Live data from Hacker News

Google fixed more Chrome bugs in June than over the past two years, thanks to AI

blog.google

491–500 of 668 posts

Re: Google fixed more Chrome bugs in June than over the past two years, thanks to AI

#491
post #49
post #41

A lot of people here seem to be living in a different universe than me or simply don't know how to work with AI. I think detractors believe you should just let AI do the job blindly instead of leveraging it as a tool to accelerate you. They get mad at Excel for the poor investment returns. At this point, this is such a strawman, it isn't worth counter arguing. I think I'll abandon this discussion and keep using AI qu…

> A lot of people here seem to be living in a different universe than me I feel this way on this topic too. > I think detractors believe you should just let AI do the job blindly instead of leveraging it as a tool to accelerate you. The problem is; how _should_ I use AI? On a previous thread, I had two replies to the same comment, one saying "provide the LLM all the context it needs and let it go ham", and the other…

it depends on what it is you are doing. if the complexity is low (frontend, GUI) you can just prompt it once and refine at the end.

if the complexity is high but you know how the task is to be done then what you can do is divide the task into pieces yourself or with the help of the LLM and use an LLM for each piece.

if the task is complex and you don't have a good idea how it is to be done then you need to start exploratory work with the LLM (multiple sessions, don't reuse the sessions for code).

how to use an LLM correctly is a skill in and of itself. the people who say that LLM's are bad either haven't used any good ones and have such disorganized thinking processes that they are unable to encode them into English good enough for an LLM.

Re: Google fixed more Chrome bugs in June than over the past two years, thanks to AI

#492
post #86

Earlier quoted context omitted.

Tests! Unit tests, integration tests, random adhoc scripts. You know - TDD! I’ve been working on UI component improvements and it was doing a lousy job until i specifically told it to test in a headless browser to validate it works. I think somewhere in an AGENTS.md i have an instruction to “don’t state your guesses as fact - validate findings and results”.

It bothers me that you have to explicitly state this to the agent. Makes me think what else is missing from that file which also needs to be explicitly stated, but I don't know what don't know. "Do a good job"?

Claude Code just does this for me. But it might be one of their Superpower skills that I added.

Re: Google fixed more Chrome bugs in June than over the past two years, thanks to AI

#493
post #414

Earlier quoted context omitted.

I'll await your Rust ports of Windows, Linux and MacOS then. This isn't really a fair take. Keep in mind that C/C++ has been the backbone of the most important software in the world since the 1970s. At that time we didn't have virtually unlimited compute and memory at our fingertips the way we do now. It was a huge improvement to have a high level language which still could be optimized nearly as well as assembly. It…

A pretty big part of the reason we didn't switch earlier is that most people—certainly most non-technical leaders, but also a lot of engineers—don't value correctness or security enough. We didn't have good alternatives until recently because we did not, collectively, invest in developing these alternatives. One surprising thing is that, in the grand scheme of things, developing an alternative like Rust is not that e…

The real curious thing is serious C/C++ folks seem like one of the least likely groups imaginable, to want to undergo humiliating and embarrassing blunders…

Yet they seemingly don’t mind that it practically guarantees them to make blunders over and over again.

Re: Google fixed more Chrome bugs in June than over the past two years, thanks to AI

#494

Earlier quoted context omitted.

> The post has counts for everything that went right and nothing for what could go wrong. That's AI for you. At Amazon we have many forums to share our AI wins, but none to share AI failures or disappoinments. No wonder execs make bad decisions regarding AI, they only hear completely one-sided stories.

This is kind of a weird take. If you were the CEO of Amazon, would you be setting up channels for people to talk about their AI failures? The general way technology is deployed is that we try to find ways to make it work, because those are the most interesting. We're not as interested in all the ways it doesn't work. From my perspective, some people are trying to use AI in the same way somebody might use a laptop to…

>The general way technology is deployed is that we try to find ways to make it work, because those are the most interesting.

That's not the way AI is being deployed. At all.

Re: Google fixed more Chrome bugs in June than over the past two years, thanks to AI

#495
post #414

To me this merely signals how broken C++ development really is. Most if not all of the bugs being uncovered are memory related and therefore intimately tied to the mental memory model of C and C++, namely manual memory management. It's fine for a C or C++ program encompassing a couple hundred lines but beyond that it's a liability. C and C++ are simply not fit for purpose when large scale software projects are concer…

I'll await your Rust ports of Windows, Linux and MacOS then. This isn't really a fair take. Keep in mind that C/C++ has been the backbone of the most important software in the world since the 1970s. At that time we didn't have virtually unlimited compute and memory at our fingertips the way we do now. It was a huge improvement to have a high level language which still could be optimized nearly as well as assembly. It…

That change is happening. Microsoft has been rewriting parts of Windows in Rust, Linux is accepting Rust code, and Apple is using Swift for core parts of their OSes.

Re: Google fixed more Chrome bugs in June than over the past two years, thanks to AI

#496

Earlier quoted context omitted.

A pretty big part of the reason we didn't switch earlier is that most people—certainly most non-technical leaders, but also a lot of engineers—don't value correctness or security enough. We didn't have good alternatives until recently because we did not, collectively, invest in developing these alternatives. One surprising thing is that, in the grand scheme of things, developing an alternative like Rust is not that e…

The real curious thing is serious C/C++ folks seem like one of the least likely groups imaginable, to want to undergo humiliating and embarrassing blunders… Yet they seemingly don’t mind that it practically guarantees them to make blunders over and over again.

We call them blunders mostly because the solutions are so well known.

In contrast, the last company I worked for did everything in typescript and the amount of problems caused by code that blocked the main event loop was staggering. And at that, our best JavaScript people generally just threw up their arms saying there wasn't a good way to fix it.

Between the two, I prefer a language that lets me fix problems.

Re: Google fixed more Chrome bugs in June than over the past two years, thanks to AI

#497
post #486

Earlier quoted context omitted.

It basically completely eliminates the most common class of errors which are bugs related to memory management. Hard numbers and statistics show that every application with enough complexity will be riddled with those. It is simply impossible, even for the smartest human minds, to manage this kind of complexity. And this is a fact.

Somehow, magically, some people managed to write C software that I now use for three decade with not a single crash in all this time.

What software would that be, and how do you know there have never been memory-related bugs and vulnerabilities in it?

Re: Google fixed more Chrome bugs in June than over the past two years, thanks to AI

#498
post #339

Earlier quoted context omitted.

Google's entire modus operandi has been "automate everything" for decades. They've been doing this with fuzzers, with project zero and so on. Adding LLMs on top is a very obvious next step. And LLMs improving and finding more bugs also follows. Then improve the harness and the dev tools, to better use the LLMs. And then everything together end-to-end to find-triage-fix-confirm. Your LLMs are as good as the loop they…

So thinking about this, do you think these bugs are all unique or are there a small set of new bug categories that were found and once automated resulted in many separate bug fixes? For many of the new bugs, do we think they would all have been prioritized in the past? Are these all critical bugs that would have all been addressed in a timely fashion or are they getting done because its easier to do. Another way to a…

> do we think we're discovering that Chrome had more big holes than we thought or are we raising the security bar by fixing smaller holes?

To me the most probable explanation is that they automated a way to find (and fix) existing vulnerabilities in a way that was not possible before.

Some holes were probably very small, some were probably almost impossible to actually exploit, I don't doubt it. But still, I find it very hard to not consider this a strong security improvement overall (unless they made those numbers up)

Re: Google fixed more Chrome bugs in June than over the past two years, thanks to AI

#499
post #494

Earlier quoted context omitted.

This is kind of a weird take. If you were the CEO of Amazon, would you be setting up channels for people to talk about their AI failures? The general way technology is deployed is that we try to find ways to make it work, because those are the most interesting. We're not as interested in all the ways it doesn't work. From my perspective, some people are trying to use AI in the same way somebody might use a laptop to…

>The general way technology is deployed is that we try to find ways to make it work, because those are the most interesting. That's not the way AI is being deployed. At all.

Sure it is. It's just like the .com bust: people didn't know what the internet was good for, so they did a lot of stupid stuff with it before settling on the most interesting uses.

Re: Google fixed more Chrome bugs in June than over the past two years, thanks to AI

#500

Earlier quoted context omitted.

This is kind of a weird take. If you were the CEO of Amazon, would you be setting up channels for people to talk about their AI failures? The general way technology is deployed is that we try to find ways to make it work, because those are the most interesting. We're not as interested in all the ways it doesn't work. From my perspective, some people are trying to use AI in the same way somebody might use a laptop to…

> If you were the CEO of Amazon, would you be setting up channels for people to talk about their AI failures? I would set up channels to talk about AI, encouraging both successes and failures, with proofs required for both, and punishing people who intentionally misreport on either.

Wow. Setting up a forum for discussion where people could potentially be punished for what they say is not going to encourage discussion.
Post reply on HN