Security Weaknesses of Copilot Generated Code in GitHub

Re:Security Weaknesses of Copilot Generated Code in GitHub by phyzome on Thursday October 05, 2023 @09:06AM (#37778096)

This would likely help a little bit. We've already seen LLMs improve performance on some tasks by being instructed to "think carefully" first; presumably this biases it towards parts of the training set that are higher quality.

But security ultimately requires comprehension, which is not something LLMs have.

[ Parent | on HN ]

Re:Security Weaknesses of Copilot Generated Code in GitHub by jncfhnb on Thursday October 05, 2023 @09:22AM (#37778280)

Security 100% does not require comprehension in the philosophical sense

[ Parent | on HN ]

Re:Security Weaknesses of Copilot Generated Code in GitHub by phyzome on Friday October 06, 2023 @07:09PM (#37797477)

Not sure what the philosophical sense would be. I just mean that an awful lot of people treat security as "hack on the code until it doesn't obviously break", and that's the wrong mindset for practical security.

[ Parent | on HN ]

Re:Security Weaknesses of Copilot Generated Code in GitHub by jncfhnb on Friday October 06, 2023 @07:41PM (#37797723)

I’m not sure what you could possibly mean by LLMs don’t have comprehension if not speaking to philosphical debates of what comprehension means.

I think your point is otherwise right, but the correct answer is standard best practices which is the easiest thing for bots to do

[ Parent | on HN ]