GitHub Copilot Generated Insecure Code in 40% of Circumstances During Experiment

Post by simion314 » Fri, Sep 03, 2021, 11:48 AM UTC

andix wrote: post #16

lmilcin wrote: post #2

I thought this should have been expected. Security starts with deep understanding. Some standards and practices can help avoid some types of problems, and some are even rather effective (like airgapping your systems), but there isn't any way to assure security in general other than truly understand what you are doing. ** I feel like Copilot is the wrong direction to optimize development. This is mostly going to help…

The real evil here is boilerplate code. I've seen so much boilerplate in the Java or classic .NET Framework world, it's incredible. So many layers of DTOs, Request/Response Models and so on, that could be just generated. Or most of the time even removed completely (that would cost some "architects" their job though). This is also true for a lot of Redux or Angular/NgRx applications. So much boilerplate, that you can'…

Post by carl_dr » Fri, Sep 03, 2021, 11:49 AM UTC

toastal wrote: post #10

You are the free labor copilot to train Microsoft GitHub's Copilot tool. You are responsible for any of those insecure code errors and the diligence require. You will be on the hook for resulting problems. But Microsoft and their home-phoning, tracking-embedded editor will get real people to correct and train their machine for free—with their stated plan of later selling that machine back to us later. I wish there we…

Post by andix » Fri, Sep 03, 2021, 11:54 AM UTC

simion314 wrote: post #21

andix wrote: post #16

Earlier quoted context omitted.

The real evil here is boilerplate code. I've seen so much boilerplate in the Java or classic .NET Framework world, it's incredible. So many layers of DTOs, Request/Response Models and so on, that could be just generated. Or most of the time even removed completely (that would cost some "architects" their job though). This is also true for a lot of Redux or Angular/NgRx applications. So much boilerplate, that you can'…

An IDE or other tools will generate correct boilerplate code. Seems a gripe from someone that prefers hidden magical code that setups code behind their back. The evil is that someone trained an AI on random text , not even with some AST, so you have garbage in so no surprise you get garbage out. A true AI would understand that "the dev wants trough find all lines of text in a file that have this property", the AI jus…

Post by makach » Fri, Sep 03, 2021, 11:55 AM UTC

Post by andix » Fri, Sep 03, 2021, 12:00 PM UTC

lmilcin wrote: post #20

andix wrote: post #16

Earlier quoted context omitted.

The real evil here is boilerplate code. I've seen so much boilerplate in the Java or classic .NET Framework world, it's incredible. So many layers of DTOs, Request/Response Models and so on, that could be just generated. Or most of the time even removed completely (that would cost some "architects" their job though). This is also true for a lot of Redux or Angular/NgRx applications. So much boilerplate, that you can'…

(I have been professionally programming Java backends for the past 16 years). Java is not the culprit here. I think it is something that happened on the way that has something to do with J2EE and patterns craze we had a decade ago or two ago. It doesn't help that frameworks like Spring and their documentation go out of their way to propagate these boilerplate-heavy patters. Copying these lazy patterns is shortest, ea…