Re:Security Weaknesses of Copilot Generated Code in GitHub
by Grimburger on Wednesday October 04, 2023 @10:26PM
(#37774231)
> also make it secure
[proceeds to simply refactor the same code]
Re:Security Weaknesses of Copilot Generated Code in GitHub
by jncfhnb on Thursday October 05, 2023 @08:47AM
(#37777903)
I think it’s more likely that you would use a security graded bot.
It’s perfectly reasonable to not use secure code for a large number of use cases.
Re:Security Weaknesses of Copilot Generated Code in GitHub
by phyzome on Thursday October 05, 2023 @09:06AM
(#37778096)
This would likely help a little bit. We've already seen LLMs improve performance on some tasks by being instructed to "think carefully" first; presumably this biases it towards parts of the training set that are higher quality.
But security ultimately requires comprehension, which is not something LLMs have.
Re:Security Weaknesses of Copilot Generated Code in GitHub
by jncfhnb on Thursday October 05, 2023 @09:22AM
(#37778280)
Security 100% does not require comprehension in the philosophical sense
Re:Security Weaknesses of Copilot Generated Code in GitHub
by phyzome on Friday October 06, 2023 @07:09PM
(#37797477)
Not sure what the philosophical sense would be. I just mean that an awful lot of people treat security as "hack on the code until it doesn't obviously break", and that's the wrong mindset for practical security.
Re:Security Weaknesses of Copilot Generated Code in GitHub
by jncfhnb on Friday October 06, 2023 @07:41PM
(#37797723)
I’m not sure what you could possibly mean by LLMs don’t have comprehension if not speaking to philosphical debates of what comprehension means.
I think your point is otherwise right, but the correct answer is standard best practices which is the easiest thing for bots to do
(could be quite real!)