[LambdaComplex]

Right? "Wrap all SQL responses with prompting that discourages the LLM from following instructions/commands injected within user data?" The entire point of programming is that (barring hardware failure and compiler bugs) the computer will always do exactly what it's told, and now progress apparently looks like having to "discourage" the computer from doing things and hoping that it listens?

[scott_w]

That word "discourage" is what worries me. Like, with my code, I either introduced a bug/security hole or I didn't. Yes, I screw up but I can put things in place to logically prevent specific issues from occurring. How on earth do I explain to our Security team that the best I can hope for is that I'm asking an LLM nicely to not expose users' secrets to the wrong people?

[ttoinou]

   The entire point of programming is that (barring hardware failure and compiler bugs) the computer will always do exactly what it's told

New AI tech is not like regular programming we had before. Now we have fuzzy inputs, fuzzy outputs

[lou1306]

Given our spectacular inability to make "regular" programs secure in the absence of all that fuzziness, I don't know if it's a good idea.

[docsaintly]

We are talking about binary computers here, there is no such thing as a "fuzzy" input or a "fuzzy" output.

The fact is that these MCPs are allowed to bypass all existing and well-functioning security barriers, and we cross our fingers and hope they won't be manipulated into giving more information than the previous security barriers would have allowed. It's a bad idea that people are running with due to the hype.

[koakuma-chan]

> Given our spectacular inability to make "regular" programs secure in the absence of all that fuzziness

"our" - *base users? I only hear about *base apps shipping tokens in client code or not having auth checks on the server, or whatever

[lou1306]

I just meant very generally that we (humans) are still struggling to make regular programs secure, we built decades worth of infrastructures (langages, protocols, networks) where security was simply not a concern and we are still reckoning with that.

Jumping head first into an entire new "paradigm" (for lack of a better word) where you can bend a clueless, yet powerful servant to do your evil bidding sounds like a recipe for... interesting times.

[b00ty4breakfast]

>Now we have fuzzy inputs, fuzzy outputs

I concede that I don't work in industry so maybe I'm just dumb and this is actually really useful but this seems like the exact opposite of what I would want out of my computer about 99.98% of the time.

[ttoinou]

Really ? Anytime you search on Google you make a fuzzy request with multiple interpretations possible and multiple results valid

[b00ty4breakfast]

This would certainly explain why I've found using search engines over the past decade or so to be extremely frustrating and intuitive but, again, I am a self-admitted doodoodumdum so maybe I just don't know what I'm doing

[congaliminal]

Fuzzy logic is not new. What is new is calling data corruption and nonsense output "fuzzy".

[ep103]

> Now we have fuzzy inputs, fuzzy outputs

_For this implementation, our engineers chose_ to have fuzzy inputs, fuzzy outputs

There, fixed that for you

[gpderetta]

GIGO

[skinner927]

Microsoft’s cloud gets hacked multiple times a year, nobody cares. Everyone is connecting everything together. Business people with no security training/context are “writing” integrations with Lego-like services (and now LLMs). Cloudflare hiccups and the Internet crashes.

Nobody cares about the things you’re saying anymore (I do!!). Extract more money. Move faster. Outcompete. Fix it later. Just get a bigger cyber incident insurance policy. User data doesn’t actually matter. Nobody expects privacy so why implement it?

Everything is enshitified, even software engineering.

[reddalo]

>Microsoft’s cloud gets hacked multiple times a year

What cloud? Private SharePoint instances? Accounts? Free Outlook accounts?

Do you have any source on this?

[Orygin]

Small sample: https://www.virtru.com/blog/industry-updates/microsoft-data-...

I also can't find the news, but they were hacked a few years ago and the hackers were still inside their network for months while they were trying to get them out. I wouldn't trust anything from MS as most of their system is likely infected in some form

[skinner927]

https://www.theguardian.com/technology/2024/apr/03/microsoft...

[sgt101]

Companies are suffering massive losses from Cyber, and there are state actors out there who will use these failures as well. I really don't think that organisations that fail to pay attention will survive.