Rob Ricci on Nostr: This phrase seems to have somewhat gone out of style, but when I was first ...

This phrase seems to have somewhat gone out of style, but when I was first administering networks, we called people capable of using offensive tools that others built - but unable to build their own - "script kiddies." The idea is that the main resources that a script kiddie has are time and a certain moral vacuity. Not, really, much in the way of expertise.

I think that LLMs already are - and will continue to - enhance security experts' abilities to find exploits. However, these experts tend to be fairly rare, and many of them have specific goals. Think, for example, state intelligence services. Militaries. Corporate espionage. That kind of thing. The limiting factors here are expertise, and the "market" for these services. Seems like at least the latter will probably grow. But my money is not on it growing in a way that fundamentally re-shapes our network environment.

Where LLMs for offense really shine is with the script kiddies, who neither have, not care about, gaining expertise. They want to steal. To extort. They are bored. They have grudges. They want to watch the world burn. Time used to be an important resource here, since it took time to find and use the tools that others made, and to turn that into whatever you were seeking. I suspect time becomes less important with LLMs, since you can (to some extent now, and likely more in the future) turn them loose against targets. This leaves a lack of morality as the main "feature" needed to become a script kiddie.

To me, then, the question as to whether LLMs wreak havoc on the internet as offensive weapons comes down to whether our society maintains, or degrades (or even improves) its moral character. It's not, directly, the technology. It's the people, and whether we let the technology change us and morally de-skill ourselves.