oxydite

Damn, dunno why I've always assumed that if something gets a CVE, then some authority has reproduced and verified it.

Shouldn't it be CNA's job? Why would anything get a number if it hadn't been verified?

Well... I can image incentives like health/survival/independence in case of war or other cataclysm. But this is pretty drastic, nothing else comes to mind though

And it makes sense. If you publish some state-of-the-art algorithm then you're basically helping your competition, and you don't get anything back from them. So you publish bare minimum in small articles on your website, only to gain people's/investors' interest, and just hope that you didn't share too much. And it'll always be like that, unless the root cause changes - intentives. And the main incentives right now are money and power.

Please tell me then how ridiculous my post is. I wanna hear that - that's why I posted this. Your comment did literally nothing useful except bumping your own ego.

> You literally did not take 5 minutes to even start Yes you're exactly right - you can guess that from reading my post. But you're hitting the wrong topic there. Seems like you didn't understand what I asked.

But let me elaborate on that. Why would I take >5 minutes to start reading each report I see on the web? Like all humans I have limited capacity of information I can effectively gather so I'm not gonna start reading each article 24/7.

Topic was interesting, got many upvotes, so I opened the report. I saw there a bunch of LLM-generated paragraphs, got mixed feelings and just closed it. I mean just see the beginning "A measured, reproducible teardown. Findings are backed by captured artifacts (endpoint, HTTP method, status code, byte size, host) and repro commands; where an observation was seen live but not retained as a file, §7 says so explicitly.". When I see something like that I immediately lose motivation to read that.

I wonder how many of you guys actually read this kind of reports (or even skim through)? At the first glance it looks to me like someone just asked an agent for a security review of this CLI and then pasted results to the gist.

When I see a report like that I just assume it's a low-effort AI slop and stop reading immediately. Why would I read it since I can do the same with my agent and with that understand it better? Or if I'm really lazy then just copy paste this report and ask for a summary or have a discussion.