3 ms·

> above is a 300-line chunk ... deadlocks every few hundred runs Wow, if this kind of thing is successful it feels like there's much less need for static check

> above is a 300-line chunk ... deadlocks every few hundred runs Wow, if this kind of thing is successful it feels like there's much less need for static checkers. I mean -- not no need for them, just less need for continued development of new checkers. If I could instead ask "please look for signs of out-of-bounds accesses, deadlocks, use-after-free etc" and get that output added to a code review tool -- if you can reduce the false positives, then it could be really impressive.

therein 2y ago
This mentality is so weird to me. The desire to throw a black box at a problem just strikes me as laziness. What you're saying is basically wow if we had a perfect magic programmer in a box as a service that would be so revolutionary; we could reduce the need for static checkers. It is a large language model, trained on arbitrary input data. And you're saying let's take this statistical approach and have it replace purpose made algorithms. Let's get rid of motion tracking and rotoscoping capabilities in Adobe After Effects. Generative AI seems to handle it fine. Who needs to create 3D models when you can just describe what you want and then AI just imagines it? Hey AI, look at this code, now generate it without my memory leaks and deadlocks and use-after-free? People who thought about these problems mindfully and devised systematic approaches to solving them must be spinning in their graves.
- intelVISA 2y ago
  I think the unaccountability of said magic box is the true allure for corps. It's the main reason they desperately want it to be turnkey for code - they'd be willing to flatten most office jobs as we know them today en route to this perfect, unaccountable, money printer.
- wyldfire 2y ago
  > It is a large language model, trained on arbitrary input data. Is it? For all I know they gave it specific instances of bugs like "int *foo() { int i; return &i; }" and told it "this is a defect where we've returned a pointer to a deallocated stack entry - it could cause cause stack corruption or some other unpredictable program behavior." Even if OpenAI _hasn't_ done that, someone certainly can -- and should! > Who needs to create 3D models I specifically pulled back from "no static checkers" because some folks might tend to see things as all-or-nothing. We choose to invest our time in new developer tools all the time, and if AI can do as good or better maybe we don't need to chip-chip-chip away at defects with new static checkers. Maybe our time is better spent working on some dynamic analysis tool, to find the bugs that the AI can't easily uncover. > now generate it without my memory leaks ... People who thought about these problems mindfully I think of myself who devises systematic approaches to problems. And I get those approaches wrong despite that. I really love the technology that has been developed over the past couple of decades to help me find my bugs: sanitizers, warnings, and OS, ISA features to detect bugs. This strikes me as no different from that other technology and I see no reason not to embrace it. Let me ask you this: how do you feel about refcounting or other kinds of GC? Huge drawbacks make them unusable for some problems. But for tons of problem domains, they're perfect! Do you think that GC has made developers worse? IMO it's lowered the bar for correct programs and that's ideal.
  - therein 2y ago
    GCs create a paradigm in which you still craft logic on your own. It is simply an abstraction, one you could even think of it as a pluggable library construct like Arc<T> in Rust. It doesn't write or transform code at the layer programmer writes code. I think GC is closer to the paradigm that stack local variables will go out of scope when you return from a function than a transformer that cleans up the misunderstandings about lifetime. If someone said I crafted this unique approach with this special kind of neural network, and it works on your AST or llvm IR, and we don't prompt it, it just optimizes your code to follow these good practices we have engrained into this network, I'd be less concerned by it. But we are trying to take LLMs trained on anything from Shakespeare to YouTube comments and prompting it to fix memory leaks and deadlocks.
- hiAndrewQuinn 2y ago
  As a child I thought about what the perfect computer would be, and I came to the conclusion it would have no screen, no mouse, and no keyboard. It would just have a big red button labeled "DO WHAT I WANT", and when I press it, it does what I want. I still think this is the perfect computer. I would gladly throw away everything I know about programming to have such a machine. But I don't deny your accusation; I am the laziest person imaginable, and all the better an engineer for it.

therein 2y ago

This mentality is so weird to me. The desire to throw a black box at a problem just strikes me as laziness. What you're saying is basically wow if we had a perfect magic programmer in a box as a service that would be so revolutionary; we could reduce the need for static checkers. It is a large language model, trained on arbitrary input data. And you're saying let's take this statistical approach and have it replace purpose made algorithms. Let's get rid of motion tracking and rotoscoping capabilities in Adobe After Effects. Generative AI seems to handle it fine. Who needs to create 3D models when you can just describe what you want and then AI just imagines it? Hey AI, look at this code, now generate it without my memory leaks and deadlocks and use-after-free? People who thought about these problems mindfully and devised systematic approaches to solving them must be spinning in their graves.

intelVISA 2y ago
I think the unaccountability of said magic box is the true allure for corps. It's the main reason they desperately want it to be turnkey for code - they'd be willing to flatten most office jobs as we know them today en route to this perfect, unaccountable, money printer.
wyldfire 2y ago
> It is a large language model, trained on arbitrary input data. Is it? For all I know they gave it specific instances of bugs like "int *foo() { int i; return &i; }" and told it "this is a defect where we've returned a pointer to a deallocated stack entry - it could cause cause stack corruption or some other unpredictable program behavior." Even if OpenAI _hasn't_ done that, someone certainly can -- and should! > Who needs to create 3D models I specifically pulled back from "no static checkers" because some folks might tend to see things as all-or-nothing. We choose to invest our time in new developer tools all the time, and if AI can do as good or better maybe we don't need to chip-chip-chip away at defects with new static checkers. Maybe our time is better spent working on some dynamic analysis tool, to find the bugs that the AI can't easily uncover. > now generate it without my memory leaks ... People who thought about these problems mindfully I think of myself who devises systematic approaches to problems. And I get those approaches wrong despite that. I really love the technology that has been developed over the past couple of decades to help me find my bugs: sanitizers, warnings, and OS, ISA features to detect bugs. This strikes me as no different from that other technology and I see no reason not to embrace it. Let me ask you this: how do you feel about refcounting or other kinds of GC? Huge drawbacks make them unusable for some problems. But for tons of problem domains, they're perfect! Do you think that GC has made developers worse? IMO it's lowered the bar for correct programs and that's ideal.
- therein 2y ago
  GCs create a paradigm in which you still craft logic on your own. It is simply an abstraction, one you could even think of it as a pluggable library construct like Arc<T> in Rust. It doesn't write or transform code at the layer programmer writes code. I think GC is closer to the paradigm that stack local variables will go out of scope when you return from a function than a transformer that cleans up the misunderstandings about lifetime. If someone said I crafted this unique approach with this special kind of neural network, and it works on your AST or llvm IR, and we don't prompt it, it just optimizes your code to follow these good practices we have engrained into this network, I'd be less concerned by it. But we are trying to take LLMs trained on anything from Shakespeare to YouTube comments and prompting it to fix memory leaks and deadlocks.
hiAndrewQuinn 2y ago
As a child I thought about what the perfect computer would be, and I came to the conclusion it would have no screen, no mouse, and no keyboard. It would just have a big red button labeled "DO WHAT I WANT", and when I press it, it does what I want. I still think this is the perfect computer. I would gladly throw away everything I know about programming to have such a machine. But I don't deny your accusation; I am the laziest person imaginable, and all the better an engineer for it.