Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira

wiz.io

Post reply on HN
Print view View original

111–120 of 179 posts

Re: AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira

#111

Post by worldsayshi »

david_shaw wrote: post #103

We're going to see more of this before we see, hopefully, substantially less of it. What I'm seeing now in industry -- and I think this autofix issue is a precise example of it -- is a natural evolution of the "LGTM!" review that's so prevalent in software development and similar disciplines. For years, the dramatic majority of "code review" was a quick glance followed by "Looks good to me." Sure, critical workflows…

Yeah I agree and I think code forges as well as AI harnesses are kinda the killer apps of this (relatively short) era.

I think once we figure out how to tighten the loop of user feedback, expert analysis, automatic/static verification and AI generation then technology is going to make another leap.

Re: AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira

#112

Post by airstrike »

inahga wrote: post #70
netdevphoenix wrote: post #49

Earlier quoted context omitted.

Difference is you are not a trillion dollar plus technology hyped as a harbinger of civilisational change.

Sadly I'm not. Either way, how LLMs work mean that traditional software analysis tools are every bit as important as they were in the before times. This is why we see a lot of hype around LLMs and formal verification.

The problem is that if everyone is 10x faster with LLMs then we're also wrong ~10x as frequently as we were before

Re: AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira

#114

Post by itintheory »

jeroenhd wrote: post #82
doix wrote: post #46

Earlier quoted context omitted.

Yeah, the YAMLification of everything kinda killed my ability to understand "everything". Previously, if you knew the Linux userland well, I felt like you could figure anything out with enough digging. Take CI for example, it was Jenkins and it ran a csh/bash/zsh whatever script and captured the output. Nice and simple (even if the scripts sometimes got insane). GitHub actions is nothing like that. Weird home grown e…

The things done in yaml today would've been obscure bash oneliners had YAML not existed. Jenkins still exists and it's no less complicated than Github Actions. The complexity gets hidden in obscure script files, obscure tabbed UI, and remote services for doing things Jenkins itself can't do. Defaulting to system tooling makes it almost impossible to predict what a job will do unless you know exactly how paths and too…

> You could copy-paste the Jenkins job, but unless you have Jabberwocky v2018.3 installed in /home/JabberWock/RELEASE, the script will fail.

In my experience, containerization resolved this issue. Now you just need to be able to "docker run public.ecr.aws/carroll/jabberwocky:v2018.3 [etc]".

Re: AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira

#115

Post by ctoth »

ctoth wrote: post #50
fg137 wrote: post #39

Earlier quoted context omitted.

I have seen plenty of "my backlog has never been shorter" comments here. I'm interested in how that turns out 6 months later. In my team, we have plenty of enhancement requests from users. We address those that make obvious sense and are trivial to do but withhold from others, even though the code change itself is likely small. Because we don't know if there is more than a single user that can actually benefit from i…

> but withhold from others, even though the code change itself is likely small. Prediction: programming is going to change massively not only because the cost of creating code will go down, but because people are so tired of this sort of gatekeeping "we know better" from programmers.

Lots of responses to a comment I explicitly did not make. Let me try and spell it out for you folks:

demand was suppressed by an access bottleneck, the bottleneck is gone, expect a magnitude of change proportional to how much demand was actually pent up rather than proportional to how much programmers currently think was reasonable to deny.

Explicit things I am not saying: gatekeeping was bad, feature creep is good or desirable, etc. etc. etc.

Re: AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira

#116

Post by galnagli »

croemer wrote: post #78
vultour wrote: post #66

Earlier quoted context omitted.

I must be too tired because I cannot figure out what happened in that pull request. The PR/source branch was over a year old with none of the commits adding up to the full diff. There is [1], which introduced the vulnerability but didn't remove the environment variables above, then master is merged into it via [2] (but still doesn't show the variables being removed), yet in the full PR diff they're gone. In any case,…

Yes, it's misattributed, a human introduced it: https://github.com/snowflakedb/snowflake-connector-net/pull/...

Thanks @vultour and croemer for your proactiveness -- you are correct,I updated the blog to clarify that Copilot was a co-author that checked the merged PR and code change, and identified it as all-clear without noticing the critical vulnerabilities, it's unclear whether the code-change was AI-Assisted

Re: AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira

#117

Post by pojzon »

bonoboTP wrote: post #75
netdevphoenix wrote: post #49

Earlier quoted context omitted.

Difference is you are not a trillion dollar plus technology hyped as a harbinger of civilisational change.

It can be that while also causing problems. It's like when a self driving car crashes, it's big news and everyone runs around like their pants are on fire. When a human driver crashes, it's a blip on local news or not even that.

Difference is in how you sell it.

We all know that people make mistakes. I.e. crash a car from time to time.

We all are sold a view that AI will save humanity, cure all diseases, solve all problems, allow for autonomous driving and many other (lies?).

While making basic mistakes or crashing on trivial crossroads..

Hype is way overblown.

Re: AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira

#118

Post by phatfish »

bonoboTP wrote: post #75
netdevphoenix wrote: post #49

Earlier quoted context omitted.

Difference is you are not a trillion dollar plus technology hyped as a harbinger of civilisational change.

It can be that while also causing problems. It's like when a self driving car crashes, it's big news and everyone runs around like their pants are on fire. When a human driver crashes, it's a blip on local news or not even that.

Probably because there are 1000x or whatever human driven miles compared to AI. And no one wants to be crippled by an AI have have to fight $billon_dollar_corp for compensation.

Re: AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira

#119

Post by bonoboTP »

pojzon wrote: post #117
bonoboTP wrote: post #75

Earlier quoted context omitted.

It can be that while also causing problems. It's like when a self driving car crashes, it's big news and everyone runs around like their pants are on fire. When a human driver crashes, it's a blip on local news or not even that.

Difference is in how you sell it. We all know that people make mistakes. I.e. crash a car from time to time. We all are sold a view that AI will save humanity, cure all diseases, solve all problems, allow for autonomous driving and many other (lies?). While making basic mistakes or crashing on trivial crossroads.. Hype is way overblown.

The anti-hype is also way overblown. Nobody is saying that today's AI is omniscient and never makes mistakes. Future models will make fewer mistakes. They will still not hook into the universe with a cheat code and do everything at 100 percent reliability. It's a straw man.

Re: AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira

#120

Post by woodruffw »

IncreasePosts wrote: post #84
inahga wrote: post #37

I probably would have made the same mistake. It is negligent to write GitHub Actions without using static analysis. Use zizmor in CI https://github.com/zizmorcore/zizmor error[template-injection]: code injection via template expansion --> .github/workflows/jira_issue.yml:24:29 | 22 | run: | | --- this run block 23 | # Escape special characters in title and body 24 | TITLE=$(echo '${{ github.event.issue.title }}' | se…

Is that project named after the serial nyc subway advertising dermatologist?

Yes :-)
Post reply on HN