GitHub Copilot Generated Insecure Code in 40% of Circumstances During Experiment • Hacker News Board

Re: GitHub Copilot Generated Insecure Code in 40% of Circumstances During Experiment

#61

Post by serial_dev » Fri, Sep 03, 2021, 1:07 PM UTC

lmilcin wrote: post #20

andix wrote: post #16

Earlier quoted context omitted.

The real evil here is boilerplate code. I've seen so much boilerplate in the Java or classic .NET Framework world, it's incredible. So many layers of DTOs, Request/Response Models and so on, that could be just generated. Or most of the time even removed completely (that would cost some "architects" their job though). This is also true for a lot of Redux or Angular/NgRx applications. So much boilerplate, that you can'…

(I have been professionally programming Java backends for the past 16 years). Java is not the culprit here. I think it is something that happened on the way that has something to do with J2EE and patterns craze we had a decade ago or two ago. It doesn't help that frameworks like Spring and their documentation go out of their way to propagate these boilerplate-heavy patters. Copying these lazy patterns is shortest, ea…

I'm working on a Dart / Flutter project where most devs are coming from Java and Android backgrounds. For me, coming mostly from JavaScript, TypeScript, and Python, the amount of pointless over-engineering is very frustrating.

We need to jam through every change through 10 layers now, because of "clean architecture". The team is very slow and can't implement even small changes quickly.

The worst part is that I feel like I'm the idiot for thinking about whether the 50 classes (dtos, models, mappers, blablabla) actually make sense and reduce coupling. I see that anytime a tiny requirement changes, I need to update the 50 classes again, so in practice, it's just doesn't bring anything positive.

When I raise my concerns, they just roll their eyes, and make me feel like "I'm just not a senior enough guy" who just accidently got in the team.

Re: GitHub Copilot Generated Insecure Code in 40% of Circumstances During Experiment

#62

Post by nextlevelwizard » Fri, Sep 03, 2021, 1:07 PM UTC

tyingq wrote: post #44

carl_dr wrote: post #23

Earlier quoted context omitted.

> I wish there were a “robots.txt” file for Git to disallow certain bots from training on anything I have written. It’s simple. If you are concerned by this, don’t host your repositories on GitHub.

You would have to not host your code publicly either, right?

You can always host is with license that doesn't allow reuse or something

Re: GitHub Copilot Generated Insecure Code in 40% of Circumstances During Experiment

#63

Post by lupire » Fri, Sep 03, 2021, 1:08 PM UTC

The thing about copilot that drives me crazy is that it is anti-good-programming.

A smart AI should recommend a library function to call, not generate boilerplate code. The boilerplate code is either wrong, or should be a library function, nearly axiomatically.

Re: GitHub Copilot Generated Insecure Code in 40% of Circumstances During Experiment

#64

Post by nextlevelwizard » Fri, Sep 03, 2021, 1:09 PM UTC

0-_-0 wrote: post #34

I fail to see how this is particularly useful information about Copilot. The comparison should be: 1. How many times do people write insecure code when not using Copilot? 2. How many times do people write insecure code when using Copilot?

It is useful since it means copilot is not taking your job any time soon. i.e. if 40% of the time the human driving the thing is needed to intervene and prevent obvious security flaws then expert is still needed to use the tool.

Re: GitHub Copilot Generated Insecure Code in 40% of Circumstances During Experiment

#65

Post by arvindamirtaa » Fri, Sep 03, 2021, 1:11 PM UTC

Unit tests with TONS of assertions, cleaned data from form to ORM object, stuff that look look like you're just through a list and doing the same thing over and over. For these, Copilot is great. I wouldn't trust it to do anything else though.

Nothing more. Nothing less.

Re: GitHub Copilot Generated Insecure Code in 40% of Circumstances During Experiment

#66

Post by softwaredoug » Fri, Sep 03, 2021, 1:11 PM UTC

I will say I’m not looking forward to writing some mundane code today.

It’s interacting with GCS to scan a bucket for an extension, load the data with pandas, and concat some dataframes. It’s something dumb but mildly finicky that’s going to eat up so much time I could be using for higher value work.

Copilot would be very welcome as I do this, instead of annoyingly going off to Google 3 different python libraries and getting it all to work nicely together.

Re: GitHub Copilot Generated Insecure Code in 40% of Circumstances During Experiment

#67

Post by burnished » Fri, Sep 03, 2021, 1:17 PM UTC

iainmerrick wrote: post #9

mbrevda1 wrote: post #4

For comparison, what percentage of human-generated code is secure?

It seems reasonable to want Copilot to help you produce code of a reasonable quality. If it’s just helping you crank out the same bad code more quickly, without learning anything in the process, that’s useful to know. Some people might still want a tool like that, I wouldn’t.

Sure. But in order to know if its 'of reasonable quality' you need some sort of baseline to compare it to. What is reasonable quality? I think what your average human does is probably reasonable.

Like, if your average dev will produce insecure code in 80% of samples, then Copilot starts to look really good! But if its closer to 0.01% of code samples, then copilot looks more like an intriguing novelty, not to be brought too near serious work. Much like dippin dots in this regard.

Re: GitHub Copilot Generated Insecure Code in 40% of Circumstances During Experiment

#68

Post by tyingq » Fri, Sep 03, 2021, 1:19 PM UTC

nextlevelwizard wrote: post #62

tyingq wrote: post #44

Earlier quoted context omitted.

You would have to not host your code publicly either, right?

You can always host is with license that doesn't allow reuse or something

GitHub mentions that they don't currently look at the license before trawling code.

https://twitter.com/NoraDotCodes/status/1412741339771461635

There's also other references that GitHub public repos weren't the only source. They trawl other publicly readable code.

Re: GitHub Copilot Generated Insecure Code in 40% of Circumstances During Experiment

#69

Post by ransom1538 » Fri, Sep 03, 2021, 1:20 PM UTC

Has anyone here got past the wait list? I and my team members have been waiting for months.

Re: GitHub Copilot Generated Insecure Code in 40% of Circumstances During Experiment

#70

Post by kthejoker2 » Fri, Sep 03, 2021, 1:20 PM UTC

lmilcin wrote: post #58

gverrilla wrote: post #55

Earlier quoted context omitted.

Do you think only experts should be programming? I'm an amateur programmer, and I think copilot could help me a lot with unimportant things, as you said - I even tried to install it but I'm not on some list. I can read code, and have built a few programs - I've hired around 30 different programmers in my life, and the vast majority clearly are copy-pasters-adapters. The way I see it, that happens because programming…

> Do you think only experts should be programming? I'm an amateur programmer (...) Amateur vs professional and novice vs expert are completely separate things. You can be professional novice just as you can be expert amateur. Now, the answer to your question is an obvious "NO". To be an expert you have to be a novice first. The problem rather is "Are you making progress towards being an expert or are you just learnin…

Why did you redirect OP's question about amateurs to one about novices?

For amateurs, the homework is a great analogy - they don't need a lesson, they need a calculator so they can get back to the professional work they are doing.