Of course it did, why would github copilot “care about” security, unless the majority of code on github cared about security?
GitHub Copilot Generated Insecure Code in 40% of Circumstances During Experiment
131–140 of 161 posts
Re: GitHub Copilot Generated Insecure Code in 40% of Circumstances During Experiment
#132It's painful to see that GitHub Copilot is called "AI". For god's sake, it is not AI. It's just an advanced auto-complete for coders. GPT-3 is close to AI, GitHub Copilot is not.
Jesus Christ, please make them stop. Stop using AI as a buzzword.
Re: GitHub Copilot Generated Insecure Code in 40% of Circumstances During Experiment
#133It's painful to see that GitHub Copilot is called "AI". For god's sake, it is not AI. It's just an advanced auto-complete for coders. GPT-3 is close to AI, GitHub Copilot is not. Jesus Christ, please make them stop. Stop using AI as a buzzword.
Is it fair to call it an ML based system?
Re: GitHub Copilot Generated Insecure Code in 40% of Circumstances During Experiment
#134I thought this should have been expected. Security starts with deep understanding. Some standards and practices can help avoid some types of problems, and some are even rather effective (like airgapping your systems), but there isn't any way to assure security in general other than truly understand what you are doing. ** I feel like Copilot is the wrong direction to optimize development. This is mostly going to help…
Do you think only experts should be programming? I'm an amateur programmer, and I think copilot could help me a lot with unimportant things, as you said - I even tried to install it but I'm not on some list. I can read code, and have built a few programs - I've hired around 30 different programmers in my life, and the vast majority clearly are copy-pasters-adapters. The way I see it, that happens because programming…
This assuming most people using copilot are going to properly read generated code.
Re: GitHub Copilot Generated Insecure Code in 40% of Circumstances During Experiment
#135Earlier quoted context omitted.
I love that we always use the average here for these justifications. We just slowly chip away and any and all excellence. 10x memes aside, we all know what it's like to work with a truly talented and productive engineer versus your everyday schmoe collecting a paycheck. It's a story as old as time, and yet here we are doing the exact big factory industrialization techniques other industries have done and that is comm…
I disagree. 40% is not great, but unlike the masses of developers, this is a single system that can improve over time. Further, a system that can do most of the work but requires a security specialist to polish it is still a useful tool. What's important to recognize is that this is not a terribly novel concept. Unsecure code is written every day.
> unlike the masses of developers, this is a single system that can improve over time
I’d say the exact opposite. Unlike this algorithm, developers can continue to learn. There will likely be future algorithms that are improvements, but this isn’t that.
Re: GitHub Copilot Generated Insecure Code in 40% of Circumstances During Experiment
#136Earlier quoted context omitted.
I love that we always use the average here for these justifications. We just slowly chip away and any and all excellence. 10x memes aside, we all know what it's like to work with a truly talented and productive engineer versus your everyday schmoe collecting a paycheck. It's a story as old as time, and yet here we are doing the exact big factory industrialization techniques other industries have done and that is comm…
Wasn't there a thread here just yesterday about how 6% of some class of AI outperformed a human, but then it turned out that 0% outperformed two humans? That's also literally the lesson Uber learned the hard way when a SDV ran over a person (that zero humans is worse than one, and one is worse than two). This is also the principle behind code review, peer review, QA, middle management bureaucracy, and a whole lot of…
A common quip is that most benchmarks are of the performance of humans who aren’t really paying attention (because while building datasets, they’re doing this repetitive task over and over and over). So better than the average human benchmark isn’t generally great.
Re: GitHub Copilot Generated Insecure Code in 40% of Circumstances During Experiment
#137It's painful to see that GitHub Copilot is called "AI". For god's sake, it is not AI. It's just an advanced auto-complete for coders. GPT-3 is close to AI, GitHub Copilot is not. Jesus Christ, please make them stop. Stop using AI as a buzzword.
Is it fair to call it an ML based system?
Why not? GitHub Copilot was trained with ML to autocomplete your code. But it is not AI.
Re: GitHub Copilot Generated Insecure Code in 40% of Circumstances During Experiment
#138It's painful to see that GitHub Copilot is called "AI". For god's sake, it is not AI. It's just an advanced auto-complete for coders. GPT-3 is close to AI, GitHub Copilot is not. Jesus Christ, please make them stop. Stop using AI as a buzzword.
GitHub Copilot is literally GPT adapted for code. The paper on OpenAI Codex, the stuff powering Copilot, makes it very clear in the abstract. https://arxiv.org/abs/2107.03374
Either you call both AI or you call neither AI.
(A previous version of the comment stated that it was tuned from GPT-3. This is incorrect; the simpler GPT was used for faster convergence.)
Re: GitHub Copilot Generated Insecure Code in 40% of Circumstances During Experiment
#139It's painful to see that GitHub Copilot is called "AI". For god's sake, it is not AI. It's just an advanced auto-complete for coders. GPT-3 is close to AI, GitHub Copilot is not. Jesus Christ, please make them stop. Stop using AI as a buzzword.
GitHub Copilot is literally GPT adapted for code. The paper on OpenAI Codex, the stuff powering Copilot, makes it very clear in the abstract. https://arxiv.org/abs/2107.03374 Either you call both AI or you call neither AI. (A previous version of the comment stated that it was tuned from GPT-3. This is incorrect; the simpler GPT was used for faster convergence.)
If I have to choose, then I would decide not to call them AI at all.
Re: GitHub Copilot Generated Insecure Code in 40% of Circumstances During Experiment
#140My take on Copilot has not changed.
I believe it will make programmers that produce junk code more productive, by being able to produce more junk code in less time.