Historically, a lot vulnerabilities in PHP projects were because of PHP itself.
Things like register_globals, remote includes/reads using functions that supposed to read local data and so on.
> But there are also really good ones - so I can't afford to not take actual look at each, but it gets tiring and we need a solution.
There is not easy solution, the landscape has changed and if care about security, you just need to allocate more human resources. Another layer of LLM checks won't help.
Google Chrome used to report visited pages back to Google, not sure if this still the case. Also, Google Analytics can see visited pages and Google uses it.
Finding domains is easy, everybody uses CTL to find them.
I'm working on hexora, a library that detects malicious Python code using static analysis and machine learning.
Recently, I've added a simple ML model to filter out false positives. In the last month, I found and flagged more than 40 malicious Python packages.
Unlike the LLM approach, my library is not susceptible to prompt injection and deobfuscates Python code. Where LLMs see "obfuscated code, potentially harmful", my library decodes it and sees what's happening inside.
Yeah, claims that it can be faster than CH are very suspicious. CH guys are very good at their craft, they spend hundreds of hours optimizing one single small detail.
I think Google stopped using such data long time ago. They have been showing hydrants, buses, crosswalks for ages. It's a solved problem to detect them.
They don't have a goal of becoming a popular language, though and will continue to work on it as long as there are donations.
They don't care about being mainstream and there are niche companies who appreciate Zig and donate.
No, it's good for coding and faster to iterate.
Flash models work almost the same for changes under 1000 LOC when you dictate how you want your code to look. Big models still suck at big changes and big changes are hard to review.