Live data from Hacker News

AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira

wiz.io

151–160 of 179 posts

Re: AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira

#151
post #117

Earlier quoted context omitted.

Difference is in how you sell it. We all know that people make mistakes. I.e. crash a car from time to time. We all are sold a view that AI will save humanity, cure all diseases, solve all problems, allow for autonomous driving and many other (lies?). While making basic mistakes or crashing on trivial crossroads.. Hype is way overblown.

The anti-hype is also way overblown. Nobody is saying that today's AI is omniscient and never makes mistakes. Future models will make fewer mistakes. They will still not hook into the universe with a cheat code and do everything at 100 percent reliability. It's a straw man.

Overblown? Not really. There is still not enough of criticism given asinine hype given by the LLM and adjacent companies.

Funny of you to mention strawman after presenting one.

Re: AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira

#152
post #50
post #39

Earlier quoted context omitted.

I have seen plenty of "my backlog has never been shorter" comments here. I'm interested in how that turns out 6 months later. In my team, we have plenty of enhancement requests from users. We address those that make obvious sense and are trivial to do but withhold from others, even though the code change itself is likely small. Because we don't know if there is more than a single user that can actually benefit from i…

> but withhold from others, even though the code change itself is likely small. Prediction: programming is going to change massively not only because the cost of creating code will go down, but because people are so tired of this sort of gatekeeping "we know better" from programmers.

Knock yourself out and change the world, absolutely nobody is stopping you. That you haven’t already does tell us something though.

Re: AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira

#154
post #81

Earlier quoted context omitted.

Shell scripts on their own already are so perilous without static analysis. I'll never understand how we ended up deciding that embed them in yaml instead of requiring an external script file was a reasonable idea.

YAML seems reasonable because it allows the sequence of steps to be treated as data , which then enables GUI visualisation, introspection, etc... without actually having to run anything. That's critical for a platform like GitHub and for devops pipelines in general. The failure is that "data" ends up being a "terrible custom DSL" that is bad at everything: Not good at data, not a good DSL, and not even a proper progr…

nit, CUE is independent from Google now, Marcel left to work on it full time years ago with some other folks, they started a company

Re: AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira

#155

We're going to see more of this before we see, hopefully, substantially less of it. What I'm seeing now in industry -- and I think this autofix issue is a precise example of it -- is a natural evolution of the "LGTM!" review that's so prevalent in software development and similar disciplines. For years, the dramatic majority of "code review" was a quick glance followed by "Looks good to me." Sure, critical workflows…

That's mostly because at some point a wave of nonsense swept over the field that brought with it the Scrum master, agile, pairing, middle managers thinking up elaborate Git branching schemes (they don't understand Git) and of course, the mandatory code review.

It's best to take all these things in moderation.

Re: AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira

#156
post #117

Earlier quoted context omitted.

Difference is in how you sell it. We all know that people make mistakes. I.e. crash a car from time to time. We all are sold a view that AI will save humanity, cure all diseases, solve all problems, allow for autonomous driving and many other (lies?). While making basic mistakes or crashing on trivial crossroads.. Hype is way overblown.

The anti-hype is also way overblown. Nobody is saying that today's AI is omniscient and never makes mistakes. Future models will make fewer mistakes. They will still not hook into the universe with a cheat code and do everything at 100 percent reliability. It's a straw man.

The hype has significant real-world consequences such as nonsensical amounts of funding and valuations that could crash the world economy at some point. Until there some "check" on this system, i think the anti-hype is quite valid.

Re: AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira

#157
Where’s the bullet point about the way we do programming being horrible? Not even the work, but the tools and languages afforded to us.

github.event.issue.title is very obviously data. It should never be POSSIBLE to treat that as an instruction.

Furthermore, the idea of any code being able to access the tokens instead of allowlisted software and only with specific commands, and also no housekeeping to prevent the DATA of the token from ever being sent to anything other than a desired host… all of it feels fundamentally wrong.

The fact that our OSes don’t help with that is so saddening.

Re: AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira

#158
post #46
post #19

YAML is a nightmare fuel spec. In its quest to make markup "human readable", it has created countless footguns. I honestly prefer XML at this point.

Yeah, the YAMLification of everything kinda killed my ability to understand "everything". Previously, if you knew the Linux userland well, I felt like you could figure anything out with enough digging. Take CI for example, it was Jenkins and it ran a csh/bash/zsh whatever script and captured the output. Nice and simple (even if the scripts sometimes got insane). GitHub actions is nothing like that. Weird home grown e…

Lack of a local runner is my biggest peeve. Any novel GHA workflow creation results in a PR with 100 commits, until you can finally sort out all the non-obvious idiosyncrasies. For any modestly complex workflow, I move everything to a bash or TS file and call that, and then you can use _coding tools_ and a _local_ dev/eval loop.

How funny that GitHub Actions' lack of tools forces you to make a bunch of billed cloud runs with GitHub for workflow edits. I'm sure their PMs are very concerned about this trend.

Re: AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira

#159

Why is the original pattern (with the env var in double quotes) not vulnerable? Why can you close the single quotes early but you can't just include double quotes in your title? Is it something to do with the GitHub templating?

i'm not sure if there was an original pattern where the env var was in double quotes.

https://github.com/snowflakedb/snowflake-connector-net/pull/...

but if you have:

X=$(echo "$BLAH")

then in bash I believe this is safe, because bash will just substitute this as putting the BLAH variable as the first argument to echo without doing any further parsing. without the double quotes can be safe as well but more risky.

X=$(echo $BLAH)

and the only difference is bash will split the arguments. so if you have BLAH="x y" then bash will pass two arguments to echo. though, this can be dangerous if the command you are invoking has dangerous command line options.

however, they had something similar to:

TITLE=$(echo '${{ github.event.issue.title }}')

and this ${{ }} is some kind of template substitution that is happening before the command is sent to bash. so if the variable `github.event.issue.title` was `foo bar` then bash sees something like:

TITLE=$(echo 'foo bar')

and then you start to have problems because `'` can be put into the title to escape.

the bash variable substitution will protect you in a lot of cases from command line injection but if you pass user input directly into command evaluation without using variables then bash can't protect you.

Re: AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira

#160
post #87

Earlier quoted context omitted.

There _is_ a json variant with comments, so that’s what you’ve seen. Not all parsers support that though

Are you denying what I've seen with my own eyes? I am saying it was an object like this: { "//":"make sure these are divisible by 8", "width": 640, "height": 480 }

Oooh, I misunderstood. I thought you were seeing this: https://jsonc.org/
Post reply on HN