so i guess everyone uses llms to think now

In recent times, many have asked the question "what AI model did you use for this?" when it comes to the articles on this blog. The answer has always been "my brain" - the author has never used AI for any research they have published. When asked why not, the author explains that they simply do not enjoy giving an AI all the fun of exploring something instead of doing it themselves.

They prefer using their brain, coding, and spending hours staring at devtools, binary ninja, or other tools. Exploring weird library source code and tracing it with only GitHub Code Search and a dream is fun for them. They don't do anything on this blog for money; they do it for fun, and the money is just a nice side effect. They cannot take credit for something an AI did for them and are uncomfortable with publishing something an AI did for them on their personal blog as a writeup.

The blog is their own, and all the work on it is their own, or it's shared research with other people that are explicitly credited. They have tried using AIs before, but nothing they were going to publish as research, but it left them not wanting to use an AI again. They cannot handle an AI confidently being wrong, as it drives them crazy.

AIs are powerful machines, but they still need skill and experience to guide them, and currently, no one can just do everything with them. The vulnerabilities that have been found often have been found by skilled researchers using AIs, likely at a big firm. AI companies have hooked onto cybersecurity as their marketing strategy, which is evident in recent events.

For example, PHP2Shell involved three companies collaborating and releasing blog posts with different narratives. Each company had their own perspective on using AI to find PHP vulnerabilities, but the author believes that AI should not be the sole guiding force in cybersecurity. They argue that these case studies contain useful information but are more about fearmongering than actually helping with security.

The author also criticizes the practice of using hashes to claim proof of a vulnerability or accomplishment. They believe that hashes have always been a way to claim proof but should not be used as a way to fearmonger. Instead of providing useful information, the hashes just create panic. The author also points out that posting minimal information and then slowly releasing more cryptic information does not help anyone.

They criticize a researcher who claimed to have found a 0day in Tailscale by posting a hash. The researcher then posted more cryptic information and eventually gave away the vulnerability, but they did not contact Tailscale for responsible disclosure. The vulnerability, which allowed privilege escalation to root on a machine with Tailscale SSH enabled, was real, but the researcher's actions did more harm than good.