3 ms·
At least the vuln was old enough so that they couldn't blame AI for it, otherwise the article would read different ;)
by bflesch 9mo ago
At least the vuln was old enough so that they couldn't blame AI for it, otherwise the article would read different ;)
- chuckadams 9mo agoIronically (?) an AI code review would very likely have noticed the overly-permissive regex.
- catlifeonmars 9mo agoThis is a good point. On my GH I’ve disabled Copilot reviews because the vast majority of them are false positives, but I’m reconsidering that position as it might still be worth it to wade through the spurious reviews just to catch some real issues.
- maxbond 9mo agoI filter for false positives with language like this: For each bug you find, write a failing test. Run the test to make sure it fails. If it passes, try 1-3 times to fix the test. If you can't get it to work, delete the test and move on to the next bug. It's not perfect, you still get some non-bugs where the test fails because it's premises are wrong. Eg, recently I tossed out some tests that were asserting they could index a list at `foo.len()` instead of `foo.len() - 1`. But I've found a bunch of bugs this way too.
- catlifeonmars 9mo agoNice, I’ll give this a try
- catlifeonmars 9mo agoI take it this wasn’t Lua then? > I tossed out some tests that were asserting they could index a list at `foo.len()` instead of `foo.len() - 1`.
- SkiFire13 9mo agoThis doesn't really matter as long as they also find 10x more nits that create noise for the human reviewer.