5 ms·
I mean. Yes, LLMs hallucinate. Yes, they have incomplete info and small context. But seriously, at the very least ask about security here. A very simplistic "
by groby_b 4y ago
I mean.
Yes, LLMs hallucinate. Yes, they have incomplete info and small context. But seriously, at the very least ask about security here.
A very simplistic "just list cve's and security issues" for the first example yields 6 of the 7 listed in the article. (It also provides working links. As opposed to, say, the article - the very first link there is broken ;)
With minimal additional prompting effort ("Assume you are an extremely seasoned security researcher - what additional issues do you find in the code?"), you get more issues uncovered than the article does.
And that's before we talk about actual security tools, which are presumably fine-tuned and have decent prompt design.
Is that an exhaustive security review? No. Absolutely not. Of course you still need that review. But it's extremely helpful, and if that was the only advice you'd get, it'd still be orders of magnitude better than what most devs get.
If you ask ChatGPT to rewrite a secure version, it's doing leagues better than most devs as well.
So, you know, as a starter? Rather use ChatGPT than not using anything.
- justinclift 4y ago> But seriously, at the very least ask about security here. Shouldn't need to. Considering security for any code you're working on is basic table stakes. :(
- antonvs 4y agoI don’t think you’re really engaging with what that comment was saying. For example, it said: > Of course you still need that review. But it's extremely helpful, and if that was the only advice you'd get, it'd still be orders of magnitude better than what most devs get. > If you ask ChatGPT to rewrite a secure version, it's doing leagues better than most devs as well. No matter what your opinion of “table stakes” here may be, in practice not enough attention is paid to security by developers, because by far most developers are oblivious to security issues beyond the absolute basics, if that. It’s often left to security teams to find issues from the outside, which is a good security layer to have, but terrible if it’s all you have. As such, the OP article’s advice needs to be qualified with several caveats, including that it used naive prompts which (hopefully) a security product’s GPT feature would try to address; and also that, as the other comment pointed out: > So, you know, as a starter? Rather use ChatGPT than not using anything ...keeping in mind that this applies at nearly every point in the SDLC. E.g., a developer unfamiliar with security issues might use it to improve their work before a security team looks at it.
- justinclift 4y ago> ... most developers are oblivious to security issues beyond the absolute basics, if that. Sorry, but I don't believe you. Maybe juniors are oblivious - they are just starting out after all - but any reasonable developer is going to have security front of mind when writing code. At least, for internet facing stuff. Purely internal usage code may, may be treated differently.
- groby_b 4y agoMeanwhile, over here, I just stare at https://github.com/CVEProject/cvelistV5 https://github.com/CVEProject/cvelistV5 and mumble "any reasonable dev, front of mind".
- justinclift 4y agoYeah, that's a valid point too. :)
- antonvs 4y ago> any reasonable developer is going to have security front of mind when writing code What’s your basis for believing this? It doesn’t even remotely match what I’ve observed in several decades of development, architecture, consulting, and management of developers. You may be experiencing expert blindness.
- justinclift 4y ago> What’s your basis for believing this? Same as yours. Personal experience working with others, professionally.
- fomine3 4y agoI hope so