The first linked PR (#1218) has only one commit co-authored by Copilot and it's not related to the vulnerability, and neither are the other suggestions in the PR. Am I missing something?
I must be too tired because I cannot figure out what happened in that pull request. The PR/source branch was over a year old with none of the commits adding up to the full diff. There is [1], which introduced the vulnerability but didn't remove the environment variables above, then master is merged into it via [2] (but still doesn't show the variables being removed), yet in the full PR diff they're gone.
In any case, I'm pretty sure you misattributed the vulnerability to Copilot because the PR got squash-merged and _all_ of the changes were then attributed to every contributor in that PR, despite Copilot only appearing on one of the commits.
Thanks @vultour and croemer for your proactiveness -- you are correct,I updated the blog to clarify that Copilot was a co-author that checked the merged PR and code change, and identified it as all-clear without noticing the critical vulnerabilities, it's unclear whether the code-change was AI-Assisted
What happened to "I don't know" or "I'm not sure"? Why do you need to direct someone to ask an LLM? If somebody asks me a question I don't know the answer to I'm not sending them anywhere, I tell them I don't know.
My first thought was that they have several people who seem like they'll expect very serious compensation but no actual product, then I noticed they already seem to have a whole bunch of VC backers. I'm not gonna lie, I'm a little jealous of people who can make a flashy vaporware pitch deck and ride the VC gravy train.
I have yet to see someone explain why they even needed an LLM to figure out what's going on, other than further proliferating this industry AI psychosis. Are their engineers actually so incompetent that they can't read a bunch of logs without AI? Here I was thinking these fancy AI companies are only hiring the best and the brightest, but apparently 7 rounds of leetcode does a number on your hiring process.
You literally need two or three mouse buttons for a FPS game. This argument might have worked if you said MMO because there’s a million abilities you can use but there’s absolutely nothing special about Razer mice when it comes to FPS specifically.
The link talks about more than just SQL injection. SQL injection can be fully mitigated using prepared statements. They were the solution 15 years ago when I was getting started with PHP in high school and it's still applicable today. The fact that SQL injection remains an issue speaks volumes about the general quality of software engineers.
The GitHub statistics for the project this website represents are insane. It has a sole author that has averaged approximately 20,000 lines of code every week in the past month. How do you even maintain that alone?
I’ve never gone through a paid training course that wasn’t a complete waste of time. It’s at the point where people at work know there isn’t even a point in offering these to me. “But why don’t you take the Terraform training?” Because I’m not going to waste my time with a 3-day course where it takes the first day to install and configure Terraform. I can install it on my computer in 5 minutes. I think people usually see these as a paid vacation, but I find them so insufferably boring I’d rather just work.
Yes! Forty years ago (c. 1985) members of our department of anesthesiology (University of Virginia Medical Center) were offered an optional two full day course on how to do our own MedLine searches so as not to have to put in a request to the biomedical librarian for same.
I jumped at the chance to not have to be in the OR from 7am-5pm doing the same old same old but instead relax and learn something useful.
Bad choice.
The instructor and material were deadeningly boring; I couldn't even begin to enter into the computer the right search request format and terms and as I sat there I was reminded of my days in elementary school watching the big round clock on the wall tick away the minutes until the final dismissal bell.
Because our chairman was in the class and had encouraged all of us tenure-track faculty to take the course, I couldn't bail after the first day but had to return for the second day.
Subsequently I continued using the biomedical librarian to request my searches (it took just a couple minutes to fill out the form) with excellent results.
