Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Any indications Copilot scans your local files?

news.ycombinator.com

Post reply on HN
Print view View original

61–70 of 88 posts

Re: Ask HN: Any indications Copilot scans your local files?

#61

Post by harshitaneja »

kall wrote: post #56
harshitaneja wrote: post #38

I noticed a very peculiar thing with copilot. I was writing a twitter api wrapper and had hardcoded access token for a test user. Copilot when testing a function that requires a user id suggested one. I searched the id and it belonged to my test user. I searched my entire codebase but couldn't find any place I had used the particular id. The only place it could have extracted it from would have been access token whic…

If it‘s always in the same location inside the api key, it seems very reasonable that it would pick up that pattern, as most projects that include a hardcoded key would include it. API key variables are probably named almost the same everywhere.

This is my guess as well. But I doubt anyone would be writing their code like "${userId}-${otherPart}" so copilot itself noticed that in all codebases with hardcoded twitter keys(which shouldn't be common on github I think) that their is a partial match and this is a useful information(given that in such a large corpus of all public github code partial matches would be quite common and ratio of signal to noise should be less). Whatever the case, I started as a skeptic thinking this is pure gimmick and now each day I am impressed by something new that copilot can do.

Re: Ask HN: Any indications Copilot scans your local files?

#62

Post by polycaster »

katmannthree wrote: post #40

How exactly does Copilot not open Microsoft up to significant legal liability, when it has been demonstrated that copilot will regurgitate entire blocks of scanned code?

I may add that like in my case it doesn't have to be an entire block of code. I think most people have this idea that copilot just alters the content enough so it is basically doing the same thing without being a literal copy of the original. Perhaps adjusting to the project at hand.

Part of the problem is much simpler actually. Copyrighted text can cited without permission or product names become public before release, revealing disclosed information to competitors.

Re: Ask HN: Any indications Copilot scans your local files?

#63

Post by moyix »

Alex Graveley, the Chief Architect at GitHub on Copilot, says pretty definitively here that it does not look at anything outside your project: https://twitter.com/orph/status/1457790239796199424

So I'm thinking either it made a very good guess, or the assets got included in your project without you realizing?

Re: Ask HN: Any indications Copilot scans your local files?

#64

Post by harshitaneja »

kevinsundar wrote: post #59
harshitaneja wrote: post #51

Earlier quoted context omitted.

I have seen that as well and it is impressive. But this is more than that. The code contained a string variable named accessToken with a string like "218276172612672-jash127hg27128h'(random data here, not the actual id), where 218276172612672 was the user id. When testing a function that required user id it not only suggested 218276172612672 but also did it with the full context participant.follow({twitterUserId:"218…

Seems totally reasonable to me too. It probably has just seen the pattern ``` str = "{{SOME_ID_HERE}}-jash127hg27128h" participant.follow({twitterUserId:"{{SOME_ID_HERE}}"}) ```

This doesn't seem likely. No one would be generating it this way as access token is issued after oauth and I am unaware of any method to get the second half of the token without the first half. And given that in the same response that contains access token, user id is passed as well so there is no need to extract it from there.

Re: Ask HN: Any indications Copilot scans your local files?

#65

Post by polycaster »

catchmeifyoucan wrote: post #7

I think it also reads your clipboard. Yesterday, I had copied something from stackoverflow, and was about to paste it, and it gave me a suggestion before I could even drop it in.

Are you sure it didn't just know the URL? It's public after all. I feel copying the clipboard would be beyond, but then again, scanning locales files outside of the project's context would be crazy, too.

Re: Ask HN: Any indications Copilot scans your local files?

#66

Post by harshitaneja »

a-dub wrote: post #60
harshitaneja wrote: post #51

Earlier quoted context omitted.

I have seen that as well and it is impressive. But this is more than that. The code contained a string variable named accessToken with a string like "218276172612672-jash127hg27128h'(random data here, not the actual id), where 218276172612672 was the user id. When testing a function that required user id it not only suggested 218276172612672 but also did it with the full context participant.follow({twitterUserId:"218…

are you sure that "big number that starts with 2" wasn't just the greatest 32 bit 2s complement signed integer, which is often used for sentinel/testing values?

No it was oauth access token issued for a test user I created. Nothing special about the token.

Re: Ask HN: Any indications Copilot scans your local files?

#67

Post by polycaster »

speedgoose wrote: post #37

Is the name of the company unique and very random or something more in the trend of "WeatherForecastsForFishermen Inc"? Are you sure the AI couldn't get some context from the current file? No title tag in the head, no description nor keywords ? The filename/path is also used, could it be it?

I'm pretty sure the marketing claim cannot be derived fromthe company's name (see other comments on that topic in this thread).

Re: Ask HN: Any indications Copilot scans your local files?

#68

Post by advael »

I doubt I will ever use any IDE, so it's a moot point for me, but from a legal perspective using VSCode in particular has become extremely sketchy, and I say that as a working dev, a machine learning researcher, and having known some people who deal with patents for Microsoft

This copilot nonsense also was the straw that broke the camel's back and got me to delete my github account

Re: Ask HN: Any indications Copilot scans your local files?

#69

Post by a_lost_needle »

iamcurious wrote: post #29
aspenmayer wrote: post #25

Earlier quoted context omitted.

I’m assuming you meant “blurb” instead of “blur”?

Thanks corrected. While we are at it. Is it "make the following experiment" or "do the following experiment" ?

Perform, conduct, execute, the experiment, etc... You generally would set up an experiment, after making a hypothesis. You could make up an experiment, and then execute I suppose. It's a noun and a verb, so you could experiment with making experiments, but making a following experiment would then be making a made thing, so I don't think that would be correct.

Re: Ask HN: Any indications Copilot scans your local files?

#70

Post by mirekrusin »

polycaster wrote: post #58
minimaxir wrote: post #32

Earlier quoted context omitted.

This is a joke, but it may be the correct answer: if the company name is self-demonstrating, it's possible Codex could recognize that.

I don't think so. The phrase is 272 characters long and contains very specific terms which cannot be derived from the company's name. Also, it's a 1:1 match with the unpublished marketing material.

Maybe it's the other way around - your co unpublished marketing material has been co-written by AI?
Post reply on HN