News for hackers. Stuff that matters.
Re:Risk Assessment of GitHub Copilot by nojs on Monday July 12, 2021 @09:50AM (#27810242)
I think the biggest problem copilot will have in practice gaining traction is that verifying correctness isn’t any faster than writing the code yourself in many cases. The Easter(y) function is a classic example - it would be way faster to write that than to try and verify that there’s no subtle bugs.

Copilot is by design trying to give you something that _looks_ correct without caring whether it actually is - so it optimises for real-looking but subtly buggy code, which is the worst kind of broken code.

Re:Risk Assessment of GitHub Copilot by mumblemumble on Monday July 12, 2021 @12:12PM (#27811772)
Years ago, I ran into a similar problem working on a program that was doing named entity recognition to assist humans with data entry. We found that, for our purposes, there seemed to be no (realistic) accuracy threshold beyond which the tool would save clients money, because double-checking the machine-generated output was inherently more work than doing it by hand.

So we pivoted the product to being something you would run on full auto, for situations where you didn't need a high level of quality. I'm not sure if that option is available to programmers, though.

Re:Risk Assessment of GitHub Copilot by jpeloquin on Monday July 12, 2021 @02:14PM (#27813299)
Maybe Copilot could be turned into a context-aware search engine? That is, invoking it would return a list of examples that it thinks do the same thing as what you're trying to do, based on your work-in-progress code.
Re:Risk Assessment of GitHub Copilot by visarga on Monday July 12, 2021 @02:17PM (#27813323)
Seems like humans are more creative when they can get inspiration from language models.

https://arxiv.org/abs/2107.04007

Re:Risk Assessment of GitHub Copilot by bshanks on Monday July 12, 2021 @07:42PM (#27816368)
Ironic if AIs end up being more useful for creativity than for detail-oriented tasks.
Re:Risk Assessment of GitHub Copilot by jessmartin on Monday July 12, 2021 @09:46PM (#27816938)
I honestly think this is where things are going. Man-machine partnership on creative tasks. Not only is it more amenable to current models, it’s higher leverage and less likely to be completely automated away.

I wrote a little about this shift to what I think of as “conversational programming”: https://jessmart.in/articles/copilot

Re:Risk Assessment of GitHub Copilot by atatatat on Tuesday July 13, 2021 @07:15PM (#27827384)
You're not going to get it out of a generation of people raised by tablets, needs to come from somewhere.
Re:Risk Assessment of GitHub Copilot by stormbrew on Monday July 12, 2021 @08:04PM (#27816462)
This would be way more interesting of a product than what copilot actually is.
Re:Risk Assessment of GitHub Copilot by saurik on Monday July 12, 2021 @09:23PM (#27816839)
Yeah: I would love this; I actually often try to use GitHub like this, and it sort of works at times, except GitHub's search features frankly suck.
Re:Risk Assessment of GitHub Copilot by jtbayly on Monday July 12, 2021 @04:15PM (#27814542)
I would have thought to pivot to an assistive model in the case you mention, and in cars and in copilot.

Have the machine notify you when it thinks you’ve made a mistake.

Re:Risk Assessment of GitHub Copilot by mumblemumble on Monday July 12, 2021 @04:31PM (#27814722)
The thing we ran into was, in cases where the human and the machine disagreed, it was basically never the human that was wrong.
Re:Risk Assessment of GitHub Copilot by pessimizer on Monday July 12, 2021 @01:08PM (#27812520)
> I think the biggest problem copilot will have in practice gaining traction is that verifying correctness isn’t any faster than writing the code yourself in many cases.

Humorously, this is a similar problem to the one autonomous driving has. Being alert when something goes wrong randomly is more difficult than being alert all of the time.

Re:Risk Assessment of GitHub Copilot by slg on Monday July 12, 2021 @03:11PM (#27813844)
However in the real world people don't always write bugless code and aren't always alert when driving. Therefore these AI assistants can still have a net positive result as long as they are better than the average performance of a human. Of course three quarters of us probably believe that "I'm not an average programmer so Copilot would only make me worse."

Personally I think the more interesting angle is the trolley problem this creates. People will die in self-driving car accidents and bugs will exist in AI generated code. Those people and bugs are different than the people who will die in human caused accidents and the bugs in human written code. If the number and severity of the results are lessened by the computer, are we willing to forgive the damage directly caused by the AI that falls short of perfection?

Re:Risk Assessment of GitHub Copilot by tkiolp4 on Monday July 12, 2021 @03:30PM (#27814030)
I’m a very mediocre developer and if Copilot is any better than me at writing code, then I will have a hard time understanding whatever Copilot throws at me. I cannot just save, commit and push whatever Copilot suggests... so it’s faster if I write the code myself than to review Copilot’s code.
Re:Risk Assessment of GitHub Copilot by slg on Monday July 12, 2021 @03:55PM (#27814315)
> I cannot just save, commit and push whatever Copilot suggests

I don't think that is the goal just like the goal of the current generation of self-driving cars isn't for you to be able to take a nap in the driver's seat.

Imagine you need some code that would have traditionally taken you and hour to write. I believe the goal of Copilot is to generate the code for you as a starting point. Maybe you don't understand that code immediately and it takes you 20 minutes to figure out what is going on. Then you spend another 20 minutes tweaking it for your exact purpose. If that results in code of similar quality to what you would have written alone, then Copilot makes you more efficient by saving you 20 minutes.

Re:Risk Assessment of GitHub Copilot by yojo on Monday July 12, 2021 @04:54PM (#27814992)
I haven't had a chance to try it yet, but I'm skeptical of the time savings claim of copilot in its current form. At least working on a large code base, the things that take time are:

1) Understanding the data model and logic of the code that interacts with the component I'm working on

2) Refactoring existing code to accommodate my change gracefully

3) Writing and fixing tests

4) Working through the code review process

For a major new piece of functionality, add

5) Put together a design document and review it with relevant stakeholders

The part that is fast is actually writing the code, as once I've done steps 1 and 2 (and sometimes 5) writing the new code itself is near trivial. I don't see how copilot could possibly help me in a meaningful way on these kinds of tasks.

The work that seems most amenable to copilot help is things like utility functions for transforming data/calculating things from it, as in the "Easter" example from the article. But here I would rather use a well-tested library, or if one doesn't exist (or I can't use it), write well documented code that I understand thoroughly.

Put another way, the work that copilot seems most adept at is "junior developer" work performed by people operating at a junior level. But if they delegate "figuring things out" to copilot, they're just going to spend way more time in code review. Or worse, they're not going to spend that time, and will learn nothing/stagnate in their professional progression.

Ever since the advent of satellite nav I've become terrible at learning my way around cities. I'm okay with the loss, since I can generally rely on having nav when I need it, and navigating cities isn't one of my core responsibilities. Copilot is not reliable (it won't answer your question every time), and it automates something that is your actual job. A junior dev might be better served by spending the extra 20 minutes muddling through and building their skillset.

Re:Risk Assessment of GitHub Copilot by munchbunny on Monday July 12, 2021 @04:25PM (#27814657)
> I don't think that is the goal just like the goal of the current generation of self-driving cars isn't for you to be able to take a nap in the driver's seat.

I think the issue is that the MVP from a customer perspective is, effectively, being able to take a nap in the driver's seat. From a research perspective there are obviously intermediate milestones, but that doesn't make it fit for what people would want to use it for. Same goes for Copilot.

Re:Risk Assessment of GitHub Copilot by slg on Monday July 12, 2021 @04:55PM (#27815013)
>I think the issue is that the MVP from a customer perspective is, effectively, being able to take a nap in the driver's seat.

Maybe that is a requirement for some users, but it isn't a universal one. Plenty of people see a benefit in assistive technology that isn't complete such as adaptive cruise control or boilerplate/scaffolding dev tools.

It also raises the ethical question of whether these creators are responsible for the misuse of their products. Is it enough for them to say "This is how this product should be used. You are on your own if you use it outside these settings."? Holding developers responsible for the misuse of their software could create an actual slippery slope. Where is the line drawn? Do we start punishing people who create encryption algorithms because someone used the encryption to hide evidence of a crime?

Re:Risk Assessment of GitHub Copilot by munchbunny on Monday July 12, 2021 @05:32PM (#27815389)
> It also raises the ethical question of whether these creators are responsible for the misuse of their products. Is it enough for them to say "This is how this product should be used. You are on your own if you use it outside these settings."?

I don't think you have to answer the ethical question to address the level of readiness that Copilot or self-driving cars are at. It definitely raises the question, but you don't have to answer it to talk about suitability for use cases.

As you say, it might address the requirements of some specific people. My argument is that Copilot is not good enough yet for the bulk of imagined use cases, whether or not you call that MVP, and I think the post makes a good argument about why.

Re:Risk Assessment of GitHub Copilot by IanCal on Tuesday July 13, 2021 @02:30AM (#27818132)
I don't think that's a reasonable assumption - that if you're a mediocre developer you won't understand code written by a better developer.

Better code should largely be easier to understand.

Re:Risk Assessment of GitHub Copilot by bamboozled on Monday July 12, 2021 @09:46PM (#27816945)
Faster and more fun to write it yourself.
Re:Risk Assessment of GitHub Copilot by mumblemumble on Monday July 12, 2021 @04:30PM (#27814707)
So, you can at least make a theoretical argument for why self-driving cars can do a better job than humans: they are always alert and paying attention, and the set of things they're trying to accomplish are concrete, can reasonably be presumed a priori and baked into themodel, and are reasonably well specified so that we hopefully don't need hard AI to be successful.

By contrast, Copilot doesn't necessarily have any idea what you're trying to do. So it can, to an approximation, pattern match on what you've already written, and spit out valid code that is "inspired" by things it's seen in the past. But it doesn't actually know what you're trying to do. It doesn't know what your acceptance criteria are, or what invariants you're trying to maintain, or anything like that. And, at least in the places I've worked, most the interesting bugs (by which I mean, the ones that managed to cause trouble in production) happen when the programmer writing the code didn't have a firm idea of what they were trying to do. So, that's what worries me - I would fear that the spots where Copilot can't even theoretically be expected to do a good job happens to be exactly the kind of things for which people would tend to rely on it the most.

Maybe I'm being overly pessimistic? But that's kind of my job - I work in an area where "move fast and break things" is pretty antithetical. But it would still be a lot more compelling to me if I could see a paper demonstrating that a team using Copilot has fewer production defects than a team that's doing exactly the same work but without Copilot. Or alternatively, if it were repackaged as something that's a bit like a smarter version of IDE refactorings. "Hey, it looks like you're about to spit out a big old mess of boilerplate. Let us get that for you." Or, "Hey, some functions you called can fail, how about I go ahead and suggest a catch block so you don't forget to write one?" Basically, give me something that's a bit more smart cruise control and a bit less Autopilot.

Re:Risk Assessment of GitHub Copilot by IlliOnato on Tuesday July 13, 2021 @12:18AM (#27817582)
My cynical opinion is that Copilot will be most useful for people who write junk code. They will be able to write more junk code faster.
Re:Risk Assessment of GitHub Copilot by dogecoinbase on Monday July 12, 2021 @07:30PM (#27816294)
> However in the real world people don't always write bugless code and aren't always alert when driving. Therefore these AI assistants can still have a net positive result as long as they are better than the average performance of a human.

This is an extremely good analogy -- in both situations, the human will become lazy and stop paying attention (regardless of whether they're supposed to keep their hands on the wheel, literally or metaphorically), and it will be possible to have a net result worse than either human or AI acting alone.

Re:Risk Assessment of GitHub Copilot by bamboozled on Monday July 12, 2021 @09:46PM (#27816936)
Are we also willing to just start accepting lower quality code (on average) because we have AI guiding us towards it.

What's the point of striving to write better, more correct code, being a safer driver, if all we ever do is rely on the status quo to train models to be average?

Re:Risk Assessment of GitHub Copilot by mattwad on Monday July 12, 2021 @10:50AM (#27810843)
I've been using it and that's 100% correct. If it suggests more than a few lines, i might as well do it myself. However, it has been an awesome Intellisense tool for one-liners.. it can write out the rest of a comment or a simple map/filter method just fine. I don't think it will ever go further than that, but nor does it need to.
Re:Risk Assessment of GitHub Copilot by visarga on Monday July 12, 2021 @02:12PM (#27813281)
Be sure it doesn't generate any GPL licensed code down to the size of a single letter, to be safe. The reaction to GPL inspired snippet generation has been more fierce than I could have imagined, even though usable snippets are so short.
Re:Risk Assessment of GitHub Copilot by z3t4 on Monday July 12, 2021 @05:06PM (#27815133)
You can't license a code snippet. You can only copyright/license a complete work, as in a complete app or library. Software patterns might work differently though!?
Re:Risk Assessment of GitHub Copilot by dec0dedab0de on Monday July 12, 2021 @05:28PM (#27815358)
Any portion of a work has a copyright the moment there is a tangible copy.

There is a uniqueness requirement, but it has nothing to do with length. A unique one liner would have a copyright.

Re:Risk Assessment of GitHub Copilot by z3t4 on Tuesday July 13, 2021 @05:47AM (#27819110)
You can not take the source code of an app, change a few lines, and then call it your own. You can however make your own app by stealing a few lines of code here and there... funny enough many companies write code so that all functions depend on all other functions making it impossible to reuse any parts of the code in another app (but i think that is not deliberate)
Re:Risk Assessment of GitHub Copilot by shinjitsu on Monday July 12, 2021 @04:41PM (#27814825)
> give you something that _looks_ correct without caring whether it actually is

Oh this is going to make teaching intro to computer science sooooo 'interesting'.

It wouldn't be so bad if the students looked at the generated code and understood it, but experience tells me most of them will not.

Re:Risk Assessment of GitHub Copilot by staticassertion on Monday July 12, 2021 @05:16PM (#27815239)
Students will always cheat tbh. I doubt this will radically change anything with regards to that.
Re:Risk Assessment of GitHub Copilot by intothev01d on Monday July 12, 2021 @01:00PM (#27812425)
Yea, that's the major problem. I'd prefer just some sort of inline helper that could point directly to documentation, topics, stack overflow answers that might be helpful for whatever I'm developing. An enhanced "Intellisense" or something. That to me, is better, because ultimately it's up to the developer to place scrutiny on the solution. You basically can't blindly accept the implementation which makes this just a constant code review, of yourself? I dunno. This just seems half-baked
Re:Risk Assessment of GitHub Copilot by visarga on Monday July 12, 2021 @02:21PM (#27813361)
Copilot does approximately that, but instead of showing you code that's written independently it adapts to your variable names and context.
Re:Risk Assessment of GitHub Copilot by elcomet on Monday July 12, 2021 @01:45PM (#27812979)
It works well for completing lines one by one. I just write a few characters and it can often complete very well the lines.

Of course it will not write complete functions correctly.

Re:Risk Assessment of GitHub Copilot by tkiolp4 on Monday July 12, 2021 @03:26PM (#27813990)
Agree. It’s way easier to write a function from scratch than to read/evaluate/fix whatever snippet Copilot throws at me. Replace Copilot with “junior engineer” or “senior engineer that knows more than me” and the result is the same (the junior engineer will probably introduce couple of subtle bugs that are hard to find; the senior engineer would write code in such a way that my mediocre brain won’t understand).
Re:Risk Assessment of GitHub Copilot by jeltz on Monday July 12, 2021 @06:52PM (#27816020)
The best senior developers I have worked with knew how to keep code simple to understand for less skilled developers.
Re:Risk Assessment of GitHub Copilot by TameAntelope on Monday July 12, 2021 @03:59PM (#27814377)
"Subtly buggy" is another way of saying "mostly working", and I'll take "mostly working" any day of the week!
Re:Risk Assessment of GitHub Copilot by ohazi on Monday July 12, 2021 @06:24PM (#27815839)
More likely: "inscrutably buggy"

It looks to you like it should work, but it doesn't, and you can't figure out why.

That's not "mostly working," that's a frustrating waste of time. It's hard enough to notice when you accidentally swap `i` and `j` -- why would you want to make your life even more miserable by spending your time finding all of the instances where a pattern matching robot has done something similar in an unfamiliar block?

And if you do happen to get "mostly working" code, but only want it to stay together long enough for you to fundraise, you're basically stating that you plan on foisting this technical debt onto the poor sod you happen to hire.

Attitudes like yours are the reason this dogpile scares me.

Re:Risk Assessment of GitHub Copilot by TameAntelope on Monday July 12, 2021 @10:39PM (#27817166)
If I understand your argument correctly, it's that GitHub Copilot does not produce functioning code, yes?

If that's the case, I agree with your assessment, that GitHub Copilot isn't delivering on its promise and I would not be using it.

My understanding, however, was the GitHub Copilot does produce functioning code. If you're saying, as I think you are, "No, GitHub is lying about Copilot." I find that claim fascinating (How the hell did we get to the point where a software company could release a product that literally does not do even the most basic version of what it says it does, and only a few people notice?), but I'd need more specific information from you before I'd believe it.

Re:Risk Assessment of GitHub Copilot by gspr on Monday July 12, 2021 @04:27PM (#27814681)
You must not be coding anything important.
Re:Risk Assessment of GitHub Copilot by TameAntelope on Monday July 12, 2021 @04:42PM (#27814834)
Ouch, but I'm not interesting in writing software as much as I'm interested in making enough money to spend the rest of my days sipping piña coladas on a beach in a foreign country.

All I really need is for the product to work well enough that I can fundraise and hire someone who's better at programming than I am, someone who hopefully doesn't write comments about how unimportant other people's work is on HN.

Re:Risk Assessment of GitHub Copilot by gspr on Tuesday July 13, 2021 @06:50AM (#27819512)
OK, that's fair enough, you're not interested in the engineering side of things – but then expect blowback if you decide to comment on exactly that.
Re:Risk Assessment of GitHub Copilot by TameAntelope on Tuesday July 13, 2021 @08:17PM (#27827850)
I am interested in the engineering side of things, for sure, but only insofar as their actual outcomes and justification as part of a value-add to a business.

GitHub Copilot, if it can create "mostly working" code, is a huge value-add to an early business trying to find product/market fit because it cuts down on the time it takes to prototype and generate early versions.

Not every piece of software has to work perfectly every time, and I don't think that's the standard to which we should hold any automated coding tool.

Re:Risk Assessment of GitHub Copilot by corpdrone2021 on Monday July 12, 2021 @02:15PM (#27813309)
I feel like a mix of hand written test cases and copilot generated code might go somewhere, but I think you've got the basic problem sorted out. I'd much rather type an algorithm in from scratch than wrap my head around whatever copilot spits out.
Re:Risk Assessment of GitHub Copilot by dkersten on Monday July 12, 2021 @03:07PM (#27813807)
I had an idea long ago that you basically write unit tests (nowadays I would add property-based tests to the mix too) and a genetic algorithm (best I could come up with at the time, nowadays we obviously have much fancier techniques, as evidenced by Copilot) would come up with code to try and make the tests pass.

I could see Copilot used in such a way. I think the interaction would have to change though: force the user to give it the tests as input, not give it some basic instruction, have it generate code, and then I try to write tests after. The tests should be the spec that Copilot uses to generate its output.

Right now, I'm not excited about Copilot. Like you say, understanding what Copilot spits out is difficult and I suspect more error prone than just writing it yourself (since we often see what we want to see and can overlook even glaring mistakes). I'm also not excited about them ignoring the licenses of the code they trained on. But I can imagine a future iteration that generated code to pass some tests that I could get excited about.

Re:Risk Assessment of GitHub Copilot by corpdrone2021 on Monday July 12, 2021 @04:27PM (#27814685)
It seems to me that "generate the code that makes these unit tests pass" is actually a much saner engineering task than "go from a comments to an implmentation"
Re:Risk Assessment of GitHub Copilot by fighterpilot on Monday July 12, 2021 @02:26PM (#27813422)
I can foresee one niche where this doesn't matter: exploratory ad-hoc data science.

In this exploration stage, total correctness doesn't matter since you're just getting a feel for the data. Copilot might help a lot with the associated boilerplate.

Re:Risk Assessment of GitHub Copilot by jessmartin on Monday July 12, 2021 @09:50PM (#27816956)
I think Copilot-like tools could be excellent for the exploration phase. Marvin Minsky mused on this usage back in 1967:

> The programmer does not even have to be exact in his own ideas‑he may have a range of acceptable computer answers in mind and may be content if the computer's answers do not step out of this range. The programmer does not have to fixate the computer with particular processes. In a range of uncertainty he may ask the computer to generate new procedures, or he may recommend rules of selection and give the computer advice about which choices to make. Thus, computers do not have to be programmed with extremely clear and precise formulations of what is to be executed, or how to do it.

From: https://web.media.mit.edu/~minsky/papers/Why%20programming%2...

Re:Risk Assessment of GitHub Copilot by 908B64B197 on Monday July 12, 2021 @06:08PM (#27815695)
I can't wait for coders who used copilot for all coding projects they did. Copy and pasting snippets until it works. No proofs or real exams at bootcamps!

Having offline coding interviews to find Software Engineers will become even more important.

Re:Risk Assessment of GitHub Copilot by tyingq on Monday July 12, 2021 @01:07PM (#27812512)
It also isn't giving you any information on the source(s) of the generated code. Which might help determine how much to trust it, whether it could have licensing issues, etc.
Re:Risk Assessment of GitHub Copilot by visarga on Monday July 12, 2021 @02:24PM (#27813396)
It's probably the only way it would work - to show top matching snippets from training data on request, with links to the source and ideally licensing information, if it can be gleaned automatically. This would also clearly show how much it is copying verbatim and what exactly is its contribution.

The funny part will be when all the human programmers who steal code will get doxed as a side effect. It shine a light on lots of skeletons in the closet.

Re:Risk Assessment of GitHub Copilot by ikiris on Monday July 12, 2021 @02:12PM (#27813287)
I can think of multiple cases where the best result is probably volume of output that looks good without close scrutiny.
Re:Risk Assessment of GitHub Copilot by intuitionist on Monday July 12, 2021 @12:56PM (#27812361)
I think my best guess is that this is actually meant to produce broken code, so that Microsoft can sell you additional services (cloud fuzzing?) to find and fix the bugs.
Re:Risk Assessment of GitHub Copilot by cyanydeez on Wednesday July 14, 2021 @08:40PM (#27840239)
just use it to talso write the tests, problem solved!
Re:Risk Assessment of GitHub Copilot by nimbius on Monday July 12, 2021 @10:56AM (#27810909)
see when I saw the words 'risk assessment' i figured the presuppositional framework of the authors argument wasnt that copilot was legally sound. In other words, i didnt expect to jump straight to the technical validity of the product.

do not ignore the elephant in the room. copilot is stealing code from projects with open licenses.

Re:Risk Assessment of GitHub Copilot by ShroudedNight on Monday July 12, 2021 @11:30AM (#27811273)
I would expect an information security expert to comment on the risks they have a professional background in assessing. More broadly, your comment almost seems to suggest that one should preclude all avenues of criticism beyond whichever singular issue is most "obvious" / "problematic". That strikes me as less than optimal.
Re:Risk Assessment of GitHub Copilot by ForHackernews on Monday July 12, 2021 @03:10PM (#27813831)
Producing code that kinda-mostly works, very quickly, is the behaviour the software industry optimises for. This tool will help do more of that, so it will be very widely adopted.

Developers who not use this (or similar tools) will not be hired, or only in particular niche domains where correctness matters.