News for hackers. Stuff that matters.
Re:Over 100k Infected Repos Found on GitHub by simonw on Thursday February 29, 2024 @08:22AM (#39548945)
It's a risk. Similar to the risk that if you accept PRs from coworkers without reviewing them they might have copied and pasted in some vulnerable code from somewhere.

Using LLMs means investing more effort in code review. I think that's a worthwhile trade.

Re:Over 100k Infected Repos Found on GitHub by jprete on Thursday February 29, 2024 @09:26AM (#39549667)
This is not a worthwhile trade. The person sending the PR should not send LLM code that they can't vouch for, under the expectation that reviewers will find any vulnerabilities. That's just dumping the work onto the reviewers.
Re:Over 100k Infected Repos Found on GitHub by simonw on Thursday February 29, 2024 @10:00AM (#39550174)
It's a worthwhile trade. I've been able to produce a substantial amount of reliable, working code with the assistance of LLMs over the past year - code I would have not been able to produce otherwise simply due to lack of time.

Why review code at all if you think your coworkers are infallible?

Re:Over 100k Infected Repos Found on GitHub by bee_rider on Thursday February 29, 2024 @10:48AM (#39550936)
I think you are both saying that it is OK to use LLMs, but you have to check the output.

It looks like there’s been a communication hiccup or something; I think you are saying that the LLM user should treat LLM code as if it is written by an unreliable team-mate who might copy-paste from the internet, and check it.

Jprete seems to be talking about just receiving a PR from a person who didn’t do that checking and just directly is using the LLM code.

I agree with you, but I think it is worth noting that

> This is not a worthwhile trade

> It's a worthwhile trade

The difference here is not in whether or not the trade is worthwhile; you are just talking about two different trades .

Re:Over 100k Infected Repos Found on GitHub by simonw on Thursday February 29, 2024 @10:56AM (#39551042)
Yeah, I think you're right.

I don't think it's OK for a coworker to contribute a PR generated by an LLM without having already reviewed it and being ready to declare that they are confident in its quality.

Re:Over 100k Infected Repos Found on GitHub by dartos on Thursday February 29, 2024 @10:13AM (#39550408)
I’m fine with LLM code as long as someone actually understands what it’s doing.