state actor can. So I'm clearly not lifted to the level of a state actor.
1 boost
@Merovius but someone ran it and it was brought to the public eye. So what used to be state only privilege is now in the public domain.
@AwetTesfaiesus But that access isn't equal. Someone could've read the code previously and found a vulnerability. The only thing privileging state actors was that they can use a lot more eyeballs. Now you can use compute. State actors remain privileged, because they have a lot more compute.
AI is definitionally a technology to replace labor with capital. The idea that it's "democratizing" is oxymoronic on the face of it.
@Merovius it seems to be beside the point but: newspapers have to be bought, too.
Maybe put it this way: it serves a purpose in the democratic realm
@AwetTesfaiesus Yes and what happens when news gets put under the control of capital, we are all observing right now.
Again, the *point* of AI is to centralize power. The space is controlled by like three companies in a trenchcoat. Controlling investments comparable to NATOs military spending. It's baffling to me, how one can look at that and think "democracy".
@Merovius I can see the point you are making.
Still: in this particular case, isn’t AI the thermometer, rather then the fever.
@AwetTesfaiesus I don't understand the analogy. What's supposed to be the fever that AI is the thermometer for? Because if anything, I would consider it the disease *causing* the fever.
@Merovius I assume that flawed code is the disease and that AI (at least in this case) merely measures the code‘s quality
@AwetTesfaiesus That *might* be true today (I'm not sure it is) but I certainly don't think it'll be true in five years. I mean, everybody in the industry *knows* all existing code is bad. And *right now* there are enough low-hanging fruit that you can find high-profile problems with comparatively low resource usage.
In five years, all devices will still be vulnerable, but exploiting that will require "auditing" too much code to be feasible for most people.
@AwetTesfaiesus@mastodon.social @Merovius@chaos.social no, it’s in the domain of the likes of OpenAI, google, anthropic. The public domain can’t afford it. We see a shift from state actors to a very few tech companies.
@docwhozee @Merovius granted. But in this particular instance: the news is packed with it. Everyone updates their servers now. Couldn’t possibly/ be more in the public domain.
Remember: not that long ago, the news used to be the public domain
@AwetTesfaiesus @docwhozee Heartbleed was also in the news. I don't understand the argument. And no, not "everyone updates their servers now". The percentage of actually fixed websites will be pretty low. The overwhelming majority of people affected won't even know their website uses PHP, even if they hear about it.
@Merovius @docwhozee chasing the tail now.
From: all servers are open to state actors via this flaw.
To: … many are not.
Wrong?
@AwetTesfaiesus @docwhozee Oh at this point right now, I would say definitely wrong. Every server (except *maybe* the ones from the hyperscalers) is almost definitely open to state actors right now. I would bet almost any amount that any intelligence agency worth its salt has a zero day for Linux.