6 ms·

We should keep in mind that the product is still in beta / technical preview.

alkonaut 5y ago
This is a good point. There is a lot of outrage now, but the product when finished might have every single wrinkle removed. This one, for example, seems it should be pretty easy to fix. You could even make a hack that replaces ALL sufficiently long and sufficiently random strings with garbage/zeroes, at the point of recall. The difference from the case of regurgitating GPL sources is that the information that it looks like an API key can be deducedd from the output of copilot, so you don't need to track it through the system like you would with a system of attribution.
- skywhopper 5y ago
  How do you tell a “long and random string” from a base64 encoded PNG file or embedded script or…
  - rattray 5y ago
    Should any of those be autocompleted?
  - alkonaut 5y ago
    You don't. The logic is unchanged if the data changes. A snippet of code would be unchanged, apart from the data. // Add an arrow icon var arrow_icon = base64decode("00000000000000000..."); add_image(arrow_icon); That is: the prerequisite for this approach being viable is if one assumes that "code" and "data" are distinct, and that data can be seen as irrelevant placeholders. That is: in the example above I was after the code to add the icon, not the icon payload itself. There are obvious bordeline cases like large numeric constants that are actually core part of the logic. E.g. a method that multiplies by Pi with 14 digits wouldn't work very well if they were replaced by zeroes. So most likely numerical constants would need to be left alone.
    - voakbasda 5y ago
      Often times secrets are numerical constants. In your own example, the icon is a base64-encoded number. How would you tell secret numbers apart from the rest?
      - alkonaut 5y ago
        Base64 isn't numeric it's alphanumeric. The only reason this is reasonable (again) is that alomost all secrets like api keys or complex passwords are maximizing their information content and are therefore alphanumeric (or better). Base64 encoded data does too, and is an innocent casualty in that censorship.
        novatype 5y ago
        > Base64 isn't numeric it's alphanumeric. They meant that a number written in hex (base16) is still a number, even though you use some letters. Similarly, a number written in base64 is still a number.
        alkonaut 5y ago
        Yes, and in that case I’d like it of Copilot erased/replaced any string over (say) 15 or 20 characters unless they are [0..9]+. Obviously any string is a potential number in some encoding so the only encoding to exclude would be decimal.
naniwaduni 5y ago
Should we really be forgiving one of the world's richest corporations for launching a marketing campaign with expansive claims for a half-baked product because, in the fine print, they call it a technical preview?
- luma 5y ago
  Presumably you can get your money back if you don't like the results. edit: well this appears to be unpopular. It's a preview release, nobody is using this in production. They are offering the tech for free while they kick out the bugs and determine where things don't work as everyone expected. The fact that this is doing things they might not have expected suggests that this part of the process was necessary. If you expected this to be production-ready, then you've misunderstood the purpose of a preview release. This applies to MS the same as it does any other developer.
  - tarsinge 5y ago
    The point of GP is that the grand PR campaign doesn't really state it's an unfinished product and that they are looking for free testers and security and legal audits.
    - luma 5y ago
      Do you parse "preview release" in some way other than that which I outline above?
  - rorykoehler 5y ago
    It’s unacceptable to ship this kind of security flaw even for a half baked internal proof of concept.
  - klyrs 5y ago
    If they're encouraging users to distribute my GPL code under a CC0 license that doesn't even mention my name, how am I gonna "get my money back?"
- lmohseni 5y ago
iamlucaswolf 5y ago
Absolutely. I also believe that Copilot is getting more flak than appropriate at the moment. To rephrase my comment above: I don't want to blame the team behind Copilot for not getting everything right on the first try. Neither am I in a position to do so, nor would I want to live in a world where smart people aren't allowed to make mistakes. What irritates me is that there are two possible scenarios here: 1) They knew about potential issues and decided to release it anyway (without at least addressing them verbally). 2) They didn't. And frankly, I don't know which one I like less. Even though it's still a beta/preview, either option seems to signal a degree of negligence? that feels unnerving given the potential impact of such a system. That being said, if we do live in scenario 1) than I am certain that better framing could have prevented the PR fallout that we're seeing right now (at least partially). IMHO, GitHub (the platform) is still a great product after all.
tasuki 5y ago
If my product is in beta, is it ok for it to leak your secrets?
- rst13 5y ago
  Unfortunately this is something large corps like AWS have been getting away with for a while now. Releasing half-baked product clones as GA when in fact they're still clunky and are probably beta at max.

This is a good point. There is a lot of outrage now, but the product when finished might have every single wrinkle removed. This one, for example, seems it should be pretty easy to fix. You could even make a hack that replaces ALL sufficiently long and sufficiently random strings with garbage/zeroes, at the point of recall. The difference from the case of regurgitating GPL sources is that the information that it looks like an API key can be deducedd from the output of copilot, so you don't need to track it through the system like you would with a system of attribution.

skywhopper 5y ago
How do you tell a “long and random string” from a base64 encoded PNG file or embedded script or…
- rattray 5y ago
  Should any of those be autocompleted?
- alkonaut 5y ago
  You don't. The logic is unchanged if the data changes. A snippet of code would be unchanged, apart from the data. // Add an arrow icon var arrow_icon = base64decode("00000000000000000..."); add_image(arrow_icon); That is: the prerequisite for this approach being viable is if one assumes that "code" and "data" are distinct, and that data can be seen as irrelevant placeholders. That is: in the example above I was after the code to add the icon, not the icon payload itself. There are obvious bordeline cases like large numeric constants that are actually core part of the logic. E.g. a method that multiplies by Pi with 14 digits wouldn't work very well if they were replaced by zeroes. So most likely numerical constants would need to be left alone.
  - voakbasda 5y ago
    Often times secrets are numerical constants. In your own example, the icon is a base64-encoded number. How would you tell secret numbers apart from the rest?
    - alkonaut 5y ago
      Base64 isn't numeric it's alphanumeric. The only reason this is reasonable (again) is that alomost all secrets like api keys or complex passwords are maximizing their information content and are therefore alphanumeric (or better). Base64 encoded data does too, and is an innocent casualty in that censorship.
      - novatype 5y ago
        > Base64 isn't numeric it's alphanumeric. They meant that a number written in hex (base16) is still a number, even though you use some letters. Similarly, a number written in base64 is still a number.
        alkonaut 5y ago
        Yes, and in that case I’d like it of Copilot erased/replaced any string over (say) 15 or 20 characters unless they are [0..9]+. Obviously any string is a potential number in some encoding so the only encoding to exclude would be decimal.

naniwaduni 5y ago

Should we really be forgiving one of the world's richest corporations for launching a marketing campaign with expansive claims for a half-baked product because, in the fine print, they call it a technical preview?

luma 5y ago
Presumably you can get your money back if you don't like the results. edit: well this appears to be unpopular. It's a preview release, nobody is using this in production. They are offering the tech for free while they kick out the bugs and determine where things don't work as everyone expected. The fact that this is doing things they might not have expected suggests that this part of the process was necessary. If you expected this to be production-ready, then you've misunderstood the purpose of a preview release. This applies to MS the same as it does any other developer.
- tarsinge 5y ago
  The point of GP is that the grand PR campaign doesn't really state it's an unfinished product and that they are looking for free testers and security and legal audits.
  - luma 5y ago
    Do you parse "preview release" in some way other than that which I outline above?
- rorykoehler 5y ago
  It’s unacceptable to ship this kind of security flaw even for a half baked internal proof of concept.
- klyrs 5y ago
  If they're encouraging users to distribute my GPL code under a CC0 license that doesn't even mention my name, how am I gonna "get my money back?"
lmohseni 5y ago

iamlucaswolf 5y ago

Absolutely. I also believe that Copilot is getting more flak than appropriate at the moment. To rephrase my comment above: I don't want to blame the team behind Copilot for not getting everything right on the first try. Neither am I in a position to do so, nor would I want to live in a world where smart people aren't allowed to make mistakes. What irritates me is that there are two possible scenarios here: 1) They knew about potential issues and decided to release it anyway (without at least addressing them verbally). 2) They didn't. And frankly, I don't know which one I like less. Even though it's still a beta/preview, either option seems to signal a degree of negligence? that feels unnerving given the potential impact of such a system. That being said, if we do live in scenario 1) than I am certain that better framing could have prevented the PR fallout that we're seeing right now (at least partially). IMHO, GitHub (the platform) is still a great product after all.

tasuki 5y ago

If my product is in beta, is it ok for it to leak your secrets?

rst13 5y ago
Unfortunately this is something large corps like AWS have been getting away with for a while now. Releasing half-baked product clones as GA when in fact they're still clunky and are probably beta at max.