How long will the rapid update cycle last? [LWN.net]

How long will the rapid update cycle last?

Posted May 12, 2026 10:32 UTC (Tue) by patrick_g (subscriber, #44470)
In reply to: How long will the rapid update cycle last? by ras
Parent article: Dependency-cooldown discussions warm up

> over the long term, the amount of effort a nation-state can put into it isn't constrained at all.

You assume the effort curve will tend to infinity?
It's clearly an S curve that will eventually become logarithmic. Since we haven't seen the inflection point yet, we shouldn't assume it tends to infinity.

to post comments

How long will the rapid update cycle last?

Posted May 12, 2026 11:03 UTC (Tue) by ras (subscriber, #33059) [Link] (1 responses)

> It's clearly an S curve that will eventually become logarithmic.

Yes, logarithmic is probably where it will end up. But if code generation starts growing exponentially that doesn't help.

There is another worrying aspect to this. There is a tendency to view this new CVE finding capability as an "open source" problem. That's wrong. Have you ever fed obfuscated javascript to an LLM and asked it to translate it back to readable code? It does it so well, it's often more readable and better commented than the original.

This ability to understand code humans find inscrutable isn't limited to obfuscated javascript. Researchers found CVE-2026-3854 two weeks ago by using AI-augmented tools to analyse closed-source binaries in GitHub’s internal infrastructure. A suitably trained LLM has no trouble reconstituting the intent of machine code, and once it's done that the CVE hunt is on. The machine code can be obtained from a proprietary binary or a ROM.

The proprietary hunt for CVEs hasn't started in earnest yet, as the right sort of people haven't woken up to the possibilities. But they will, and then the hunters will have a field day. You may be right about it becoming logarithmic eventually, but I would not count on that saving us.

How long will the rapid update cycle last?

Posted May 12, 2026 12:02 UTC (Tue) by paulj (subscriber, #341) [Link]

How would you know the translated code is the same as the obfuscated or the machine code?

I'd fully expect the LLM to produce code that looks reasonable - it's been trained on large volumes of code after all. However, it's not at all the case that LLMs are perfect at preserving meaning/equivalence across translations.