Potential issues in curl found using AI assisted tools

Post by robhlam » Thu, Oct 02, 2025, 6:24 PM UTC

simonw wrote: post #30

alganet wrote: post #23

Something sounds fishy in this. Has these bugs really been found by AI? (I don't think they were). If you read Corgea's (one of the products used) "whitepaper", it seems that AI is not the main show: > BLAST addresses this problem by using its AI engine to filter out irrelevant findings based on the context of the application. It seems that AI is being used to post-process the findings of traditional analyzers. It re…

Looks like you're reacting to the Hacker News title here, which is currently " Daniel Stenberg on 22 curl bugs found by AI and fixed" That's an editorialized headline (so it may get fixed by dang and co) - if you click through to what Daniel Stenberg said he was more clear: > Joshua Rogers sent us a massive list of potential issues in #curl that he found using his set of AI assisted tools. AI-assisted tools seems rig…

Post by blixt » Thu, Oct 02, 2025, 6:35 PM UTC

Post by srcreigh » Thu, Oct 02, 2025, 6:43 PM UTC

Post by ratelimitsteve » Thu, Oct 02, 2025, 6:48 PM UTC

Sharlin wrote: post #32

flohofwoe wrote: post #4

This is exactly what I'd want from an 'AI coding companion'. Don't write or fix the code for me (thanks but I can manage that on my own with much less hassle), but instead tell me which places in the code look suspicious and where I need to have a closer look. When I ask Claude to find bugs in my 20kloc C library it more or less just splits the file(s) into smaller chunks and greps for specific code patterns and in t…

This is a point I see discussed surprisingly little. Given that many (most?) programmers like designing and writing code (excluding boilerplate), and not particularly enjoy reviewing code, it certainly feels backwards to make the AI write the code and relegate the programmer to reviewing it. (I know, of course, that the whole thing is being sold to stakeholders as "LoC machine goes brrrr" – code review? what's that?)

Post by OGWhales » Thu, Oct 02, 2025, 7:17 PM UTC

CharlesW wrote: post #43

flohofwoe wrote: post #4

This is exactly what I'd want from an 'AI coding companion'. Don't write or fix the code for me (thanks but I can manage that on my own with much less hassle), but instead tell me which places in the code look suspicious and where I need to have a closer look. When I ask Claude to find bugs in my 20kloc C library it more or less just splits the file(s) into smaller chunks and greps for specific code patterns and in t…

> When I ask Claude to find bugs in my 20kloc C library it more or less just splits the file(s) into smaller chunks and greps for specific code patterns and in the end just gives me a list of my own FIXME comments (lol), which tbh is quite underwhelming - a simple bash script could do that too. Here's a technique that often works well for me: When you get unexpectedly poor results, ask the LLM what it thinks an effec…