There is no guarantee ChatGPT did the correct thing. There may be no indication whatsoever. This is not like comparing pen&paper to a calculator, it's more like comparing pen&paper to "calling a random, allegedly smart person on the phone".

> "Why use a calculator all the time? Just use pen and paper!"

"Why use a calculator all the time? Just use ChatGPT!"

Maybe you want to be an helpless baby who can't do anything and needs to chug a bajillion liters of water and depend on OpenAI to decode base64, but the thought of this becoming the norm understandably upsets reasonable people.

In addition to the other responses, ChatGPT is more wasteful and uses a lot more computing power than a locally run Base 64 decoder. When masses of people use LLMs for such trivial calculations, the environmental cost adds up.

ChatGPT failed at doing the job, and it was the wrong tool to use.

It explained that it saves a file and executes it. That's a nothingburger, it was obvious it's going to execute some code.

The actual value would have been showing what's in the executed file, but of course it didn't show that (since that would have required actually executing the code).

Showing the contents of the file would have provided an exact and accurate information on what the malware is trying to do. ChatGPT gave a vague "it executes some code".

So what exactly did it fail at here ? Not executing the clear malware attack just so it could it see what was inside ? Really ?

Explaining what the malware does

I mean, what exactly would decoding the string yourself change ? It's not as if b64 decoding has secret malware introspection abilities.

It already decoded the string so I'm not sure what your question is.

There is 0 value in chatgpt telling you "it executes some code". The interesting part would be what is inside the /tmp/... file that the malware intends to execute.

To turn this question around, what did you gain by asking ChatGPT this question? You would have not run this command before, and you wouldn't run it after, and you wouldn't have run it either if ChatGPT told you "yeah it's safe go ahead".

What you would have liked to see is besides the point. Nowhere did the author tell us he was interested in finding out what running the code would do rather than what the string said. So there's no failure here, and the 'right way' people are bringing up here (decoding b64 algorithmically) would produce no more meaningful a result.

Nah this is more like, "Why do you consult the vibes oracle to compute 7 * 5? Just use a calculator!"

.. which is, to be honest, a criticism I would make if I saw someone try to ask ChatGPT to do math

.. and, FWIW, that is exactly what's happening here; base64 decode is just math

For 7 × 5 using a calculator should not even be a thing for most people. Sure, some people just can't do the basic tables, but most people should be able to tell how much seven €5 items cost in a supermarket. If you could do this as a teenager, but lost that skill afterwards, you are just sacrificing your brain.

Yes I thought about that after writing it and should've used an example with bigger numbers. But I didn't want to ninja edit too much. I think the point came across.

> if I saw someone try to ask ChatGPT to do math

This makes me wonder how many kids are using Chat GPT as a calculator.

This is ridiculous, given that even the browser itself already includes a calculator in the URL-bar, and they are probably not using a website without a browser.

To most of the replies to my comment, the point is that:

- ChatGPT is _satisficing_, not optimal. It's definitely worse than a dedicated decoder tool.

- and it's also much more versatile, so it will be satisficing a large array of tasks.

So in scenarios where precision isn't critical and the stakes are mid, it'll simply become the default tool.

Like googling something instead of checking out wikipedia. Or checking out wikipedia instead of using those mythical primary sources. etc.

> ChatGPT is _satisficing_, not optimal.

But is it _always_ accurate?

The answer to that is important when there are security implications.

The security implication here was writing a blog post. You're allowed to use a cheap box cutter even if you work at NASA, as long as you use it to open mail. That's what satisficing means.

> The security implication here was writing a blog post.

Not sure why you're only looking at that part of it?

What are you talking about? How is it the right tool? You have a command you can use instead that will give back the exact answer, immediately, with no possibility of mistakes or hallucination

genAI is unreliable. For a task like this, reliability is pretty important.

That's a terrible analogy.