News for hackers. Stuff that matters.
Re:Security Weaknesses of Copilot Generated Code in GitHub by OmarShehata on Wednesday October 04, 2023 @10:02PM (#37774113)
That would be kind of wild. Imagine a world where whether your system was secure was just a matter of remembering to tell the AI agent "& also make it secure" before it writes your code.

(could be quite real!)

Re:Security Weaknesses of Copilot Generated Code in GitHub by Grimburger on Wednesday October 04, 2023 @10:26PM (#37774231)
> also make it secure

[proceeds to simply refactor the same code]

Re:Security Weaknesses of Copilot Generated Code in GitHub by jncfhnb on Thursday October 05, 2023 @08:47AM (#37777903)
I think it’s more likely that you would use a security graded bot.

It’s perfectly reasonable to not use secure code for a large number of use cases.

Re:Security Weaknesses of Copilot Generated Code in GitHub by phyzome on Thursday October 05, 2023 @09:06AM (#37778096)
This would likely help a little bit. We've already seen LLMs improve performance on some tasks by being instructed to "think carefully" first; presumably this biases it towards parts of the training set that are higher quality.

But security ultimately requires comprehension, which is not something LLMs have.

Re:Security Weaknesses of Copilot Generated Code in GitHub by jncfhnb on Thursday October 05, 2023 @09:22AM (#37778280)
Security 100% does not require comprehension in the philosophical sense
Re:Security Weaknesses of Copilot Generated Code in GitHub by phyzome on Friday October 06, 2023 @07:09PM (#37797477)
Not sure what the philosophical sense would be. I just mean that an awful lot of people treat security as "hack on the code until it doesn't obviously break", and that's the wrong mindset for practical security.
Re:Security Weaknesses of Copilot Generated Code in GitHub by jncfhnb on Friday October 06, 2023 @07:41PM (#37797723)
I’m not sure what you could possibly mean by LLMs don’t have comprehension if not speaking to philosphical debates of what comprehension means.

I think your point is otherwise right, but the correct answer is standard best practices which is the easiest thing for bots to do