Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub Copilot Generated Insecure Code in 40% of Circumstances During Experiment

theinsaneapp.com

Post reply on HN
Print view View original

41–50 of 161 posts

Re: GitHub Copilot Generated Insecure Code in 40% of Circumstances During Experiment

#41

Post by fendy3002 »

andix wrote: post #25
simion314 wrote: post #21

Earlier quoted context omitted.

An IDE or other tools will generate correct boilerplate code. Seems a gripe from someone that prefers hidden magical code that setups code behind their back. The evil is that someone trained an AI on random text , not even with some AST, so you have garbage in so no surprise you get garbage out. A true AI would understand that "the dev wants trough find all lines of text in a file that have this property", the AI jus…

The problem with boilerplate code is, that it is mostly generated once (by the ide) and then slightly modified. More like a template. In the end you get a lot of meaningless code (the generated code), with some meaningful parts inside. But you can’t see anymore what was generated and what was added manually without deep analysis of the commit log. It is much better to generate code on the fly during build, so it does…

Not without trade-off though, I've been on both spectrum. Template generated code allows you to modify things if you know how, while generation on the flies will need a bunch of options, hooks, and worse string-based evaluation call to make it modifiable.

So it's better for code with little to no modification, while boilerplate / template are better for things that will be modified.

Re: GitHub Copilot Generated Insecure Code in 40% of Circumstances During Experiment

#43

Post by chrismorgan »

andix wrote: post #36
toastal wrote: post #10

You are the free labor copilot to train Microsoft GitHub's Copilot tool. You are responsible for any of those insecure code errors and the diligence require. You will be on the hook for resulting problems. But Microsoft and their home-phoning, tracking-embedded editor will get real people to correct and train their machine for free—with their stated plan of later selling that machine back to us later. I wish there we…

It is called LICENSE.txt. License your code as GPL and then Copilot can't reproduce bigger parts of your code. But as long as you give the public access to your code, they can study it and learn from it. Humans and machines.

No, the license that you apply is completely irrelevant, and there’s certainly nothing whatsoever special about the GPL. Copilot is completely depending on being effectively exempt from copyright; if that legal theory falls apart, the entire space (and a lot of other machine learning stuff) is utterly doomed. Trouble is, Copilot can’t tell whether it’s reproducing copyrightable chunks of your code, or indeed where what it produces came from, by the very nature of machine learning techniques.

Re: GitHub Copilot Generated Insecure Code in 40% of Circumstances During Experiment

#44

Post by tyingq »

carl_dr wrote: post #23
toastal wrote: post #10

You are the free labor copilot to train Microsoft GitHub's Copilot tool. You are responsible for any of those insecure code errors and the diligence require. You will be on the hook for resulting problems. But Microsoft and their home-phoning, tracking-embedded editor will get real people to correct and train their machine for free—with their stated plan of later selling that machine back to us later. I wish there we…

> I wish there were a “robots.txt” file for Git to disallow certain bots from training on anything I have written. It’s simple. If you are concerned by this, don’t host your repositories on GitHub.

You would have to not host your code publicly either, right?

Re: GitHub Copilot Generated Insecure Code in 40% of Circumstances During Experiment

#45

Post by chrismorgan »

EamonnMR wrote: post #40
andix wrote: post #36

Earlier quoted context omitted.

It is called LICENSE.txt. License your code as GPL and then Copilot can't reproduce bigger parts of your code. But as long as you give the public access to your code, they can study it and learn from it. Humans and machines.

I'd love to see ML-GPL which specifically deals with using licensed property as a training set.

Not possible. Such licenses are founded upon copyright doctrine, and copyright doesn’t protect against learning, natural or machine. As it stands (and this can certainly change), legal consensus in general (regardless of jurisdiction) is that if you publish your code where they can reach it, they can use it.

Re: GitHub Copilot Generated Insecure Code in 40% of Circumstances During Experiment

#46

Post by eddieroger »

mbrevda1 wrote: post #4

For comparison, what percentage of human-generated code is secure?

That's basically where my gut went when I read the headline - so is that of a junior engineer, or really any engineer who hasn't had to think about it, and we don't promote their code directly to prod, either (if we can avoid it).

Copilot shouldn't be able to generate code destined for prod without review any more than should any line of code written by a human.

Re: GitHub Copilot Generated Insecure Code in 40% of Circumstances During Experiment

#47

Post by lmilcin »

fendy3002 wrote: post #41
andix wrote: post #25

Earlier quoted context omitted.

The problem with boilerplate code is, that it is mostly generated once (by the ide) and then slightly modified. More like a template. In the end you get a lot of meaningless code (the generated code), with some meaningful parts inside. But you can’t see anymore what was generated and what was added manually without deep analysis of the commit log. It is much better to generate code on the fly during build, so it does…

Not without trade-off though, I've been on both spectrum. Template generated code allows you to modify things if you know how, while generation on the flies will need a bunch of options, hooks, and worse string-based evaluation call to make it modifiable. So it's better for code with little to no modification, while boilerplate / template are better for things that will be modified.

Or you can use Lisp, call your boilerplate generator a macro and get rid of any boilerplate and never again have any problems with modifying any duplicate pieces of code.

Sigh... every time I see people generating any code (say through external tool or through IDE) I am always thinking how this could be a simple macro in any Lisp language.

Re: GitHub Copilot Generated Insecure Code in 40% of Circumstances During Experiment

#49

Post by moonchrome »

lmilcin wrote: post #20
andix wrote: post #16

Earlier quoted context omitted.

The real evil here is boilerplate code. I've seen so much boilerplate in the Java or classic .NET Framework world, it's incredible. So many layers of DTOs, Request/Response Models and so on, that could be just generated. Or most of the time even removed completely (that would cost some "architects" their job though). This is also true for a lot of Redux or Angular/NgRx applications. So much boilerplate, that you can'…

(I have been professionally programming Java backends for the past 16 years). Java is not the culprit here. I think it is something that happened on the way that has something to do with J2EE and patterns craze we had a decade ago or two ago. It doesn't help that frameworks like Spring and their documentation go out of their way to propagate these boilerplate-heavy patters. Copying these lazy patterns is shortest, ea…

>Java is not the culprit here.

It definitely is the culprit. They didn't even want to add `var` to the language until recently, and let's not even go to the anonymous class vs lambdas retardation.

These are just the things that they eventually buckled on, but Java is extremely boilerplatey - the bad patterns and XML crap got invented to deal with that problem.

DDD and onion are another issue, mostly coming out of the TDD movement and "make everything unit-testable". If I liked one thing about working with Rails is that they just gave you E2E tests from the start. But if Java/.NET were more flexible (dynamic or FP do far better at enabling simpler unit testing from my experience) mocking would be simpler so the unit testing part would be simpler too.

Re: GitHub Copilot Generated Insecure Code in 40% of Circumstances During Experiment

#50

Post by rustc »

chrismorgan wrote: post #45
EamonnMR wrote: post #40

Earlier quoted context omitted.

I'd love to see ML-GPL which specifically deals with using licensed property as a training set.

Not possible. Such licenses are founded upon copyright doctrine, and copyright doesn’t protect against learning, natural or machine. As it stands (and this can certainly change), legal consensus in general (regardless of jurisdiction) is that if you publish your code where they can reach it, they can use it.

So would it (theoretically) be legal to train on the JS files services like gmail.com serve to the client? What about decompiled output of proprietary software like certain files in Windows and macOS?
Post reply on HN