Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google fixed more Chrome bugs in June than over the past two years, thanks to AI

blog.google

Post reply on HN
Print view View original

541–550 of 668 posts

Re: Google fixed more Chrome bugs in June than over the past two years, thanks to AI

#541

Post by xyzsparetimexyz »

hn_submit wrote: post #431
gtowey wrote: post #414

Earlier quoted context omitted.

I'll await your Rust ports of Windows, Linux and MacOS then. This isn't really a fair take. Keep in mind that C/C++ has been the backbone of the most important software in the world since the 1970s. At that time we didn't have virtually unlimited compute and memory at our fingertips the way we do now. It was a huge improvement to have a high level language which still could be optimized nearly as well as assembly. It…

C is literally "high level assembly" and therefore lacks any guard rails you'd expect in a programming language. It's just unfortunate that so many software developers embraced C for its speed, even when it wasn't strictly needed. I always remind people that C is a systems programming language and not fit for regular application programming. For that you need an application programming language like Pascal or Java.

How is it high level assembly? Have you written much assembly recently?

Re: Google fixed more Chrome bugs in June than over the past two years, thanks to AI

#542

Post by glimshe »

addaon wrote: post #329
glimshe wrote: post #89

Earlier quoted context omitted.

I don't generally use AI to write code I feel I can write efficiently. In these cases, I'll just ask AI for a review. But when I need to write code in areas I'm less confident about, I'll let AI take the reins and the do a thorough review myself. These instances are not too common, though. I also ask direct questions to AI for brainstorming and advanced programming language usage. In these cases, AI isn't touching th…

> But when I need to write code in areas I'm less confident about, I'll let AI take the reins and the do a thorough review myself. I see this mindset a bunch, and I just don’t get it. Reviewing code is so much harder than writing code! To write code, I need to find one path to achieve my goal, and convince myself, the compiler, and the reviewer that it does so. To review code, I need to consider all reasonable paths…

Seeing a solved problem and verifying the solution's correctness is much easier than solving the problem yourself. it's a bit like riddles. You can find examples of that when studying any topic. I disagree that reviewing code is harder than writing code in all/most instances.

Also, there's code that is just tedious and repetitive to write. AI can write that and reviewing is pretty easy.

Re: Google fixed more Chrome bugs in June than over the past two years, thanks to AI

#543

Post by [deleted] »

rustfreeforme wrote: post #535
thin_carapace wrote: post #509

Earlier quoted context omitted.

if you go around pulling out logic flaw arguments and then proceed to commit logic flaws yourself, it isn't a good look man. the quoted statement was "beyond most intelligent individuals" which contradicts your assertion that the argument was stated as "humans cannot write correct C". anyway I do find it ultra amusing how software engineers believe software engineering is the backbone of programming, when in reality…

[flagged]

[deleted]

Re: Google fixed more Chrome bugs in June than over the past two years, thanks to AI

#544

Post by user43928 »

skydhash wrote: post #524
user43928 wrote: post #514

Earlier quoted context omitted.

In the context of a mobile app the user interface is the main part. Testing and linting often do not cover whether things work or provide decent UX. The 'security layer' is almost irrelevant here. Do you do mobile app development? I would guess not.

Then you would have guessed wrong. Even though a lot of mobile app are just presentation layer for a backend service, there are indeed a few stuff that warrants carefulness. Like any data saved offline. Any update to that offline format means a migration plan unless it’s just a cache for the online data. Then if you support something like multiple organization, you don’t want user data to jump the separation between…

I was not talking about a backend service here.

Regarding clickable vulnerabilities in messaging apps, are you referring to the exploits that were enabled by vulnerabilities in system media parser and browser components?

This has essentially no practical relevance to app implementation.

What we are left with is not corrupting user data, particularly during migrations on app updates.

Compared to the attack surface of a backend service that handles user data, this is trivial.

We agree that the delicate work is presentation and interactions working well on device.

In my opinion this is best supported by extensive manual QA and user testing, rather than code review. This is what unlocks tremendous productivity for mobile app development with AI.

Re: Google fixed more Chrome bugs in June than over the past two years, thanks to AI

#545

Post by unprovable »

MostlyStable wrote: post #467
MostlyStable wrote: post #407

Earlier quoted context omitted.

I just did a search and apparently this fact (the specific one about no payouts for the first time in almost 20 years) has not gotten a discussion on HN. Given the degree of skepticism around the utility of AI bug finding and fixing (this very thread is full of it), I would have thought that concrete evidence that it can help actually make real software more secure against attacks would have gotten a write-up somewhe…

After doing a bit more research, this fact is somewhat less impressive. Apparently, this was also the first time in nearly 20 years that there was such a large capacity crunch and many researchers weren't able to get into the competition. One of the rejected researchers did apparently have a working exploit, which, upon not getting into the event, they responsibly disclosed, and it was then patched before the event.

This was, itself, driven by AI vuln finding, ironically :-P however, I took the example of @ggwhyp's Firefox RCE - quite a long chain, rejected by the organizers but probably would have won some cash from Mozilla... Details aren't public, so we won't know. Maybe their vuln was patched with Bug 2024918? At this point it's anyone's guess...

But the fact that nobody else who made it through had an exploit and claimed $$$ on Firefox tells me that improvements were made.

And this is what blew my mind, personally; a _browser_ - huge, complicated target codebase with myriad features, many of which are 'on the internet' - didn't have any disclosures with money on the table. That's definitely a datapoint worth registering. But you're absolutely right to remain skeptical!

Re: Google fixed more Chrome bugs in June than over the past two years, thanks to AI

#546

Post by IshKebab »

MichaelZuo wrote: post #493
tikhonj wrote: post #478

Earlier quoted context omitted.

A pretty big part of the reason we didn't switch earlier is that most people—certainly most non-technical leaders, but also a lot of engineers—don't value correctness or security enough. We didn't have good alternatives until recently because we did not, collectively, invest in developing these alternatives. One surprising thing is that, in the grand scheme of things, developing an alternative like Rust is not that e…

The real curious thing is serious C/C++ folks seem like one of the least likely groups imaginable, to want to undergo humiliating and embarrassing blunders… Yet they seemingly don’t mind that it practically guarantees them to make blunders over and over again.

Pre-Rust "serious C++ folks" used it because it was the best option if you wanted essentially zero performance overhead no heavy runtime and GC spikes. They didn't like the lack of memory safety but it was seen as an unfortunate but necessary trade-off.

These days most of the sensible people have moved from C++ to Rust and so the "serious C++ folks" are an entirely different distribution of people who are much more inclined to think memory safety isn't a big deal and you just have to not make mistakes.

Re: Google fixed more Chrome bugs in June than over the past two years, thanks to AI

#547

Post by mf2hd »

tstrimple wrote: post #534
cognitiveinline wrote: post #65

Earlier quoted context omitted.

It's the opposite: humans. The most critical one (sandbox escape) has been sitting there for 13 years.

This is the thing the anti-ai zealots will never admit. Humans fucking suck at writing code. They talk about software development as if it's only ever performed by the top 1% of the top 1%. They never acknowledge that humans make mistakes. No. Humans create perfect code every fucking time while LLM's only produce slop. It's such a fucking mind-numbingly stupid position that I have to think they have never actually wo…

Fucking humans and their shitty creations eh?

Re: Google fixed more Chrome bugs in June than over the past two years, thanks to AI

#548

Post by iLoveOncall »

rpdillon wrote: post #500
iLoveOncall wrote: post #470

Earlier quoted context omitted.

> If you were the CEO of Amazon, would you be setting up channels for people to talk about their AI failures? I would set up channels to talk about AI, encouraging both successes and failures, with proofs required for both, and punishing people who intentionally misreport on either.

Wow. Setting up a forum for discussion where people could potentially be punished for what they say is not going to encourage discussion.

That's fine, lies are more harmful than anecdotes are beneficial. There's no forum to discuss the best IDE and people still manage, in reality there's no need for a forum around AI.

Re: Google fixed more Chrome bugs in June than over the past two years, thanks to AI

#549

Post by danielbln »

cubefox wrote: post #61
ikekkdcjkfke wrote: post #15

Earlier quoted context omitted.

Yes. AI is a tool, it’s supposed to be used a certain way, anything else is a misunderstanding og what AI is. You have to aim it in the direction you want it to go, not expect it to solve all your problems magically

LLMs are increasingly not tools anymore but agents. The difference is still one of degree, but it's clear in which direction we are currently moving. It was even clear to some people 10 years ago: https://gwern.net/tool-ai

That article is surprisingly prescient.

Re: Google fixed more Chrome bugs in June than over the past two years, thanks to AI

#550

Post by userbinator »

What remains to be seen is whether Google also introduced more Chrome bugs in June than over the past two years, thanks to AI.

The big problem is that AI output can be very convincing and look "right", even appear to work, until you examine it in detail and realise all the edge-cases it didn't handle.

Post reply on HN