News for hackers. Stuff that matters.
Re:Don't encode POST bodies like GitHub Copilot, use URLSear... by TeMPOraL on Thursday July 01, 2021 @08:13AM (#27698320)
A real copilot will get fired and/or go to jail and/or die, if it feeds you subtly wrong data, and leads you to crash a plane. GitHub won't suffer any consequences if its Copilot feeds you bad code that causes a security breach, or wastes a lot of engineering time on debugging subtle heisenbugs.

The problem with Copilot is that it works just enough to be dangerous: it streamlines copy-pasting of unchecked code, but the code it offers has subtle bugs. It's even worse than copy-pasting from StackOverflow, because code on SO got at least a passing review by someone who understands it. Here, you get code generated from ML models. Unlike generating pictures of faces or kittens, when an occasional artifact doesn't matter much, an "artifact" in code that you won't notice will still make the code wrong.

> Don't put it in hand of non programmers

Putting it in hands of programmers isn't really any better. To make it work, you need programmers to be disciplined - more disciplined than they were when copy-pasting from SO.

Re:Don't encode POST bodies like GitHub Copilot, use URLSear... by dathinab on Thursday July 01, 2021 @08:19AM (#27698351)
> It's even worse than copy-pasting from StackOverflow, because code on SO got at least a passing review by someone who understands it.

It's like copying from StackOverflow while ignoring upvotes, comments, and anything but the first revision ;=)

Re:Don't encode POST bodies like GitHub Copilot, use URLSear... by emodendroket on Thursday July 01, 2021 @08:17AM (#27698338)
If you're taking the code suggestions without reading them it's your fault.
Re:Don't encode POST bodies like GitHub Copilot, use URLSear... by TeMPOraL on Thursday July 01, 2021 @08:25AM (#27698403)
Discipline doesn't scale.

Also the problem isn't code that's obviously wrong when you read it. The problem is when code looks OK, but is subtly wrong. Which keeps happening - as we know today, at least two examples featured on Copilot homepage have this problem. To make this work, you have to read each snippet super carefully - which defeats the whole point.

Re:Don't encode POST bodies like GitHub Copilot, use URLSear... by emodendroket on Thursday July 01, 2021 @08:29AM (#27698434)
I really don't think it does defeat the point. The point isn't just churning stuff out as fast as possible without concerning yourself with quality. There are lots of other reasons you'd benefit from snippets -- rote work done for you, familiarity with language ecosystem, and so on.

It's all well and good to say there should be something better than just discipline but there's no idiot-proof way of writing programs.

Re:Don't encode POST bodies like GitHub Copilot, use URLSear... by TeMPOraL on Thursday July 01, 2021 @08:48AM (#27698565)
Ok, maybe it doesn't defeat the whole point. The way I see it, there are two ways of using Copilot:

1. As a way to specify a problem and get a suggested solution (or a selection of them), to use as a starting point.

2. As a way to specify a problem, get it solved by the AI, and consider it done.

I'd expect that any developer worth their salt will do 1. I expect that of myself. I also worry this is so streamlined that people, including myself, will naturally shift to doing 2 over time.

This is similar to the problem with self driving cars - you can't incrementally approach perfection, you have to get it right in one go, because the space between "not working" and "better than human in every way" is where self-driving is more dangerous than not having it. When it works most of the time, it lulls you into a false sense of security, and then when it fails, you aren't prepared and you die. Similarly, Copilot seems to be working well enough to make you think the code is OK, but it turns out the code is often buggy in a subtle way.

> familiarity with language ecosystem

This is an interesting angle to explore the topic. Familiarity is a big factor when inspecting such generative snippets. For example, I'm really familiar with modern C++, and I'm confident I could spot problems in Copilot output (if and when it starts producing C++), maybe 50% of the time. If it's a logic issue, or initialization issue, I'll spot it for sure. If it's a misuse of some tricky bits of the Standard Library? I might not. I make enough of those mistakes on my own. Or, I know enough JS to be dangerous, but I don't consider myself fluent. I'm definitely going to miss most of the subtle bugs there.

Re:Don't encode POST bodies like GitHub Copilot, use URLSear... by emodendroket on Thursday July 01, 2021 @08:53AM (#27698599)
To my mind the difference between copilot and semi-autonomous cars is that split-second decisions are not required in this instance. If it takes you a minute to snap out of it and notice the suggestion was wrong, no problem.

On your other point, it's true that if you're working in an unfamiliar ecosystem, spotting subtle issues will be harder. But I think getting automatic suggestions that are probably idiomatic in that language will be more helpful than hurtful.

Re:Don't encode POST bodies like GitHub Copilot, use URLSear... by aeorgnoieang on Thursday July 01, 2021 @04:29PM (#27704357)
> When it works most of the time, it lulls you into a false sense of security, and then when it fails, you aren't prepared and you die.

That still doesn't _necessarily_ imply that 'partially self-driving cars' are worse than actually existing humans. Really, anything that's (statistically) better than humans is better, right?

I don't think it's reasonable to think that even 'perfect' self-driving cars would result in literally zero accidents (or even fatalities).

Re:Don't encode POST bodies like GitHub Copilot, use URLSear... by simonh on Thursday July 01, 2021 @08:32AM (#27698460)
If you already knew how to do the thing, then you wouldn't need co-pilot. The whole purpose of this tool is to suggest a way to do the thing, and the biggest value is when you don't know how to do it and need help. In that case, if you can't trust the help what use is it?

As others have pointed out, at last Stack Overflow comes with context, the ability to rate and comment on suggestions, or even have a discussion about an approach. With this you take it or leave it. Saying you should already know what you need to do and what the tradeoffs are and how to evaluate the quality of the suggestion is basically saying this should have no value to you, and any consequences are all your fault if it does.

Re:Don't encode POST bodies like GitHub Copilot, use URLSear... by corobo on Thursday July 01, 2021 @09:16AM (#27698746)
I only ever picture myself using it to speed up side projects to be honest. It is a glorified tab complete. A quite glorious one don't get me wrong, but that's all it is.

If you're using it to create something you don't know how to do then yeah you're in for a world of disappointment.

HN seems to be of the hivemind that random Joe Nocodes will be firing up VSCode and asking it for a custom version of Uber which.. yeah is laughable and honestly seems pretty obvious that that wont work.

Re:Don't encode POST bodies like GitHub Copilot, use URLSear... by marcosdumay on Thursday July 01, 2021 @12:18PM (#27700774)
> It is a glorified tab complete.

Interesting metaphor. Notice how the Bash tab completion is a great tool, that increases people's productivity by a large amount, and receives only complements from anybody you ask. At the same time, the newish Windows cmd tab completion is a great productivity destroyer that gets mostly only criticism and you will find way too many people blaming it for losing data.

Do you know what is the difference? The bash tab completion is always correct. If it can't be correct, it gives you as much of a correct answer as it can, and leaves the rest up to you. The cmd tab completion doesn't care at all about being correct, it will always give an answer, no matter what you ask for.

Re:Don't encode POST bodies like GitHub Copilot, use URLSear... by emodendroket on Thursday July 01, 2021 @03:14PM (#27703258)
Lots of people on Unix systems prefer the much more permissive guessing zsh offers.
Re:Don't encode POST bodies like GitHub Copilot, use URLSear... by marcosdumay on Friday July 02, 2021 @05:57PM (#27717431)
Hum... I can see how people would like zsh. It doesn't just guess at the first tab press, and that extension that displays all the alternatives before looping is nice. It's permissive but it's disastrous interaction is opt-in.

If autocomplete on IDEs were that respectful, I'd like them too.

Re:Don't encode POST bodies like GitHub Copilot, use URLSear... by corobo on Friday July 02, 2021 @01:59PM (#27714661)
I use zsh as the sibling mentioned to be honest. Giving me options is the best option
Re:Don't encode POST bodies like GitHub Copilot, use URLSear... by emodendroket on Thursday July 01, 2021 @08:49AM (#27698573)
I think there's a pretty wide continuum of "knowing how to do it" and in a lot of cases you have a pretty good idea what's going on by seeing the code, once it is presented. I'd further suggest that a lot of examples the give on the page are just finishing tedious series where the problem is mostly just typing it all out.
Re:Don't encode POST bodies like GitHub Copilot, use URLSear... by aeorgnoieang on Thursday July 01, 2021 @04:31PM (#27704388)
Even when I _do_ know "how to do the thing", I've learned, thru painful (and repeated) experience, that I can't trust myself!

(But I also have no interesting in using Copilot myself, tho maybe I should try it myself now, if only on some toy side project.)