Live data from Hacker News

Potential issues in curl found using AI assisted tools

mastodon.social

141–150 of 203 posts

Re: Potential issues in curl found using AI assisted tools

#141
post #137

Earlier quoted context omitted.

No you can't. You can only pay to transfer them to someone else on top of their own. It's fundamentally different from how a machine or some code makes a task actually go away or at least become smaller.

There are already cheap, domestic robots for cleaning dishes, cleaning the floor, cleaning clothes, making coffee, heating and cooling food, turning screws, drilling holes and so on. All those robots represent a greater than 90 percent (and sometimes a greater than 99 percent) savings in time relative to doing the same tasks manually. You still have to move the objects they operate on around within your house but tha…

I think the 10 percent is more work than you give it credit for.

Re: Potential issues in curl found using AI assisted tools

#142
post #32

Earlier quoted context omitted.

This is a point I see discussed surprisingly little. Given that many (most?) programmers like designing and writing code (excluding boilerplate), and not particularly enjoy reviewing code, it certainly feels backwards to make the AI write the code and relegate the programmer to reviewing it. (I know, of course, that the whole thing is being sold to stakeholders as "LoC machine goes brrrr" – code review? what's that?)

Creativity is fun. AIs automate that away. I want an AI that can do my laundry, fold it, and put it away. I don't need an AI to write code for me. I don't mind AI code review, it sometimes has a valid suggestion, and it's easy enough to ignore most of the rest of the time.

> Creativity is fun. AIs automate that away.

This is the complete opposite of my experiences with using AI Coding tools heavily

Re: Potential issues in curl found using AI assisted tools

#143
post #122

Earlier quoted context omitted.

Exactly. I loved doing novel implementations or abstractions… and the AI excels at the part where it modifies it slightly for different contexts… aka the boring stuff.

But this is how you learn, how you find better ways, by grinding. Getting wild ideas badly implemented on a silver plate is a slot machine, it leads nowhere but in circles.

By grinding what though? I don't wanna grind "Entering characters with my fingers", I wanna grind "Does this design work for getting X to work as I want", which is exactly the sort of things LLMs help me move faster on.

And yes, if you're just using it as a slot machine, I understand it doesn't feel useful. But I don't think that's how most people use it, at least that's not how I use it.

Re: Potential issues in curl found using AI assisted tools

#144
post #137

Earlier quoted context omitted.

No you can't. You can only pay to transfer them to someone else on top of their own. It's fundamentally different from how a machine or some code makes a task actually go away or at least become smaller.

There are already cheap, domestic robots for cleaning dishes, cleaning the floor, cleaning clothes, making coffee, heating and cooling food, turning screws, drilling holes and so on. All those robots represent a greater than 90 percent (and sometimes a greater than 99 percent) savings in time relative to doing the same tasks manually. You still have to move the objects they operate on around within your house but tha…

Unfortunately many things aren't dishwasher safe, some things don't fit in the dishwasher, and often certain types of food are not properly washed off in the dishwasher.

Re: Potential issues in curl found using AI assisted tools

#145
Love this take actually and have been working on this and published this way back 2023/2024. Recently, I've been inspired by Claude-code & Cline agentic flow + tool looping, I experimented the same with tools like file_read, dir_list and throwing in few sast tools, security prompts on Wordpress plugin ecosystem (say with 10k-100k active installation) and scanned around ~600 and to my surprise it yielded ~45 critical, ~120 high severity issues and accounting 20% for non-reachability vuln. Spent around 6$ and ~40 million tokens with grok-4 fast reasoning model and the results were impressive, I gave a try with claude-sonnet but significantly rate-limited despite having 50$ credits from anthropic for research.

You can read about my experience here: https://codepathfinder.dev/blog/introducing-secureflow-cli-t...

Old post: https://shivasurya.me/security-reviews/sast/2024/06/27/autom...

Re: Potential issues in curl found using AI assisted tools

#146
post #20

Earlier quoted context omitted.

I think the big difference is that these aren't AI generated bug reports. They are bugs found with the assistance of AI tools that were then properly vetted and reported in a responsible way by a real person.

In the defense of the language models, the bugs were written by humans in the first place. Human vetting is not much of a defense.

> Human vetting is not much of a defense.

The issue I keep seeing with curl and other projects is that people are using AI tools to generate bug reports and submitting them without understanding (that's the vetting) the report. Because it's so easy to do this and it takes time to filter out bug report slop from analyzed and verified reports, it's pissing people off. There's a significant asymmetry involved.

Until all AI used to generate security reports on other peoples' projects is able to do it with vanishingly small wasted time, it's pretty assholeish to do it without vetting.

Re: Potential issues in curl found using AI assisted tools

#147
post #97

Somehow related: You did this with an AI and you do not understand what you're doing here : https://news.ycombinator.com/item?id=45330378

Yeah, I'm quite confused. See also https://news.ycombinator.com/item?id=44411185 ("AI slop security reports submitted to curl"), and especially https://news.ycombinator.com/item?id=43907376 ("Curl: We still have not seen a valid security report done with AI help")

Re: Potential issues in curl found using AI assisted tools

#148
post #122

Earlier quoted context omitted.

Exactly. I loved doing novel implementations or abstractions… and the AI excels at the part where it modifies it slightly for different contexts… aka the boring stuff.

But this is how you learn, how you find better ways, by grinding. Getting wild ideas badly implemented on a silver plate is a slot machine, it leads nowhere but in circles.

i've done 20 years of grinding thanks. im happy to work at a higher level of abstraction now.

Re: Potential issues in curl found using AI assisted tools

#149
post #20

Earlier quoted context omitted.

I think the big difference is that these aren't AI generated bug reports. They are bugs found with the assistance of AI tools that were then properly vetted and reported in a responsible way by a real person.

In the defense of the language models, the bugs were written by humans in the first place. Human vetting is not much of a defense.

From what I understand some of the bugs where in code the AI made up on the spot, other bug reports had example code that didn't even interact with curl. These things should be relatively easy to verify by a human, just do a text search in the curl source to see if the AI output matches anything.

Hard to compute, easy to verify things should be the case where AI excel at. So why do so many AI users insist on skipping the verify step?

Re: Potential issues in curl found using AI assisted tools

#150
post #18
post #8

Earlier quoted context omitted.

I think it's more about how people are using it. An amateur who spams him with GPT-5-Codex produced bug reports is still a waste of his time. Here a professional ran the tools and then applied their own judgement before sending the results to the curl maintainers.

I keep irritating people with this observation but this was the status quo ante before AI, and at least an AI slop report shows clear intent; you can ban those submitters without even a glance at anything else they send.

The current scale of poor reports was absolutely not the status quo before AI
Post reply on HN