For those of you who don't want to click into linked in, https://hackerone.com/reports/3125832 is the latest example of a invalid curl report
Curl: We still have not seen a valid security report done with AI help
131–140 of 258 posts
Re: Curl: We still have not seen a valid security report done with AI help
#132Earlier quoted context omitted.
I recently had this happen from a senior engineer. What's really frustrating is I TOLD them the issues and how to fix it. Instead of listening to what I told them, they plugged it into GPT and responded with "Oh, interesting this is what GPT says" (Which, spoiler, was similar but lacking from what I'd said). Meaning, instead of listening to a real-life expert in the company telling them how to handle the problem they…
>They view it as a shortcut to problem solve and it isn't Oh but it is, used wisely. One: it's a replacement for googling a problem and much faster. Instead of spending half an hour or half a day digging through bug reports, forum posts, and stack overflow for the solution to a problem. LLMs are a lot faster, occasionally correct, and very often at least rather close. Two: it's a replacement for learning how to do so…
There are so many things that a human worker or coder has to do in a day and a lot of those things are non-core.
If someone is trying to be an expert on every minor task that comes across their desk, they were never doing it right.
An error page is a great example.
There is functionality that sets a company apart and then there are things that look the same across all products.
Error pages are not core IP.
At almost any company, I don't want my $200,000-300,000 a year developer mastering the HTML and CSS of an error page.
Re: Curl: We still have not seen a valid security report done with AI help
#133Shame they need to put up with that spam. However, every big open source project has by now had good contributions with "AI help". Many millions of developers are using AI a little as a tool, like Google.
And most contributions with 'AI help' tend to not follow the code practices of the code base itself, while also in general generating worse code.
Also, just like in HTTP stuff 'if curl does it its probably right', I'm also tend to think that 'if the curl team says something its bullshit its probably bullshit'.
Re: Curl: We still have not seen a valid security report done with AI help
#134Something that really frustrates me about interacting with (some) people who use AI a lot is that they will often tell me things that start “I asked ChatGPT and it said…” stop it!!! If the chatbot taught you something and you understood it, explain it to me. If you didn’t understand or didn’t trust it, then keep it to yourself!
Re: Curl: We still have not seen a valid security report done with AI help
#135Earlier quoted context omitted.
Reputation systems for this kind of thing sounds like rubbing some anti-itch cream on bullet wound. I feel like the problem seems to me to be behavior, not a technology issue. Personally I can't imagine how miserable it would be for my hard-earned expertise to be relegated to sifting through SLOP where maybe 1 in hundreds or even thousands of inquiries is worth any time at all. But it also doesn't seem prudent to jus…
I guess I'm confused by your position here. > I feel like the problem seems to me to be behavior, not a technology issue. Yes, it's a behavior issue, but that doesn't mean it can't be solved or at least minimized by technology, particularly as a technology is what's exacerbating the issue? > It's fundamentally about trust in people. Who is lacking trust in who here?
Re: Curl: We still have not seen a valid security report done with AI help
#136Earlier quoted context omitted.
But is "I asked chatgpt" assigning any authority to it? I use precisely that sentence as a shorthand for "I didn't know, looked it up in the most convenient way, and it sounded plausible enough to pass on".
In my own experience, the vast majority of people using this phrase ARE using it as a source of authority. People will ask me about things I am an actual expert in, and then when they don’t like my response, hit me with the ol’ “well, I asked chatGPT and it said…”
Re: Curl: We still have not seen a valid security report done with AI help
#137Earlier quoted context omitted.
We cannot blame the tools for how they are used by those yielding them. I can use ChatGPT to teach me and understand a topic or i can use it to give me an answer and not double check and just copy paste. Just shows off how much you care about the topic at hand, no?
This subthread was about blaming people, not the tool.
Re: Curl: We still have not seen a valid security report done with AI help
#138Earlier quoted context omitted.
It is not about stating a source, the bad thing is treating chatGPT as an authoritative source like it is a subject matter expert.
But is "I asked chatgpt" assigning any authority to it? I use precisely that sentence as a shorthand for "I didn't know, looked it up in the most convenient way, and it sounded plausible enough to pass on".
Just do the research, and you don't have to qualify it. "GPT said that Don Knuth said..." Just verify that Don said it, and report the real fact! And if something turns out to be too difficult to fact check, that's still valuable information.
Re: Curl: We still have not seen a valid security report done with AI help
#139Something that really frustrates me about interacting with (some) people who use AI a lot is that they will often tell me things that start “I asked ChatGPT and it said…” stop it!!! If the chatbot taught you something and you understood it, explain it to me. If you didn’t understand or didn’t trust it, then keep it to yourself!
I find that only acceptable (only little annoying) when this is some lead in case we're we have no idea what could be the issue, it might help to brainstorm and note that this is not verified information is important. most annoying is when people trust chatgpt more that experts they pay. we had case when our client asked us for some specific optimization, and we told him that it makes no sense, then he asked the othe…
English please
Re: Curl: We still have not seen a valid security report done with AI help
#140Shame they need to put up with that spam. However, every big open source project has by now had good contributions with "AI help". Many millions of developers are using AI a little as a tool, like Google.
I unironically can't remember a single case where AI managed to find a vulnerability in an open source project. And most contributions with 'AI help' tend to not follow the code practices of the code base itself, while also in general generating worse code. Also, just like in HTTP stuff 'if curl does it its probably right', I'm also tend to think that 'if the curl team says something its bullshit its probably bullshi…