Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira

wiz.io

Post reply on HN
Print view View original

71–80 of 179 posts

Re: AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira

#71

Post by rawgabbit »

rafram wrote: post #40
rawgabbit wrote: post #31

Earlier quoted context omitted.

Help me understand. Snowflake configured their Github repo to allow auto fixes by Copilot. It got merged automatically without anyone's review? And introduced essentially script-injection vulnerability through the title field? If this is the case, I would say Snowflake should shut down its repo and get off Github asap.

No. A Snowflake maintainer opened a PR, Copilot suggested a change (introducing a vulnerability), the maintainer accepted and committed it to their PR, and another Snowflake maintainer approved and merged the PR.

Thanks.

Re: AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira

#72

Post by reddalo »

xgulfie wrote: post #48
anonymars wrote: post #26

Earlier quoted context omitted.

In a similar vein, JSON's lack of comments makes me marvel at how consistently JavaScript seems to choose the worse option. I'm oh so glad it found its way into config files

I've seen people put "//" keys in their json lol

I've also seen using "__" as a key for comments. I think it's better because it doesn't need to be escaped.

Re: AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira

#73

Post by kozikow »

Issues will happen AI, or not AI. It's same as "self driving car made an accident"!

I'm not saying blindly trusting auto-fix is not bad. I'm just saying that interpreting singular issue as way to downplay AI-assisted engineering without giving a "denominator" is not honest reporting.

Re: AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira

#75

Post by bonoboTP »

netdevphoenix wrote: post #49
inahga wrote: post #37

I probably would have made the same mistake. It is negligent to write GitHub Actions without using static analysis. Use zizmor in CI https://github.com/zizmorcore/zizmor error[template-injection]: code injection via template expansion --> .github/workflows/jira_issue.yml:24:29 | 22 | run: | | --- this run block 23 | # Escape special characters in title and body 24 | TITLE=$(echo '${{ github.event.issue.title }}' | se…

Difference is you are not a trillion dollar plus technology hyped as a harbinger of civilisational change.

It can be that while also causing problems. It's like when a self driving car crashes, it's big news and everyone runs around like their pants are on fire. When a human driver crashes, it's a blip on local news or not even that.

Re: AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira

#76

Post by croemer »

vultour wrote: post #25

The first linked PR (#1218) has only one commit co-authored by Copilot and it's not related to the vulnerability, and neither are the other suggestions in the PR. Am I missing something?

You're correct. The issue was introduced in this commit by a human not by copilot: https://github.com/snowflakedb/snowflake-connector-net/pull/...

However, GitHub Advanced Security, a bot, flagged something but not the real issue. So maybe that bot contributed a false sense of security.

Commit: https://github.com/snowflakedb/snowflake-connector-net/pull/...

Re: AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira

#78

Post by croemer »

vultour wrote: post #66
galnagli wrote: post #33

Earlier quoted context omitted.

Github is having some problems -- will check! thanks a lot!

I must be too tired because I cannot figure out what happened in that pull request. The PR/source branch was over a year old with none of the commits adding up to the full diff. There is [1], which introduced the vulnerability but didn't remove the environment variables above, then master is merged into it via [2] (but still doesn't show the variables being removed), yet in the full PR diff they're gone. In any case,…

Yes, it's misattributed, a human introduced it: https://github.com/snowflakedb/snowflake-connector-net/pull/...

Re: AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira

#79

Post by voakbasda »

procone wrote: post #19

YAML is a nightmare fuel spec. In its quest to make markup "human readable", it has created countless footguns. I honestly prefer XML at this point.

When I see YAML in a product tech stack, I know that the developers have probably made other similarly poor life decisions and try to steer clear of the entire iceberg.

Re: AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira

#80

Post by hutattedonmyarm »

xgulfie wrote: post #48
anonymars wrote: post #26

Earlier quoted context omitted.

In a similar vein, JSON's lack of comments makes me marvel at how consistently JavaScript seems to choose the worse option. I'm oh so glad it found its way into config files

I've seen people put "//" keys in their json lol

There _is_ a json variant with comments, so that’s what you’ve seen. Not all parsers support that though
Post reply on HN