From xz to ibus: more questionable tarballs

Re:From xz to ibus: more questionable tarballs by tutfbhuf on Tuesday April 02, 2024 @06:43AM (#39904245)

Wouldn't it be possible to incorporate a security-focused GPT¹ into the CI Pipeline and have the code automatically checked? I'm not sure if anyone has integrated the backdoor from Jia Tan into GPT-4 or something similar, but I wouldn't be surprised if GPT-4 could detect such backdoors. Maybe I'm completely wrong, but if so, please tell me in a comment and do not downvote just because I mention AI.

[^1]: https://securitysentinel.substack.com/p/awesome-gpts-agents-...

[ Parent | on HN ]

Re:From xz to ibus: more questionable tarballs by loloquwowndueo on Tuesday April 02, 2024 @07:13AM (#39904418)

We don’t understand how AI works. I would not trust an AI to not hallucinate unsafely in this context.

[ Parent | on HN ]

Re:From xz to ibus: more questionable tarballs by zopa on Tuesday April 02, 2024 @07:26AM (#39904507)

You wouldn’t want it in the CI pipeline, because any model clever enough to find real issues is also going to find plenty of false positives. That seems like too much friction for most open source projects.

I’m not one of the downvoters, but you’ve linked to a list of forty or fifty different projects, many of which don’t seem relevant to this use-case. It’s not too surprising people have nothing to say besides “ugh, more AI hype.”

[ Parent | on HN ]

Re:From xz to ibus: more questionable tarballs by VMG on Tuesday April 02, 2024 @07:58AM (#39904745)

You are wrong but there is no reason to downvote you. The idea might work in the future.

[ Parent | on HN ]

Re:From xz to ibus: more questionable tarballs by Kwpolska on Tuesday April 02, 2024 @08:17AM (#39904875)

It might work if AI stops producing random output and bullshit (which proponents call hallucinations to make it sound nice), and produces correct responses deterministically. Which may take forever.

[ Parent | on HN ]