5 ms·
Like any algorithm, it is dependent on the quality of its training data. In a study, a group of academics from New York University found 40% of the code produce
by JohnWhigham 5y ago
Like any algorithm, it is dependent on the quality of its training data. In a study, a group of academics from New York University found 40% of the code produced by Copilot had cybersecurity flaws.
Yeah let me use this tool where 40% of its output is garbage. Toss this in the ever-growing AI Winter bin.
- onion2k 5y agoGiven the fact that Copilot is trained on a corpus of real code, is it not reasonable to assume that the number of security flaws just reflects how insecure most public code is? If human-written code has about the same 40% suffering from security issues then then using Copilot is certainly no worse. It definitely doesn't seem fair to invalidate the idea of AI-assisted code generation without testing that.
- Bancakes 5y agoThink of it this way, how many security-hardened open-source monolithic kernels are there to learn from?
- yqx 5y ago> is it not reasonable to assume that the number of security flaws just reflects how insecure most public code is? It sounds to me like that's not an inference that can easily be drawn. Copilot was trained on predicting code, it doesn't understand the code it produces syntactically. Security issues can be highly context dependent. For example, in most cases it's fine to log a variable, but when it happens to contain a password, it's a security issue. This is a flawed example as the algorithm may be able to learn that variables with names or contexts suggesting that they're secrets should not be logged, but I can imagine much more subtle issues can crop up.