Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira

wiz.io

Post reply on HN
Print view View original

61–70 of 179 posts

Re: AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira

#61

Post by fragmede »

muvlon wrote: post #51
doix wrote: post #46

Earlier quoted context omitted.

Yeah, the YAMLification of everything kinda killed my ability to understand "everything". Previously, if you knew the Linux userland well, I felt like you could figure anything out with enough digging. Take CI for example, it was Jenkins and it ran a csh/bash/zsh whatever script and captured the output. Nice and simple (even if the scripts sometimes got insane). GitHub actions is nothing like that. Weird home grown e…

And worse: GitHub Actions not a full-fledged programming environment by itself either, so you're inevitably going to have to deal with nontrivial shell scripts on top of all the YAML mess.

Yeah. It makes sense when you're standing right next to it, but you take a step back and go "that doesn't look right". GitHub actions is the faster horse instead of a car.

Re: AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira

#62

Post by eterm »

ctoth wrote: post #50
fg137 wrote: post #39

Earlier quoted context omitted.

I have seen plenty of "my backlog has never been shorter" comments here. I'm interested in how that turns out 6 months later. In my team, we have plenty of enhancement requests from users. We address those that make obvious sense and are trivial to do but withhold from others, even though the code change itself is likely small. Because we don't know if there is more than a single user that can actually benefit from i…

> but withhold from others, even though the code change itself is likely small. Prediction: programming is going to change massively not only because the cost of creating code will go down, but because people are so tired of this sort of gatekeeping "we know better" from programmers.

What you're describing as "gatekeeping" is actually Product Ownership and should be applauded, because the alternative is a product owner who abdicates responsibility to the customer.

Re: AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira

#64

Post by an0malous »

madeofpalk wrote: post #43
an0malous wrote: post #41

Earlier quoted context omitted.

Seems more like the opposite vein, JSON's lack of comments or other affordances has kept it safe from footguns

Of all the problems with YAML, how is comments a footgun?

> or other affordances

Re: AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira

#66

Post by vultour »

galnagli wrote: post #33
vultour wrote: post #25

The first linked PR (#1218) has only one commit co-authored by Copilot and it's not related to the vulnerability, and neither are the other suggestions in the PR. Am I missing something?

Github is having some problems -- will check! thanks a lot!

I must be too tired because I cannot figure out what happened in that pull request. The PR/source branch was over a year old with none of the commits adding up to the full diff. There is [1], which introduced the vulnerability but didn't remove the environment variables above, then master is merged into it via [2] (but still doesn't show the variables being removed), yet in the full PR diff they're gone.

In any case, I'm pretty sure you misattributed the vulnerability to Copilot because the PR got squash-merged and _all_ of the changes were then attributed to every contributor in that PR, despite Copilot only appearing on one of the commits.

[1] https://github.com/snowflakedb/snowflake-connector-net/commi...

[2] https://github.com/snowflakedb/snowflake-connector-net/commi...

Re: AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira

#67

Post by datadrivenangel »

ctoth wrote: post #50
fg137 wrote: post #39

Earlier quoted context omitted.

I have seen plenty of "my backlog has never been shorter" comments here. I'm interested in how that turns out 6 months later. In my team, we have plenty of enhancement requests from users. We address those that make obvious sense and are trivial to do but withhold from others, even though the code change itself is likely small. Because we don't know if there is more than a single user that can actually benefit from i…

> but withhold from others, even though the code change itself is likely small. Prediction: programming is going to change massively not only because the cost of creating code will go down, but because people are so tired of this sort of gatekeeping "we know better" from programmers.

And the software without gatekeepers will be regarded as confusing and complicated or buggy.

The work to go from software to usable software system is vast.

Re: AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira

#68

Post by stronglikedan »

xgulfie wrote: post #48
anonymars wrote: post #26

Earlier quoted context omitted.

In a similar vein, JSON's lack of comments makes me marvel at how consistently JavaScript seems to choose the worse option. I'm oh so glad it found its way into config files

I've seen people put "//" keys in their json lol

It's not terrible as far as I know, and it's less ambiguous than putting a "comment" key. I like it!

Re: AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira

#70

Post by inahga »

netdevphoenix wrote: post #49
inahga wrote: post #37

I probably would have made the same mistake. It is negligent to write GitHub Actions without using static analysis. Use zizmor in CI https://github.com/zizmorcore/zizmor error[template-injection]: code injection via template expansion --> .github/workflows/jira_issue.yml:24:29 | 22 | run: | | --- this run block 23 | # Escape special characters in title and body 24 | TITLE=$(echo '${{ github.event.issue.title }}' | se…

Difference is you are not a trillion dollar plus technology hyped as a harbinger of civilisational change.

Sadly I'm not. Either way, how LLMs work mean that traditional software analysis tools are every bit as important as they were in the before times. This is why we see a lot of hype around LLMs and formal verification.
Post reply on HN