xyzeva

fully responded to with a comment above but, Claude Opus 4.8, GPT 5.6 Sol and GPT 6 Astra

also, they all get there in the end (as mentioned), but the CoT and command calls and tool calls they do get to me and my instinct is to just stop it right there

the takeaway i want isn't my personal reason on why i don't use ai but rather why people should still not use ai for personal projects, or hobbies. to have fun tinkering with things and coding still, outside of work!

as mentioned in the article; i totally get using llms for work, but for personal projects i think you should spend some time to tinker with it yourself

i mean; no, this isn't the conclusion i want someone to takeaway from this article. the part about me not wanting to use LLMs again is purely so i stop getting the question of "why don't you?" and having to explain each time

the takeaway i want is a. i would like people to still have fun and tinker around with things in their personal time instead of making an LLM do it all themselves b. i think we should stop compromising ethics for marketing

as pointed out in the conclusion! that is about specifically the fact even an engineer, who i assume got into this job because they liked doing it as a hobby, should still have some fun with engineering in their personal projects themselves instead of offloading it to an LLM.

i agree that LLM use in work as a software engineer is fully inevitable at this point, because we are all expected to move so fast

i'm not gonna let my typing style be criticised when it's been a typing style i've used for previous very popular (even on HN!) articles about vuln research.

it's a choice of typing this way, i don't like typing super formally, just not my thing, i'd rather type casually and most of my articles are sort of braindumps of what i think as i go, but historically i've been complemented very much on this style and i like doing it

just starting to read all these; that specifically was both Claude Opus 4.8 and GPT 5.6 Sol and GPT 6 Astra

the main point of the article isn't this and a lot of people seem to be focusing on it though, it's me describing why i personally don't want to use an LLM

and what i'm describing specifically there is the concept of the CoT and the tools it's executing. i see it doing something stupid and my instinct is to stop it, it does usually eventually get there in the end

as i point out right below, llms are super powerful. i'm not arguing that. i'm arguing that we should stop disregarding ethics for marketing and also generally have fun ourselves without llms in personal projects (not work) specifically.

i think you're missing the fact that that indeed is not a security email, and the engineering/security email i found bounced.

i had no ill intentions. stop pretending i did.

It is for the sites, not Firebase.

Sadly, most developers don't know this and continue to write from frontend, almost all of the apps and websites we found did this.

I agree for the most, but there was some good apples (even though very few) that were very thankful and fixed it fast.

True, but also better than threat actors getting to it and dumping the DB, causing more problems for the customers.

What'd you expect, its google!

I agree! Supabase does it pretty good.

I agree, but I also disagree.

The concept with firebase DB's is flawed IMO, I never got the point of directly accessing a DB in the frontend, or allowing that even with security rules, it just seems like it would cause problems.

We believe the gambling ring is based in Indonesia, which is uncommon to use Line, but they seem to be using it here for all of their customer support across all sites.

I really doubt that this will be google's downfall, theyre too big to fall right now. I think it will be laws.

Yeah, funny how that works.

Services as time goes on makes making websites easier, and abstracts more stuff, which makes devs oblivious to what they have to configure.

Thank you! Means a lot, helps us keep going.

Must've used the twitch chat dataset

Python just isn't the language for this, really.

Rewriting it is the only real solution, I don't know your exact problem.

Setting up firebase security rules: https://firebase.google.com/docs/rules/

Would work! If you're willing to write something, go for it. I'm personally way too exhausted right now.

We confirmed that the gambling site is not fake data, I dont know about the lead one.

Why we are saying its more is there is likely other services not in our scan list that could be vulnerable.

Sadly, this is true, and theres probably much more. We did our best, sent customized emails to each of them, telling what was affected, how to fix it, and how to get in contact.