Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub Copilot Generated Insecure Code in 40% of Circumstances During Experiment

theinsaneapp.com

Post reply on HN
Print view View original

71–80 of 161 posts

Re: GitHub Copilot Generated Insecure Code in 40% of Circumstances During Experiment

#71

Post by lmilcin »

serial_dev wrote: post #61
lmilcin wrote: post #20

Earlier quoted context omitted.

(I have been professionally programming Java backends for the past 16 years). Java is not the culprit here. I think it is something that happened on the way that has something to do with J2EE and patterns craze we had a decade ago or two ago. It doesn't help that frameworks like Spring and their documentation go out of their way to propagate these boilerplate-heavy patters. Copying these lazy patterns is shortest, ea…

I'm working on a Dart / Flutter project where most devs are coming from Java and Android backgrounds. For me, coming mostly from JavaScript, TypeScript, and Python, the amount of pointless over-engineering is very frustrating. We need to jam through every change through 10 layers now, because of "clean architecture". The team is very slow and can't implement even small changes quickly. The worst part is that I feel l…

I feel your pain, I am in much the same situation just in a tech lead position.

It takes a lot of patience to undo this damage and explain that simplicity is much more important than lazily, mindlessly repeating "best" practices. I am using quotes intentionally because they aren't actually best -- "best" would suggest there are no better practices which obviously cannot be true.

The goal should always be to make the application simple and easy to work with. Patterns should be tools to achieve the goal rather than being goals themselves.

Simple is important because it allows understanding your application (which is important for developer efficiency as well as improving reliability). It also enables you to modify your application much more easily (more code usually means more work to change it) and this is important to fighting technical debts and to reduce cost of any future development.

Re: GitHub Copilot Generated Insecure Code in 40% of Circumstances During Experiment

#73

Post by lmilcin »

kthejoker2 wrote: post #70
lmilcin wrote: post #58

Earlier quoted context omitted.

> Do you think only experts should be programming? I'm an amateur programmer (...) Amateur vs professional and novice vs expert are completely separate things. You can be professional novice just as you can be expert amateur. Now, the answer to your question is an obvious "NO". To be an expert you have to be a novice first. The problem rather is "Are you making progress towards being an expert or are you just learnin…

Why did you redirect OP's question about amateurs to one about novices? For amateurs, the homework is a great analogy - they don't need a lesson, they need a calculator so they can get back to the professional work they are doing.

I did not redirect anything. Please, read more carefully.

Here, the parts you have missed reading the post:

> Do you think only _experts_ should be programming?

> I've _hired around 30 different programmers_ in my life

Re: GitHub Copilot Generated Insecure Code in 40% of Circumstances During Experiment

#75

Post by datameta »

serial_dev wrote: post #61
lmilcin wrote: post #20

Earlier quoted context omitted.

(I have been professionally programming Java backends for the past 16 years). Java is not the culprit here. I think it is something that happened on the way that has something to do with J2EE and patterns craze we had a decade ago or two ago. It doesn't help that frameworks like Spring and their documentation go out of their way to propagate these boilerplate-heavy patters. Copying these lazy patterns is shortest, ea…

I'm working on a Dart / Flutter project where most devs are coming from Java and Android backgrounds. For me, coming mostly from JavaScript, TypeScript, and Python, the amount of pointless over-engineering is very frustrating. We need to jam through every change through 10 layers now, because of "clean architecture". The team is very slow and can't implement even small changes quickly. The worst part is that I feel l…

> When I raise my concerns, they just roll their eyes, and make me feel like "I'm just not a senior enough guy" who just accidently got in the team.

Easier to do that than just admit technical dept. Some people cannot acknowledge a problem and live alongside it if it is too large to tackle immediately. It has to be explained away or compartmentalized. How simple it is blame the messenger. Sorry you had to experience that from your team.

Re: GitHub Copilot Generated Insecure Code in 40% of Circumstances During Experiment

#77

Post by LeifCarrotson »

lmilcin wrote: post #2

I thought this should have been expected. Security starts with deep understanding. Some standards and practices can help avoid some types of problems, and some are even rather effective (like airgapping your systems), but there isn't any way to assure security in general other than truly understand what you are doing. ** I feel like Copilot is the wrong direction to optimize development. This is mostly going to help…

> I feel like Copilot is the wrong direction to optimize development. This is mostly going to help people with already poor understanding of what they are doing create even more crap.

Sometimes you don't need an expert to produce highly secure, highly optimized code.

Have you seen the crap that people buy at Walmart? The furniture is not heirloom furniture, the food is not a 3-star artisanal experience. Have you bought tools at Harbor Freight? They're not the lifetime companion of a tradesman, kept in wood boxes and wrapped in cosmoline after each use. But an awful lot of work gets done with them, common homeowner wisdom is if you need a tool, buy it at Harbor Freight, if you use it enough to wear it out spend 10x to buy a really good one, but most tools you'll only use once or twice.

At workplaces across the country right this minute there are human beings doing rote transcription from one application to another, copy-pasting if they're lucky. That's a waste of effort and intellectual potential, and a hodgepodge of Excel equations or a crappy bit of Copilot glue code could be just the ticket. Yes, if those become the business' secret sauce and sold to customers on the Internet, they ought to put some effort into doing it properly, but there's a ton of work that could be accomplished with low-quality code.

Re: GitHub Copilot Generated Insecure Code in 40% of Circumstances During Experiment

#79

Post by JamesSwift »

andix wrote: post #36
toastal wrote: post #10

You are the free labor copilot to train Microsoft GitHub's Copilot tool. You are responsible for any of those insecure code errors and the diligence require. You will be on the hook for resulting problems. But Microsoft and their home-phoning, tracking-embedded editor will get real people to correct and train their machine for free—with their stated plan of later selling that machine back to us later. I wish there we…

It is called LICENSE.txt. License your code as GPL and then Copilot can't reproduce bigger parts of your code. But as long as you give the public access to your code, they can study it and learn from it. Humans and machines.

I would assume github could supercede your license by putting its own claim to your code in the TOS. I doubt they have done that, but just pointing it out.

Re: GitHub Copilot Generated Insecure Code in 40% of Circumstances During Experiment

#80

Post by JamesSwift »

chrismorgan wrote: post #43
andix wrote: post #36

Earlier quoted context omitted.

It is called LICENSE.txt. License your code as GPL and then Copilot can't reproduce bigger parts of your code. But as long as you give the public access to your code, they can study it and learn from it. Humans and machines.

No, the license that you apply is completely irrelevant, and there’s certainly nothing whatsoever special about the GPL. Copilot is completely depending on being effectively exempt from copyright; if that legal theory falls apart, the entire space (and a lot of other machine learning stuff) is utterly doomed. Trouble is, Copilot can’t tell whether it’s reproducing copyrightable chunks of your code, or indeed where wh…

They could easily tag the source with license info and take that information into account when feeding data in.
Post reply on HN