points by orangecat 1 day ago | 0 comments
No LLMs for finding bugs.
As of late 2026, this is gross negligence and any project with such a policy should be assumed to have a variety of easily exploitable vulnerabilities.
[–] handoflixue 1 day ago
[–] ghostpepper 1 day ago
> I don't really care if someone can chain together zero-day exploits to "pwn" my lightbulbs.
The point of pwning your lightbulb is not to decide whether it's bright or dark in your house. It's valuable as a residential proxy with a good IP reputation, to be sold to the highest bidder who wants to do something they don't want traced to their own IP.
A lot of the recent major exploits like php2shell require a fair amount of effort to use, so unless you're a major public figure or holding on to something very valuable, there's not a lot of reason to be concerned.
Obviously, if you're writing a password manager, it's a very different story and I'd be horrified by such a policy there. But you've got to make an argument that this specific app is actually a target