Security Weaknesses of Copilot Generated Code in GitHub

Re:Security Weaknesses of Copilot Generated Code in GitHub by renewiltord on Thursday October 05, 2023 @02:55AM (#37775609)

A junior programmer's code? This makes no sense. It's happening right in front of you. A junior programmer isn't going to write on my screen. I can just correct it right here I am currently holding the context in my head.

These "security weakness" examples are

     print("first user registered, role set to admin", user, password)

and

     pprint({"json":"somejunk", "classes": somefunc(user)})

Nah, this stuff I can easily spot while I'm writing code. For a junior programmer, I'm going to be looking at design, and then at common specific mistakes. For Copilot it's writing in front of me. I can easily exclude anything that isn't obviously correct because I'm in the state right there.

It's a fantastic tool. If you go and use it and end up with `print(user_credentials)` I don't know what to tell you.

[ Parent | on HN ]

Re:Security Weaknesses of Copilot Generated Code in GitHub by baq on Thursday October 05, 2023 @03:39AM (#37775829)

The added complication is now you'll have to watch out for the junior+copilot combo, though it's a trade I personally am very willing to take.

[ Parent | on HN ]

Re:Security Weaknesses of Copilot Generated Code in GitHub by devjab on Thursday October 05, 2023 @05:30AM (#37776537)

You’ve had to watch out for “bad” programmers since the beginning of programming. Having been an external CS examiner for almost a decade now, I’m not too worried about LLMs in teaching because I’m not convinced they can do worse than what we’ve been doing this far. I do think it’s a little frightening that a lot of freshly educated Computer Scientists will have to “unlearn” a good amount of what they were taught to actually write good code, but on the flip side I work in a place where a big part of our BI related code is now written by people from social sciences because, well, they are easier to hire.

That’s how you end up with pipelines that can’t handle 1000 PDF documents, because they are simply designed not to scale beyond one or two documents. Because that’s what you get when you google program, or alternatively, when you use ChatGPT, and it’s fine… at least until it isn’t, but it’s not like you can’t already make a lucrative career “fixing” things once they stop being “good enough”. So I’m not sure things will really change.

If anything I think LLMs will be decent in the hands of both juniors and senior developers, it’s the mediocre developers who are in danger. At least with google programming they could easily tell if an SO answer or an article was from 20 years ago, that info isn’t readily available with LLMs. I fully expect to be paid well to clean up a lot of ChatGPT messes until the end of my career.

[ Parent | on HN ]