Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub Copilot Generated Insecure Code in 40% of Circumstances During Experiment

theinsaneapp.com

Post reply on HN
Print view View original

81–90 of 161 posts

Re: GitHub Copilot Generated Insecure Code in 40% of Circumstances During Experiment

#81

Post by metb »

lmilcin wrote: post #2

I thought this should have been expected. Security starts with deep understanding. Some standards and practices can help avoid some types of problems, and some are even rather effective (like airgapping your systems), but there isn't any way to assure security in general other than truly understand what you are doing. ** I feel like Copilot is the wrong direction to optimize development. This is mostly going to help…

>To management (especially with wrong incentives) this seems like a perfect worker, because management usually doesn't understand the connection between lack of engagement and planning at design/development time with their later problems (or they don't feel it is them that is going to pay the price).

This is how management is in most places I feel, especially when it comes to evaluating junior, and early senior engineers.

Re: GitHub Copilot Generated Insecure Code in 40% of Circumstances During Experiment

#82

Post by SketchySeaBeast »

0-_-0 wrote: post #35
dkersten wrote: post #33

Earlier quoted context omitted.

You could train a model on purely secure code and still have it combine it in insecure ways.

And the other way around.

I guess the question really is how many ways are there to do it wrong, and how many ways are there to do it right?

Re: GitHub Copilot Generated Insecure Code in 40% of Circumstances During Experiment

#83

Post by andix »

JamesSwift wrote: post #79
andix wrote: post #36

Earlier quoted context omitted.

It is called LICENSE.txt. License your code as GPL and then Copilot can't reproduce bigger parts of your code. But as long as you give the public access to your code, they can study it and learn from it. Humans and machines.

I would assume github could supercede your license by putting its own claim to your code in the TOS. I doubt they have done that, but just pointing it out.

I don’t think that’s possible, as long as you don’t actively accept that. Nobody can claim your copyright without your approval.

It would be also the end of GitHub, as most users probably won’t accept such terms.

Re: GitHub Copilot Generated Insecure Code in 40% of Circumstances During Experiment

#84

Post by merpnderp »

andix wrote: post #16
lmilcin wrote: post #2

I thought this should have been expected. Security starts with deep understanding. Some standards and practices can help avoid some types of problems, and some are even rather effective (like airgapping your systems), but there isn't any way to assure security in general other than truly understand what you are doing. ** I feel like Copilot is the wrong direction to optimize development. This is mostly going to help…

The real evil here is boilerplate code. I've seen so much boilerplate in the Java or classic .NET Framework world, it's incredible. So many layers of DTOs, Request/Response Models and so on, that could be just generated. Or most of the time even removed completely (that would cost some "architects" their job though). This is also true for a lot of Redux or Angular/NgRx applications. So much boilerplate, that you can'…

Should look at Vue with the composition-api layer, there's close to zero boilerplate.

A store in Vue 3 can basically be:

  export default { state: readonly(state), ...setterFunctions }
It doesn't get more easy to read and streamlined than that.

Re: GitHub Copilot Generated Insecure Code in 40% of Circumstances During Experiment

#85

Post by 0-_-0 »

nextlevelwizard wrote: post #64
0-_-0 wrote: post #34

I fail to see how this is particularly useful information about Copilot. The comparison should be: 1. How many times do people write insecure code when not using Copilot? 2. How many times do people write insecure code when using Copilot?

It is useful since it means copilot is not taking your job any time soon. i.e. if 40% of the time the human driving the thing is needed to intervene and prevent obvious security flaws then expert is still needed to use the tool.

I think it was obvious from the beginning that it's trained on GitHub code, so it would be surprising if it was better than the average code on GitHub.

In any case, if Copilot can generate code as well as the average programmer without supervision, that means it can already take the job of 50% of programmers. A more useful metric though is how many programmers can a person using Copilot replace by having greater productivity?

Also, in how many programming jobs does security matter? In my job for example it doesn't matter at all.

Re: GitHub Copilot Generated Insecure Code in 40% of Circumstances During Experiment

#86

Post by gverrilla »

lmilcin wrote: post #58
gverrilla wrote: post #55

Earlier quoted context omitted.

Do you think only experts should be programming? I'm an amateur programmer, and I think copilot could help me a lot with unimportant things, as you said - I even tried to install it but I'm not on some list. I can read code, and have built a few programs - I've hired around 30 different programmers in my life, and the vast majority clearly are copy-pasters-adapters. The way I see it, that happens because programming…

> Do you think only experts should be programming? I'm an amateur programmer (...) Amateur vs professional and novice vs expert are completely separate things. You can be professional novice just as you can be expert amateur. Now, the answer to your question is an obvious "NO". To be an expert you have to be a novice first. The problem rather is "Are you making progress towards being an expert or are you just learnin…

I see, sorry for wrong words. I am an amateur programmer, not a complete novice, and I have contracted mid-level professional programmers.

I understand your point about learning and getting better at it. All I'm saying is most of programmers won't become experts: the market doesn't demand that, and most just aren't able or don't want to.

No-code will make a huge impact in next decade imo.

In my specific case, I would be able to become an expert programmer but I don't intend to because I have other carreer choices. So I think copilot would be of great help.

Re: GitHub Copilot Generated Insecure Code in 40% of Circumstances During Experiment

#87

Post by 0-_-0 »

andix wrote: post #83
JamesSwift wrote: post #79

Earlier quoted context omitted.

I would assume github could supercede your license by putting its own claim to your code in the TOS. I doubt they have done that, but just pointing it out.

I don’t think that’s possible, as long as you don’t actively accept that. Nobody can claim your copyright without your approval. It would be also the end of GitHub, as most users probably won’t accept such terms.

According to many people familiar with the legal aspect training on code constitutes fair use, so can't be prevented by any kind of license.

Re: GitHub Copilot Generated Insecure Code in 40% of Circumstances During Experiment

#88

Post by andix »

serial_dev wrote: post #61
lmilcin wrote: post #20

Earlier quoted context omitted.

(I have been professionally programming Java backends for the past 16 years). Java is not the culprit here. I think it is something that happened on the way that has something to do with J2EE and patterns craze we had a decade ago or two ago. It doesn't help that frameworks like Spring and their documentation go out of their way to propagate these boilerplate-heavy patters. Copying these lazy patterns is shortest, ea…

I'm working on a Dart / Flutter project where most devs are coming from Java and Android backgrounds. For me, coming mostly from JavaScript, TypeScript, and Python, the amount of pointless over-engineering is very frustrating. We need to jam through every change through 10 layers now, because of "clean architecture". The team is very slow and can't implement even small changes quickly. The worst part is that I feel l…

I totally feel your pain. Go and work somewhere else.

What you can sometimes do, is to remove all those layers to be able to implement or fix something. Then tell the team that you didn’t have time „to do it properly“ and you focused on functionality and efficiency over design. Management loves that.

And after it’s done, some of those abstraction nazis can refactor in all those abstractions again. So they don’t distract you from the next meaningful task.

But make sure, that you understand what benefit this decoupling brings. Because sometimes it’s useful, just not often enough.

Re: GitHub Copilot Generated Insecure Code in 40% of Circumstances During Experiment

#89

Post by HomeDeLaPot »

tyingq wrote: post #44
carl_dr wrote: post #23

Earlier quoted context omitted.

> I wish there were a “robots.txt” file for Git to disallow certain bots from training on anything I have written. It’s simple. If you are concerned by this, don’t host your repositories on GitHub.

You would have to not host your code publicly either, right?

Merely hosting your code publicly seems like it wouldn't give GitHub the right to train AI models on it. You could even say it's against your terms of use. And to do it, they would have to go out of their way to find your repo on the web and clone it—unlikely.

My impression (NOT A LAWYER) is that by hosting your code in a public repo on GitHub, you agree to their terms and give them the right to "read" your code including training AI models on it. Or at least that's what they're banking on.

Go host on Sourcehut or self-host with Gitea, and I would think it unlikely (but not impossible) that any big company would use your code to train their AI.

Re: GitHub Copilot Generated Insecure Code in 40% of Circumstances During Experiment

#90

Post by [deleted] »

tyingq wrote: post #68
nextlevelwizard wrote: post #62

Earlier quoted context omitted.

You can always host is with license that doesn't allow reuse or something

GitHub mentions that they don't currently look at the license before trawling code. https://twitter.com/NoraDotCodes/status/1412741339771461635 There's also other references that GitHub public repos weren't the only source. They trawl other publicly readable code.

[deleted]
Post reply on HN