Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira

wiz.io

Post reply on HN
Print view View original

171–179 of 179 posts

Re: AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira

#171

Post by defaultman »

twistedpair wrote: post #158
doix wrote: post #46

Earlier quoted context omitted.

Yeah, the YAMLification of everything kinda killed my ability to understand "everything". Previously, if you knew the Linux userland well, I felt like you could figure anything out with enough digging. Take CI for example, it was Jenkins and it ran a csh/bash/zsh whatever script and captured the output. Nice and simple (even if the scripts sometimes got insane). GitHub actions is nothing like that. Weird home grown e…

Lack of a local runner is my biggest peeve. Any novel GHA workflow creation results in a PR with 100 commits, until you can finally sort out all the non-obvious idiosyncrasies. For any modestly complex workflow, I move everything to a bash or TS file and call that, and then you can use _coding tools_ and a _local_ dev/eval loop. How funny that GitHub Actions' lack of tools forces you to make a bunch of billed cloud r…

[dead]

Re: AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira

#172

Post by kshacker »

bakugo wrote: post #131
kshacker wrote: post #127

Earlier quoted context omitted.

What made you make that assessment?

- Three different instances of "The X is Y" in a single short comment - Relatively new account, "AI Engineer building agentic systems" - Most past comments contain em-dashes, more "The X is Y", etc.

What triggered me to ask was because I can see myself writing that. Not the content but the style. In the old days, I will spend time finessing an argument and feel happy about it. But with the pace nowadays plus the AI, it is a different world, so do not know.

Re: AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira

#173

Post by frollogaston »

jiggawatts wrote: post #148
saghm wrote: post #81

Earlier quoted context omitted.

Shell scripts on their own already are so perilous without static analysis. I'll never understand how we ended up deciding that embed them in yaml instead of requiring an external script file was a reasonable idea.

YAML seems reasonable because it allows the sequence of steps to be treated as data , which then enables GUI visualisation, introspection, etc... without actually having to run anything. That's critical for a platform like GitHub and for devops pipelines in general. The failure is that "data" ends up being a "terrible custom DSL" that is bad at everything: Not good at data, not a good DSL, and not even a proper progr…

The best thing I've seen is just regular JS or Python that outputs some data like JSON or protobuf. Google has a ton of DSLs that do this too, problem is they're DSLs and about 4 people fully understand them.

Re: AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira

#174

Post by frollogaston »

xgulfie wrote: post #48
anonymars wrote: post #26

Earlier quoted context omitted.

In a similar vein, JSON's lack of comments makes me marvel at how consistently JavaScript seems to choose the worse option. I'm oh so glad it found its way into config files

I've seen people put "//" keys in their json lol

I would still prefer that goofiness over YAML

Re: AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira

#175

Post by MiroslavPokorny »

Many OWASP items are injection attacks in some form or another. SQL Injection has been highlighted there and more for over 20 years, and almost nobody learns.

Remember that AI learns its code design by reading the code shared by the masses, which means that while this story highlights a single item, a large number of programmers themselves dont know or understanding this basic problem.

Its probably also a sad example that AI doesnt think it only copies it doesnt actually think about why something should or shouldnt be done.

Re: AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira

#177

Post by saghm »

jiggawatts wrote: post #148
saghm wrote: post #81

Earlier quoted context omitted.

Shell scripts on their own already are so perilous without static analysis. I'll never understand how we ended up deciding that embed them in yaml instead of requiring an external script file was a reasonable idea.

YAML seems reasonable because it allows the sequence of steps to be treated as data , which then enables GUI visualisation, introspection, etc... without actually having to run anything. That's critical for a platform like GitHub and for devops pipelines in general. The failure is that "data" ends up being a "terrible custom DSL" that is bad at everything: Not good at data, not a good DSL, and not even a proper progr…

My point wasn't that YAML is an indefensible choice, but that embedding bash inside the YAML is at least to me not defensible. Making the `run` field take a string that's treated as a path to script within the repo would still give you all of the properties of "this config is data" without any of the nightmares that comes to multiple stacked layers of string interpolation in languages that are each already notorious for bugs from that sort of thing.

Re: AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira

#178

Post by netdevphoenix »

SV_BubbleTime wrote: post #58
netdevphoenix wrote: post #49

Earlier quoted context omitted.

Difference is you are not a trillion dollar plus technology hyped as a harbinger of civilisational change.

I mean… it’s only Monday! But yes, there is an interesting change in the past decade, where everything new must be over-hyped. Perhaps it is attention overload and needing to shout. Perhaps it’s that technological progress has significantly slowed while communication options have exploded (coincidence?). I look at it a lot like EVs. They’re great, if your use case is inside the specific band. But, that isn’t who they…

> But yes, there is an interesting change in the past decade, where everything new must be over-hyped.

Yep, the good old "Our tech is making the world a better place" has gotten old and a new approach was needed. If you are not making standard databases obsolete with a blockchain or MapReduce or gaining business enlightenment from Big Data, no one wants to fund your startup. Civilisation level change is the new upper bound.

Post reply on HN