Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Copilot broke audit logs, but Microsoft won't tell customers

pistachioapp.com

Post reply on HN
Print view View original

311–320 of 324 posts

Re: Copilot broke audit logs, but Microsoft won't tell customers

#311

Post by scott_w »

Karrot_Kream wrote: post #309
scott_w wrote: post #259

Earlier quoted context omitted.

So let me be more direct. The part I'm not confident I'm correct in is this: > AI Agents, instead, directly access the database However, I don't think I'd be too far off the mark given many systems work like this (analytics tools typically hook into your DB, to the chagrin of many an SRE/DevOps) and it's usually marketed as the easy solution. Also, I've since read a few comments and it appears I'm pretty fucking clos…

The correct way to setup an analytics tool is to point it to an analytics db that is a replica of your main DB. It's a pretty common part of an HA setup to replicate your primary to an actual hot read replica and a cold analytics store. This way the analytics tool queries your analytics store and doesn't put load on your hot primary or hot read replica. > I'd say most of my comment is substantively correct, with a di…

> The correct way to setup an analytics tool is to point it to an analytics db that is a replica of your main DB. It's a pretty common part of an HA setup to replicate your primary to an actual hot read replica and a cold analytics store. This way the analytics tool queries your analytics store and doesn't put load on your hot primary or hot read replica.

That doesn’t solve the problem of changing schemas causing issues for your data team at all. Something I see regularly. If you setup an AI Agent the same way you still give it full access, so you still haven’t fixed the problem at hand.

> I read this and feel that you still want imaginary internet points for something that is, at best, directionally correct.

And you’ve yet to substantiate your objection to what I posited (alongside everyone else), so instead you continue to talk about something unrelated in the hope of… what, exactly?

Re: Copilot broke audit logs, but Microsoft won't tell customers

#312

Post by cookiengineer »

Gud wrote: post #114
cookiengineer wrote: post #85

Earlier quoted context omitted.

The difference: Meatbags created something like an education system, where the track record in it functions as a ledger for hiring companies. There is no such thing for AI. No ledger, no track record, no reproducibility.

On the other hand, some of the most capable meat bags said fuck you to your record keeping system and dropped out.

Those meatbags usually have a different form of ledger. Be it open source contributions, built prototypes, apps or games, or other things they've shared before to create a track record of their skillset.

I never claimed that there is one type of ultrageneric ledger that works for all areas of research. But somehow, the LLM world still thinks that is the case for whatever reason.

Re: Copilot broke audit logs, but Microsoft won't tell customers

#313

Post by AdieuToLogic »

mlyle wrote: post #294
AdieuToLogic wrote: post #292

Earlier quoted context omitted.

>> Except that the "systems made out of meat" are the entities which both define the problem needing to be solved and are the sole determiners if said problem has been solved. > It's usually not the same pile of meat defining the problem and solving the problem. True, but this distinction is also irrelevant. The point is that problems capable of being solved by software systems are identified, reified, and then deter…

What if systems develop that are able to understand typical human intention and wants with an accuracy that is superior to most humans? You seem to rule this out, but despite having similar biology and wants, humans misunderstand others' intents and miss cues a lot . -- Is it impossible that humans could build a system to know what a whale wants, based on its vocalization, that does better than the typical whale? Do…

> Is it impossible that humans could build a system to know what a whale wants, based on its vocalization, that does better than the typical whale?

The answer resides in the question. For a human to know what a whale wants is to have an understanding of what it is to be a whale, not deriving a Rosetta Stone[0] such that bidirectional vocalizations could be exchanged.

So is it possible to communicate with a whale? Sure.

But the infeasiblity of cross-species understanding is far more difficult than even what you identified above:

  ... despite having similar biology and wants, humans 
  misunderstand others' intents and miss cues a lot.
Now add to all of this the fact that computer algorithms are just that, and not even having the shared commonality of being mammals, and the possibility of a machine understanding what a human wants is fantastical at best.

0 - https://en.wikipedia.org/wiki/Rosetta_Stone

Re: Copilot broke audit logs, but Microsoft won't tell customers

#314

Post by mlyle »

AdieuToLogic wrote: post #313
mlyle wrote: post #294

Earlier quoted context omitted.

What if systems develop that are able to understand typical human intention and wants with an accuracy that is superior to most humans? You seem to rule this out, but despite having similar biology and wants, humans misunderstand others' intents and miss cues a lot . -- Is it impossible that humans could build a system to know what a whale wants, based on its vocalization, that does better than the typical whale? Do…

> Is it impossible that humans could build a system to know what a whale wants, based on its vocalization, that does better than the typical whale? The answer resides in the question. For a human to know what a whale wants is to have an understanding of what it is to be a whale, not deriving a Rosetta Stone[0] such that bidirectional vocalizations could be exchanged. So is it possible to communicate with a whale? Sur…

I think this is a silly take. Not all species had evolutionary pressure for cross-organism understanding. A different species that has selective pressure for social understanding and greater mental understanding is probably going to understand what an insect wants better than say, another insect.

That is, how well you can understand someone else doesn't depend just on common ground, but perhaps even more on how mature of machinery for understanding that you have.

Re: Copilot broke audit logs, but Microsoft won't tell customers

#315

Post by AdieuToLogic »

Finbel wrote: post #307
AdieuToLogic wrote: post #302

Earlier quoted context omitted.

> 99.99% of the code in that B2B SaaS for finding the cheapest industrial shipping option isn't novel. That's like saying 99.99% of the food people eat consists of protein, carbohydrates, fats, and/or vegetables and therefore isn't novel. The implication being a McDonald's Big Mac and fries is the same as a spinach salad. The only way someone could believe all food is the same as a Big Mac and fries is if this is all…

Calling using a proven tool (LLM agents) to generate code that provide real business value a "fatal flaw" was already hyperbole. The equivalent of not using LLMs in your workflow as a software engineer today isn't eating whole foods. That might have been true a year ago, but today it's becoming more and more equivalent to a fruit only diet.

> The equivalent of not using LLMs in your workflow as a software engineer today isn't eating whole foods. That might have been true a year ago, but today it's becoming more and more equivalent to a fruit only diet.

A software engineer which understands the problem to be solved, the programming language used to reify it, and the supporting libraries incorporated in order to address ancillary concerns has no need for "using LLMs in your workflow."

In other words, the act of producing source code is the last step a developer undertakes. This is usually no more than a typing exercise.

Re: Copilot broke audit logs, but Microsoft won't tell customers

#316

Post by AdieuToLogic »

mlyle wrote: post #314
AdieuToLogic wrote: post #313

Earlier quoted context omitted.

> Is it impossible that humans could build a system to know what a whale wants, based on its vocalization, that does better than the typical whale? The answer resides in the question. For a human to know what a whale wants is to have an understanding of what it is to be a whale, not deriving a Rosetta Stone[0] such that bidirectional vocalizations could be exchanged. So is it possible to communicate with a whale? Sur…

I think this is a silly take. Not all species had evolutionary pressure for cross-organism understanding. A different species that has selective pressure for social understanding and greater mental understanding is probably going to understand what an insect wants better than say, another insect. That is, how well you can understand someone else doesn't depend just on common ground, but perhaps even more on how matur…

> That is, how well you can understand someone else doesn't depend just on common ground, but perhaps even more on how mature of machinery for understanding that you have.

I disagree, and believe I can explain why.

If I wrote:

  I can think of a few HN posts I have written which did not
  properly express my intent when I wrote them.
Is this a statement that you can relate with?

Even if not, does it communicate an experience you could envision based on your being a participant in this forum, having written posts yourself, and knowing I am a person just as you are doing the same?

What if I texted the sentence to someone who has never heard of HN?

Now what would happen if I wrote that same sentence on a piece of paper and handed it to a random person in a train station where no one spoke English?

Re: Copilot broke audit logs, but Microsoft won't tell customers

#317

Post by sailfast »

bongodongobob wrote: post #245
sailfast wrote: post #52

Earlier quoted context omitted.

Correct. It is precisely that a user can ask about someone’s medical history (or whatever else) and not be reported that would be in violation of any heavily audited system. LLM Summaries break the compliance.

You allow what it can and can't see. If you include PII and medical records, that's your fault, not MS's.

That’s fair - unless they’re marketing the bot as compliant.

Re: Copilot broke audit logs, but Microsoft won't tell customers

#318

Post by midnightblue »

darthwalsh wrote: post #293
keyringlight wrote: post #241

Earlier quoted context omitted.

What stands out to me is that winget has the appearance and is often perceived as a package manager, yet it's more of a CLI front end to an index, and that index seems to either point to the windows store or a URL to download a regular setup file which it'll run silently (adobe acrobat is the example that springs to mind).

Is that any different than chocolatey, scoop, or homebrew casks?

homebrew casks have acceptance criteria.

Re: Copilot broke audit logs, but Microsoft won't tell customers

#319

Post by selinkocalar »

This is terrifying from a compliance perspective. Audit logs are literally the foundation of every security framework - SOC 2, HIPAA, ISO 27001, you name it. If your audit logs are broken and you don't know it, you're not just non-compliant - you have no idea what's happening in your environment. The fact that Microsoft isn't proactively notifying customers makes this 10x worse. How many companies are going into audits with incomplete logs and don't even know it?

Re: Copilot broke audit logs, but Microsoft won't tell customers

#320

Post by anaganisk »

troad wrote: post #48
heywire wrote: post #9

I am so tired of Microsoft cramming Copilot into everything. Search at $dayjob is completely borked right now. It shows a page of results, but the immediately pops up some warning dialog you cannot dismiss that Copilot can’t access some file “” or something. Every VSCode update I feel like I have to turn off Copilot in some new way. And now apparently it’ll be added to Excel as well. Thankfully I don’t have to use an…

> Every VSCode update I feel like I have to turn off Copilot in some new way. This has genuinely made me work on switching to neovim. I previously demurred because I don't trust supply chains that are random public git repos full of emojis and Discords, but we've reached the point now where they're no less trustworthy than Microsoft. (And realistically, if you use any extensions on VS Code you're already trusting ran…

There is an actively maintained VSCode fork without all the Microsoft features. https://vscodium.com/
Post reply on HN