Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We found a division by zero bug in FFmpeg with a vibecoded fuzzer

code.ffmpeg.org

Post reply on HN
Print view View original

51–60 of 274 posts

Re: We found a division by zero bug in FFmpeg with a vibecoded fuzzer

#51

Post by TacticalCoder »

krona wrote: post #36
nonethewiser wrote: post #34

Earlier quoted context omitted.

No one can keep up with the volume of code AI produces. We wont stop using AI. We will use AI to check AI. Of course this is crazy, but it will also unlock pretty insane scaling and productivity and ultimately we will manage it on either end via requirements and tests.

You're suggesting that LLMs get better at fixing bugs/vulnerabilities, but at the same time stop getting better at finding them? What if this difference is inherent and essential?

> You're suggesting that LLMs get better at fixing bugs/vulnerabilities, but at the same time stop getting better at finding them?

Are you implying that all code writing by LLMs atm is bug-free?

Re: We found a division by zero bug in FFmpeg with a vibecoded fuzzer

#52

Post by saghm »

Supermancho wrote: post #3
dabinat wrote: post #2

It’s interesting how AI may both raise and lower the quality of software. It’s very easy to send an AI agent on an open-ended bug hunt, and if it wastes a bunch of time and effort and finds nothing, no big deal. Time is much more important for a human developer with a salary.

I don't care if you call it an over-engineered looping machine or what, there are concrete benefits to using LLMs for this. They work faster than developing your own looping algorithm and more often produce useful results than not.

It's not even like fuzzers are valuable because of the process they use specifically either; the value is that they produce a concrete input that you can use as a reproducible test case at that point. The value could be produced by gazing into a crystal ball for all I care, as long as I can use what it gives me to reproduce a bug.

Re: We found a division by zero bug in FFmpeg with a vibecoded fuzzer

#53

Post by TacticalCoder »

souvlakee wrote: post #49

It is interesting that FFmpeg has its own Git server. Maybe we should move there too?

> It is interesting that FFmpeg has its own Git server. Maybe we should move there too?

Git is a DVCS. I know many people only ever used Git through Github and forgot what the 'D' in DVCS means but whether or not they remember what the 'D' stands for, running your own Git server is trivial. Especially in this day and age of LLMs were you can just ask: "Clone this repo and convert it to base Git repo and serve it on the LAN PLZ KTHX".

The result is going to be more stable than Github and, arguably, more secure too.

Re: We found a division by zero bug in FFmpeg with a vibecoded fuzzer

#54

Post by Spivak »

hn_submit wrote: post #38
shevy-java wrote: post #14

Earlier quoted context omitted.

I dislike AI, but if AI finds real bugs then this is in my opinion objectively a positive thing. Of course the question is what constitutes a real bug.

A.I. is useful for this. But it would be even more useful if all new code were written in Rust or some other memory-safe language. A.I. could also be used to port C/C++ codebases to Rust, which isn't economically feasible at the moment.

I mean I get the sentiment but Rust won't save you against division by zero, it'll just panic at runtime like every other language.

Re: We found a division by zero bug in FFmpeg with a vibecoded fuzzer

#55

Post by snailmailman »

souvlakee wrote: post #49

It is interesting that FFmpeg has its own Git server. Maybe we should move there too?

Lots of projects run their own git or forgejo or similar. I run my own private forge, and it has a higher uptime than GitHub. (A shockingly low bar, tbh)

It’s surprisingly simple to setup, and the hardware requirements are pretty small for a private or small forge, as it’s usually a relatively small number of users/repos/etc.

Re: We found a division by zero bug in FFmpeg with a vibecoded fuzzer

#58

Post by owebmaster »

pixl97 wrote: post #16
shevy-java wrote: post #15

Earlier quoted context omitted.

> LLMs do find bugs, do save time They find bugs but whether they save time is nowhere near as clear as you try to insinuate here.

They save time in finding bugs.

Unless it's finding a bug it added then it's time wasted x2

Re: We found a division by zero bug in FFmpeg with a vibecoded fuzzer

#59

Post by black_knight »

dmix wrote: post #4
dabinat wrote: post #2

It’s interesting how AI may both raise and lower the quality of software. It’s very easy to send an AI agent on an open-ended bug hunt, and if it wastes a bunch of time and effort and finds nothing, no big deal. Time is much more important for a human developer with a salary.

Finding the bugs with LLMs is easy. Reviewing the output, cleaning it up, and making sure it doesn't break something else is the hard part.

This is where I believe strong typing (like, Haskell-strong or stronger) and functional programming in general will be a win. The confidence I have that my fixes are localised when fixing Haskell code is infinitely stronger than fixing even Java, not speak about C, code.

Re: We found a division by zero bug in FFmpeg with a vibecoded fuzzer

#60

Post by duped »

robertlagrant wrote: post #30

What we need is a numeric type that cannot be zero.

For stuff like niche value optimization sure. For practical arithmetic code, nah. Like with this bug, all that changed is that garbage data in gives the user an error that they tried to process garbage data. Adding a new type doesn't make the code better, it just moves the error around. And you really don't want an infix division operator to fail to type check if the right hand side isn't a nonzero type, do you?
Post reply on HN