5 ms·

Hey Chris I am the author. When i made the video I didn't really notice the code part of regex, since I am really new to regex but in the conclusion part of my

Hey Chris I am the author. When i made the video I didn't really notice the code part of regex, since I am really new to regex but in the conclusion part of my video I did mention that most of the code is not efficient Your comment was a great learning . Thank you

lilyball 5y ago
This is exactly the problem. The regex issue isn’t that it’s not efficient, it’s that it’s wrong. Using this tool to generate code in a problem area you are not qualified to double-check and validate yourself is dangerous.
- omk 5y ago
  > Using this tool to generate code in a problem area you are not qualified to double-check and validate yourself is dangerous. I would like this message to be amplified as much as possible. Never write code you do not understand. I am excited about copilot, but also wary of the programming culture these tools will bring in. Businesses, especially body-shopping companies will want to deliver as much using tools in this category and end up shipping code with disastrous edge cases.
  - ZiiS 5y ago
    Isn't "Code you don't understand" the definition of AI/ML?
    - foxpurple 5y ago
      No. You could use copilot to generate code you do understand and double check it before committing. It’s similar to just copying and pasting from stack overflow.
    - tormeh 5y ago
      Zing! But well, depends on the algorithm. Some aren't that complicated to understand, like linear regression. Others, like DNN are basically impossible. But with ML you're at least always testing the code you don't understand in the process of training the parameters. That's better than the minimum effort when using copilot code. And many will just make that minimum effort and release untested code they don't understand.
      - tluyben2 5y ago
        Well, I think this overestimates people outside the HN echochamber again. Most senior ML people we see in big corps have no clue what they are doing: they just fiddle with knobs until it works. They would not be able to explain anything: copy code/model, change parameters and train until convergence, test for overfitting. When automl was coming a bit I hoped they would be fired (as I do not think they are doing useful work) but nope: they have trouble hiring more of them.
    - CamperBob2 5y ago
      I'd say that's "Code you (should) understand doing things you can't understand (and possibly can't audit)." The art and practice of programming didn't change much over the last 50 years. 50 years from now, though, it will be utterly unrecognizable.
    - cf499 5y ago
      > Isn't "Code you don't understand" the definition of AI/ML? We don't need to understand the process to evaluate the output in this case. Bad code is bad code no matter who/what wrote it.
  - tluyben2 5y ago
    I think there are a scary amount of programmers (this is their job and they get hired: often they are already seniors) who cannot explain what they copied or even wrote themselves. I have asked guys with 5 years or more job experience why they wrote something they wrote and I get 'because it works'. Sometimes I have trouble seeing why it works and usually it means there are indeed those disastrous edge cases. Copilot will make this worse and has the potential to make it far worse.
- blowski 5y ago
  This seems a bit overblown. If someone’s using GitHub Copilot to write code in a place it could be dangerous without any kind of quality control, then the odd wrong regex flag is the least of their problems.
- nix23 5y ago
  >validate yourself is dangerous You are taking yourself to serious.
  - deleted 5y ago
    [deleted]
- bryanrasmussen 5y ago
  There's two problems: 1. generating code in the problem area (email address validation) which is pretty much a classic 'things programmers believe about' domain - https://haacked.com/archive/2007/08/21/i-knew-how-to-validate-an-email-address-until-i.aspx/ https://haacked.com/archive/2007/08/21/i-knew-how-to-validat... 2. generating code in a programming idiom with which you are unfamiliar - which regex as a DSL is also a pretty classic example. I don't think most programmers are good at regex, I know I'm definitely in the 'now you have two problems' in the regex camp. So to summarize it generated code written in a way the programmer could not understand what it even claimed to be doing, using a technology that many programmers are not especially good at; and it generated code that did not handle the problem domain correctly, and the problem domain is one that most programmers don't actually know that well either. the more I think of this thing the more disastrous it seems.
  - lumost 5y ago
    aye - the biggest risk here is that rather than pulling in some standard lib for validating email addresses an engineer may use the copilot suggestion and validate it against a few simple test cases. Curiously an attacker could probe services for use of the invalid suggestions that copilot generates....
- victor106 5y ago
  Very well put. Thank You. I know copilot is in alpha and will improve 100x but you will still need someone qualified to double check
  - lumost 5y ago
    ML applications face a frightening problem of diminishing returns on investment. The first prototype often happens in days or weeks, the next iteration months, after that years. It's more analogous to clearing a foundation for a house by progressively picking up the boulders, then the rocks, then the grains of sand one at a time.
  - lilyball 5y ago
    I don't think it's possible for copilot to improve on this problem. It doesn't actually understand the code, it's just statistical models all the way down. There's no way for copilot to judge how good code is, only how frequently it's seen similar code. And frequency is not the same thing as quality.

lilyball 5y ago

This is exactly the problem. The regex issue isn’t that it’s not efficient, it’s that it’s wrong. Using this tool to generate code in a problem area you are not qualified to double-check and validate yourself is dangerous.

omk 5y ago
> Using this tool to generate code in a problem area you are not qualified to double-check and validate yourself is dangerous. I would like this message to be amplified as much as possible. Never write code you do not understand. I am excited about copilot, but also wary of the programming culture these tools will bring in. Businesses, especially body-shopping companies will want to deliver as much using tools in this category and end up shipping code with disastrous edge cases.
- ZiiS 5y ago
  Isn't "Code you don't understand" the definition of AI/ML?
  - foxpurple 5y ago
    No. You could use copilot to generate code you do understand and double check it before committing. It’s similar to just copying and pasting from stack overflow.
  - tormeh 5y ago
    Zing! But well, depends on the algorithm. Some aren't that complicated to understand, like linear regression. Others, like DNN are basically impossible. But with ML you're at least always testing the code you don't understand in the process of training the parameters. That's better than the minimum effort when using copilot code. And many will just make that minimum effort and release untested code they don't understand.
    - tluyben2 5y ago
      Well, I think this overestimates people outside the HN echochamber again. Most senior ML people we see in big corps have no clue what they are doing: they just fiddle with knobs until it works. They would not be able to explain anything: copy code/model, change parameters and train until convergence, test for overfitting. When automl was coming a bit I hoped they would be fired (as I do not think they are doing useful work) but nope: they have trouble hiring more of them.
  - CamperBob2 5y ago
    I'd say that's "Code you (should) understand doing things you can't understand (and possibly can't audit)." The art and practice of programming didn't change much over the last 50 years. 50 years from now, though, it will be utterly unrecognizable.
  - cf499 5y ago
    > Isn't "Code you don't understand" the definition of AI/ML? We don't need to understand the process to evaluate the output in this case. Bad code is bad code no matter who/what wrote it.
- tluyben2 5y ago
  I think there are a scary amount of programmers (this is their job and they get hired: often they are already seniors) who cannot explain what they copied or even wrote themselves. I have asked guys with 5 years or more job experience why they wrote something they wrote and I get 'because it works'. Sometimes I have trouble seeing why it works and usually it means there are indeed those disastrous edge cases. Copilot will make this worse and has the potential to make it far worse.
blowski 5y ago
This seems a bit overblown. If someone’s using GitHub Copilot to write code in a place it could be dangerous without any kind of quality control, then the odd wrong regex flag is the least of their problems.
nix23 5y ago
>validate yourself is dangerous You are taking yourself to serious.
- deleted 5y ago
  [deleted]
bryanrasmussen 5y ago
There's two problems: 1. generating code in the problem area (email address validation) which is pretty much a classic 'things programmers believe about' domain - https://haacked.com/archive/2007/08/21/i-knew-how-to-validate-an-email-address-until-i.aspx/ https://haacked.com/archive/2007/08/21/i-knew-how-to-validat... 2. generating code in a programming idiom with which you are unfamiliar - which regex as a DSL is also a pretty classic example. I don't think most programmers are good at regex, I know I'm definitely in the 'now you have two problems' in the regex camp. So to summarize it generated code written in a way the programmer could not understand what it even claimed to be doing, using a technology that many programmers are not especially good at; and it generated code that did not handle the problem domain correctly, and the problem domain is one that most programmers don't actually know that well either. the more I think of this thing the more disastrous it seems.
- lumost 5y ago
  aye - the biggest risk here is that rather than pulling in some standard lib for validating email addresses an engineer may use the copilot suggestion and validate it against a few simple test cases. Curiously an attacker could probe services for use of the invalid suggestions that copilot generates....
victor106 5y ago
Very well put. Thank You. I know copilot is in alpha and will improve 100x but you will still need someone qualified to double check
- lumost 5y ago
  ML applications face a frightening problem of diminishing returns on investment. The first prototype often happens in days or weeks, the next iteration months, after that years. It's more analogous to clearing a foundation for a house by progressively picking up the boulders, then the rocks, then the grains of sand one at a time.
- lilyball 5y ago
  I don't think it's possible for copilot to improve on this problem. It doesn't actually understand the code, it's just statistical models all the way down. There's no way for copilot to judge how good code is, only how frequently it's seen similar code. And frequency is not the same thing as quality.