Earlier quoted context omitted.
Seems more like the opposite vein, JSON's lack of comments or other affordances has kept it safe from footguns
Of all the problems with YAML, how is comments a footgun?
[dead]
AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira
161–170 of 179 posts
Re: AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira
#162It's interesting to look at what was being attempted when the vulnerability was introduced[0] > Workflows like jira_close.yml use deprecated atlassian JIRA actions and have a dependency on the gh-actions repo. This is not ideal and unecessarily complex. PR updates jira_close workflow to use direct API calls via curl. It preserves custom fields used too. I won't speak to this projects' management and how they prioriti…
>companies are going to have to start realizing that code is not free to review or maintain
What do you mean, we have both Claude and Cursor review our CC PRs. /s
Re: AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira
#163Earlier quoted context omitted.
Yeah, the YAMLification of everything kinda killed my ability to understand "everything". Previously, if you knew the Linux userland well, I felt like you could figure anything out with enough digging. Take CI for example, it was Jenkins and it ran a csh/bash/zsh whatever script and captured the output. Nice and simple (even if the scripts sometimes got insane). GitHub actions is nothing like that. Weird home grown e…
Lack of a local runner is my biggest peeve. Any novel GHA workflow creation results in a PR with 100 commits, until you can finally sort out all the non-obvious idiosyncrasies. For any modestly complex workflow, I move everything to a bash or TS file and call that, and then you can use _coding tools_ and a _local_ dev/eval loop. How funny that GitHub Actions' lack of tools forces you to make a bunch of billed cloud r…
A local runner would certainly help, but only to some extend. When you need to support multiple OS (Windows, Linux, macOS) and architecture (x64, arm64), not everything can be tested locally.
Re: AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira
#164[flagged]
Re: AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira
#165Why is the original pattern (with the env var in double quotes) not vulnerable? Why can you close the single quotes early but you can't just include double quotes in your title? Is it something to do with the GitHub templating?
GitHub has an article about it
https://docs.github.com/en/actions/reference/security/secure...
Re: AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira
#166It's interesting to look at what was being attempted when the vulnerability was introduced[0] > Workflows like jira_close.yml use deprecated atlassian JIRA actions and have a dependency on the gh-actions repo. This is not ideal and unecessarily complex. PR updates jira_close workflow to use direct API calls via curl. It preserves custom fields used too. I won't speak to this projects' management and how they prioriti…
It's completely mad and has the hallmark of an AI generated change, always eager to change one more thing.
Re: AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira
#167[flagged]
Re: AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira
#168We're going to see more of this before we see, hopefully, substantially less of it. What I'm seeing now in industry -- and I think this autofix issue is a precise example of it -- is a natural evolution of the "LGTM!" review that's so prevalent in software development and similar disciplines. For years, the dramatic majority of "code review" was a quick glance followed by "Looks good to me." Sure, critical workflows…
lol keep dreaming bro, mistakes like these were "extroardinarily rare" before LLM companies reared their thieving hands.
Mistakes like this were always common because GHA is evil. If you pull a random action and read the code, chances are it has a few bugs.
Vulnerabilities and bugs are becoming rarer due to AI. We’ve already seen the Linux kernel stamp out vulnerability after vulnerability, some of which have existed for over a decade.
That doesn’t mean AI just does the work. You need highly skilled engineers leading it. Which the Linux kernel has. But yes, AI is good at reading code and finding defects. It’s good today. Not all models, you need a highly quality model, but yes it’s good today.
Re: AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira
#169Re: AI-Generated GitHub Copilot “Autofix” Allowed Compromise of Snowflake's Jira
#170Earlier quoted context omitted.
Yeah, the YAMLification of everything kinda killed my ability to understand "everything". Previously, if you knew the Linux userland well, I felt like you could figure anything out with enough digging. Take CI for example, it was Jenkins and it ran a csh/bash/zsh whatever script and captured the output. Nice and simple (even if the scripts sometimes got insane). GitHub actions is nothing like that. Weird home grown e…
Lack of a local runner is my biggest peeve. Any novel GHA workflow creation results in a PR with 100 commits, until you can finally sort out all the non-obvious idiosyncrasies. For any modestly complex workflow, I move everything to a bash or TS file and call that, and then you can use _coding tools_ and a _local_ dev/eval loop. How funny that GitHub Actions' lack of tools forces you to make a bunch of billed cloud r…
Try writing a regression test for your Github Action.. I'll wait.
It's a pretty ridiculously half-baked feature. But a lot of these devtools are--it's arguably even worse in the observability vertical. You have all these metrics and dashboards you're using to make critical business and operational decisions yet no way to actually ensure they're telling you what you think they are. Clown shit.