3 ms·
at some point having LLMs spit out libraries for you might be safer than actually downloading them.
by baq 11mo ago
at some point having LLMs spit out libraries for you might be safer than actually downloading them.
- Eduard 11mo agoLLMs will happily copy-paste malware or add them as dependencies
- morshu9001 11mo agoThis does help. Even before, I was pretty careful about what I used, not just for security but also simplicity. Nowadays it's even easier to LLM-generate utils that one might've installed a dep for in the past.
- Muromec 11mo agothis kicks the can down the road until we get supply chain attacks through LLM poisoning, like we already do with propaganda
- christophilus 11mo agoWell, he didn’t say vibe code. Presumably, you’d still be reviewing the AI code before committing it. I ran a little experiment recently, and it does take longer than just pulling in npm dependencies, but not that much longer for my particular project: logging, routing, rpc layer with end-to-end static types, database migrations, and so on. It took me a week to build a realistic, albeit simple app with only a few dependencies (Preact and Zod) running on Bun.
- pixl97 10mo agoHeh, that's if the reviewer actually is a human doing their job and not another AI just waiting for the right keyword to act like a manchurian candidate.
- throw-12-16 10mo agoor just vendor your deps like we have been doing for decades.
- baq 10mo agostill need to read them to make sure you don't vendor a trojan in the first place.
- throw-12-16 10mo agoauditing is the first step in vendoring a dep by my definition of the practice