Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google fixed more Chrome bugs in June than over the past two years, thanks to AI

blog.google

Post reply on HN
Print view View original

461–470 of 667 posts

Re: Google fixed more Chrome bugs in June than over the past two years, thanks to AI

#461

Post by hn_submit »

bschoepke wrote: post #442
hn_submit wrote: post #389

To me this merely signals how broken C++ development really is. Most if not all of the bugs being uncovered are memory related and therefore intimately tied to the mental memory model of C and C++, namely manual memory management. It's fine for a C or C++ program encompassing a couple hundred lines but beyond that it's a liability. C and C++ are simply not fit for purpose when large scale software projects are concer…

Rust certainly helps for certain classes of errors but doesn't help at all for logic errors or incompletely understood requirements or occasional need for hacks due to business needs.

Why is everyone always referring to logic errors when pushing back against Rust? No programming language ever invented (or to be invented) will fix logic errors made by developers.

Logic errors are "out of scope" for Rust or any other programming language.

Re: Google fixed more Chrome bugs in June than over the past two years, thanks to AI

#462

Post by maccard »

colechristensen wrote: post #394
bmurphy1976 wrote: post #298

Earlier quoted context omitted.

You don't need a "blog post." You need experience managing projects, tracking progress, coordinating conversations, mentoring less experienced engineers, etc. That experience comes with practice and time. If you really need something to latch onto, there's plenty of educational material available about how to be an effective scrum master. Start there.

Indeed. I'm saying the human inside the engineering loop is essential. If a person needs training, particularly if the set of high level advice I set out in a reply is rejected, a blog post isn't going to cut it anyway. Some AI skeptics paradoxically insist humans are irreplaceable and then get almost mad(?) when you discuss how humans are necessary in the loop. At least that's my interpretation of what is going on,…

> If a person needs training, particularly if the set of high level advice I set out in a reply is rejected, a blog post isn't going to cut it anyway.

My problem with the “high level advice” is that the results it gives are bad. Sure, sometimes it gets it right, and it helps but I’d wager about half the time the results are just bad. Hence why I’m asking people to show their homework here. I think that the anthropic rust rewrite is great example - it shows yes you can do a lift and shift assuming you’re ok with those constraints.

> Some AI skeptics paradoxically insist humans are irreplaceable.

But yet in this comment thread we have people saying “just point it at your code and let it go” like [0], you saying “just follow the vague instructions and if you can’t get the results that I’m telling you you’ll get them it’s your problem. But it’s too circumstantial for me to be able to tell you how to work”

> where one set of prompts/harnesses/whatever solve all your problems forever

I don’t want forever, I just want to know what is actually working today, or this week, or this month.

[0] https://news.ycombinator.com/item?id=49122616

Re: Google fixed more Chrome bugs in June than over the past two years, thanks to AI

#463

Post by azakai »

hn_submit wrote: post #389

To me this merely signals how broken C++ development really is. Most if not all of the bugs being uncovered are memory related and therefore intimately tied to the mental memory model of C and C++, namely manual memory management. It's fine for a C or C++ program encompassing a couple hundred lines but beyond that it's a liability. C and C++ are simply not fit for purpose when large scale software projects are concer…

You can also take the opposite conclusion from this: C++ is now viable because LLMs can catch the security bugs.

I'm obviously not entirely serious here, but I think this is true to some extent: the number of memory safety bugs in a codebase is finite. Once you have a way to find them, you can drive that number down to zero.

C++ has become a far safer language thanks to LLMs - at least if you run the LLMs before you are attacked.

Re: Google fixed more Chrome bugs in June than over the past two years, thanks to AI

#464

Post by MostlyStable »

warkdarrior wrote: post #445
MostlyStable wrote: post #407

Earlier quoted context omitted.

I just did a search and apparently this fact (the specific one about no payouts for the first time in almost 20 years) has not gotten a discussion on HN. Given the degree of skepticism around the utility of AI bug finding and fixing (this very thread is full of it), I would have thought that concrete evidence that it can help actually make real software more secure against attacks would have gotten a write-up somewhe…

We KNOW AI is bad, so why would we have a use for "concrete evidence that it can help"??

I'm honestly unsure if this is a Poe's law thing or not. I'm going to go ahead assume that you are doing the honorable thing of purposefully not including a /s for the integrity of the joke.

Re: Google fixed more Chrome bugs in June than over the past two years, thanks to AI

#465

Post by skydhash »

keeda wrote: post #412
skydhash wrote: post #291

Earlier quoted context omitted.

> The idea that software has gotten so complex that a machine can evaluate code paths better than a human, seems to bristle the fur of many Lol! What about fuzzers, linters, typecheckers and formal tooling? There’s plenty of machine code evaluators that people do use because it’s better than relying on human skills. The issue is the actual report and the lack of information.

> What about fuzzers, linters, typecheckers and formal tooling? Pretty sure Chrome has been using all of those forever, along with some of the best security researchers in the world, yet AI (which is what GP really means by “machine” here) is finding way more bugs. I think GP’s point is that AI makes some people uncomfortable because it operates more like a human than a special purpose tool. As for lack of informatio…

Here is a nice report about tooling

https://cacm.acm.org/research/lessons-from-building-static-a...

This is the kind of report that you can reflect upon and learn from instead of feeling like you’ve just read a marketing piece.

Re: Google fixed more Chrome bugs in June than over the past two years, thanks to AI

#466

Post by Dylan16807 »

sitzkrieg wrote: post #451
hn_submit wrote: post #431

Earlier quoted context omitted.

C is literally "high level assembly" and therefore lacks any guard rails you'd expect in a programming language. It's just unfortunate that so many software developers embraced C for its speed, even when it wasn't strictly needed. I always remind people that C is a systems programming language and not fit for regular application programming. For that you need an application programming language like Pascal or Java.

yea, we certainly wouldn’t want regular user applications to run fast or respect user resources. can’t have that

Even if that was the tradeoff, your average C/C++ program isn't notably fast or lean.

Re: Google fixed more Chrome bugs in June than over the past two years, thanks to AI

#467

Post by MostlyStable »

MostlyStable wrote: post #407
ayewo wrote: post #361

Earlier quoted context omitted.

Perhaps this was due to their red-teaming partnership [1][2] with Anthropic which they wrote about a few months earlier in March? 1: https://www.anthropic.com/news/mozilla-firefox-security 2: https://blog.mozilla.org/en/firefox/hardening-firefox-anthro... Previous discussion: https://news.ycombinator.com/item?id=47273854

I just did a search and apparently this fact (the specific one about no payouts for the first time in almost 20 years) has not gotten a discussion on HN. Given the degree of skepticism around the utility of AI bug finding and fixing (this very thread is full of it), I would have thought that concrete evidence that it can help actually make real software more secure against attacks would have gotten a write-up somewhe…

After doing a bit more research, this fact is somewhat less impressive. Apparently, this was also the first time in nearly 20 years that there was such a large capacity crunch and many researchers weren't able to get into the competition. One of the rejected researchers did apparently have a working exploit, which, upon not getting into the event, they responsibly disclosed, and it was then patched before the event.

Re: Google fixed more Chrome bugs in June than over the past two years, thanks to AI

#468

Post by dgellow »

Cthulhu_ wrote: post #57
iLoveOncall wrote: post #38

Earlier quoted context omitted.

> The post has counts for everything that went right and nothing for what could go wrong. That's AI for you. At Amazon we have many forums to share our AI wins, but none to share AI failures or disappoinments. No wonder execs make bad decisions regarding AI, they only hear completely one-sided stories.

At my company there's a lot of discussion about AI and complaints that people run out of tokens within a day, but zero results are shown. No measurable (or measured) gains. Or nothing that people are willing to talk about, in any case.

I’ve been asking since months on HN for proofs that companies using AI see positive ROI from it. So far I didn’t get a single concrete example

Re: Google fixed more Chrome bugs in June than over the past two years, thanks to AI

#469

Post by floil »

aenis wrote: post #443
dingaling wrote: post #422

Earlier quoted context omitted.

> Saying they're not fit for purpose doesn't seem correct. I'll quite happily say they were never fit for purpose. C had a role in bootstrapping early software development in the absence of anything better but once Lisp, Delphi, Smalltalk and Java arrived on the scene then it, and its equally footgunnable variants, should have been pushed to the margins where hardware constraint was the primary consideration. Writing…

Ekhem. When Chrome was announced there wasnt Rust. And Java was a programming language for slow moving systems, with many a flaws and its own classes of footguns. I dont think they had much of a choice in 2008. Now? Sure. I bet a rust port is in the works.

This is correct (I worked on chrome in 2008) it's important to remember that chrome's renderer was webkit, an existing c++ stack.

Chrome's stability innovation was to run different tabs in different processes, and the security innovation was then to sandbox those processes.

Rust would have been super nice but it wasn't an option then, and of course let's remember that Rust was developed by Mozilla specifically with the goal of making safer browsers.

Re: Google fixed more Chrome bugs in June than over the past two years, thanks to AI

#470

Post by iLoveOncall »

rpdillon wrote: post #421
iLoveOncall wrote: post #38

Earlier quoted context omitted.

> The post has counts for everything that went right and nothing for what could go wrong. That's AI for you. At Amazon we have many forums to share our AI wins, but none to share AI failures or disappoinments. No wonder execs make bad decisions regarding AI, they only hear completely one-sided stories.

This is kind of a weird take. If you were the CEO of Amazon, would you be setting up channels for people to talk about their AI failures? The general way technology is deployed is that we try to find ways to make it work, because those are the most interesting. We're not as interested in all the ways it doesn't work. From my perspective, some people are trying to use AI in the same way somebody might use a laptop to…

> If you were the CEO of Amazon, would you be setting up channels for people to talk about their AI failures?

I would set up channels to talk about AI, encouraging both successes and failures, with proofs required for both, and punishing people who intentionally misreport on either.

Post reply on HN