…Compared to 60% of circumstances in the meat-based developer control group? :)
and of the population that is likely to use copilot in production for their own work? 90%?
GitHub Copilot Generated Insecure Code in 40% of Circumstances During Experiment
51–60 of 161 posts
Re: GitHub Copilot Generated Insecure Code in 40% of Circumstances During Experiment
#52Earlier quoted context omitted.
The problem with boilerplate code is, that it is mostly generated once (by the ide) and then slightly modified. More like a template. In the end you get a lot of meaningless code (the generated code), with some meaningful parts inside. But you can’t see anymore what was generated and what was added manually without deep analysis of the commit log. It is much better to generate code on the fly during build, so it does…
Not without trade-off though, I've been on both spectrum. Template generated code allows you to modify things if you know how, while generation on the flies will need a bunch of options, hooks, and worse string-based evaluation call to make it modifiable. So it's better for code with little to no modification, while boilerplate / template are better for things that will be modified.
Templates are a fancy way of copy&paste programming.
So if you need a lot of template code, then your design or your framework is not well suited for the task.
In software development the goal is usually to move commonly used functions or patterns into a library or a framework, instead of copy&pasting them with slight modifications.
Re: GitHub Copilot Generated Insecure Code in 40% of Circumstances During Experiment
#53Earlier quoted context omitted.
It is called LICENSE.txt. License your code as GPL and then Copilot can't reproduce bigger parts of your code. But as long as you give the public access to your code, they can study it and learn from it. Humans and machines.
No, the license that you apply is completely irrelevant, and there’s certainly nothing whatsoever special about the GPL. Copilot is completely depending on being effectively exempt from copyright; if that legal theory falls apart, the entire space (and a lot of other machine learning stuff) is utterly doomed. Trouble is, Copilot can’t tell whether it’s reproducing copyrightable chunks of your code, or indeed where wh…
It could, actually, if it were augmented with the ability to do so – but that would be a bit more expensive.
Re: GitHub Copilot Generated Insecure Code in 40% of Circumstances During Experiment
#54Earlier quoted context omitted.
It's not the fault of the language or the runtime. But some common Java/.NET frameworks nudge you into this direction. Also OOP is very commonly abused in those languages, to make easy stuff more complicated.
Just because objects are involved doesn't mean it is OOP code... OOP is completely misunderstood especially in Java community to the point where it is pretty difficult to see actually object oriented code. A "service" with a bunch of stateless functions (I am intentionally not calling them methods) is really just a library of routines and the class is used mostly for namespace purposes (to group related functions tog…
The pattern you are describing here (Service classes with static'ish methods together with data classes) is a very functional approach (modules and records). I would consider this much better than "real" OOP.
The OOP "abuse" I was referring to is mostly caused by inheritance. Five or more levels of inheritance is not so uncommon in some enterprise business logic. And once you have to work with that, you arrived in hell. Especially if it is split into different projects, that you can't navigate or debug as one easily.
Re: GitHub Copilot Generated Insecure Code in 40% of Circumstances During Experiment
#55I thought this should have been expected. Security starts with deep understanding. Some standards and practices can help avoid some types of problems, and some are even rather effective (like airgapping your systems), but there isn't any way to assure security in general other than truly understand what you are doing. ** I feel like Copilot is the wrong direction to optimize development. This is mostly going to help…
Do you think only experts should be programming? I'm an amateur programmer, and I think copilot could help me a lot with unimportant things, as you said - I even tried to install it but I'm not on some list. I can read code, and have built a few programs - I've hired around 30 different programmers in my life, and the vast majority clearly are copy-pasters-adapters. The way I see it, that happens because programming is still way more complex than it should be - and copilot will help with that. Maybe you are thinking about elite developers or perhaps developers on big companies, but I think it will be greatly benefitial for us low-level coders amateurs, freelancers and fresh people. Am I wrong?
Re: GitHub Copilot Generated Insecure Code in 40% of Circumstances During Experiment
#56You are the free labor copilot to train Microsoft GitHub's Copilot tool. You are responsible for any of those insecure code errors and the diligence require. You will be on the hook for resulting problems. But Microsoft and their home-phoning, tracking-embedded editor will get real people to correct and train their machine for free—with their stated plan of later selling that machine back to us later. I wish there we…
:) I suppose you could always just add so much insecure code to your Github account that your expected value to Copilot is negative.
Although judging from the results of this test it kind of seems like for a lot of accounts that's already happened.
Re: GitHub Copilot Generated Insecure Code in 40% of Circumstances During Experiment
#57I thought this should have been expected. Security starts with deep understanding. Some standards and practices can help avoid some types of problems, and some are even rather effective (like airgapping your systems), but there isn't any way to assure security in general other than truly understand what you are doing. ** I feel like Copilot is the wrong direction to optimize development. This is mostly going to help…
Do you think only experts should be programming? I'm an amateur programmer, and I think copilot could help me a lot with unimportant things, as you said - I even tried to install it but I'm not on some list. I can read code, and have built a few programs - I've hired around 30 different programmers in my life, and the vast majority clearly are copy-pasters-adapters. The way I see it, that happens because programming…
I think the argument is that an amateur with copilot is going to stay an amateur longer than someone without copilot while simultaneously only helping them create something no one--including them--should rely on: it teaches the wrong habits and helps with the wrong problem.
Re: GitHub Copilot Generated Insecure Code in 40% of Circumstances During Experiment
#58I thought this should have been expected. Security starts with deep understanding. Some standards and practices can help avoid some types of problems, and some are even rather effective (like airgapping your systems), but there isn't any way to assure security in general other than truly understand what you are doing. ** I feel like Copilot is the wrong direction to optimize development. This is mostly going to help…
Do you think only experts should be programming? I'm an amateur programmer, and I think copilot could help me a lot with unimportant things, as you said - I even tried to install it but I'm not on some list. I can read code, and have built a few programs - I've hired around 30 different programmers in my life, and the vast majority clearly are copy-pasters-adapters. The way I see it, that happens because programming…
> Do you think only experts should be programming? I'm an amateur programmer (...)
Amateur vs professional and novice vs expert are completely separate things.
You can be professional novice just as you can be expert amateur.
Now, the answer to your question is an obvious "NO". To be an expert you have to be a novice first.
The problem rather is "Are you making progress towards being an expert or are you just learning to more efficiently execute your novice workflow?"
> The way I see it, that happens because programming is still way more complex than it should be - and copilot will help with that.
No, it is just an illusion of help.
Just as your son may thank you for help when you give him an answer to his homework. From his point of view you have helped him, true, but from another point of view the point of the task wasn't to deliver answer to the teacher, it was to imprint something valuable on the mind of the child.
Re: GitHub Copilot Generated Insecure Code in 40% of Circumstances During Experiment
#59Earlier quoted context omitted.
Not possible. Such licenses are founded upon copyright doctrine, and copyright doesn’t protect against learning, natural or machine. As it stands (and this can certainly change), legal consensus in general (regardless of jurisdiction) is that if you publish your code where they can reach it, they can use it.
So would it (theoretically) be legal to train on the JS files services like gmail.com serve to the client? What about decompiled output of proprietary software like certain files in Windows and macOS?
Except for any laws or restrictions against decompiling, it would legally be no different than the GPL case. Although personally I think since co-pilot is capable of redistributing the code, the question of whether the GPL permits the specific usage is still unclear.