Programming

17418 readers

224 users here now

Welcome to the main community in programming.dev! Feel free to post anything relating to programming here!

Cross posting is strongly encouraged in the instance. If you feel your post or another person's post makes sense in another community cross post into it.

Hope you enjoy the instance!

Rules

Follow the programming.dev instance rules
Keep content related to programming in some way
If you're posting long videos try to add in some form of tldr for those who don't want to watch videos

Wormhole

Follow the wormhole through a path of communities !webdev@programming.dev

founded 1 year ago

MODERATORS

snowe@programming.dev

Ategon@programming.dev

MaungaHikoi@lemmy.nz

Any AI tool to analyse a git repo for malicious code? (discuss.tchncs.de)

submitted 2 months ago by unknowing8343@discuss.tchncs.de to c/programming@programming.dev

32 comments fedilink hide all child comments

I'm trying to feel more comfortable using random GitHub projects, basically.

you are viewing a single comment's thread
view the rest of the comments

[–] slazer2au@lemmy.world 2 points 2 months ago (1 children)

What do you consider malicious, specifically. Because AI are not magic boxes, they are regurgitation machines prone to hallucinations. You need to train it on examples to identify what you want from it.

[–] unknowing8343@discuss.tchncs.de 4 points 2 months ago (1 children)

I just want a report that says "we detected in line 27 or file X, a particular behavior that feels weird as it tries to upload your environment variables into some unexpected URL".

[–] slazer2au@lemmy.world 1 points 2 months ago (2 children)

particular behavior that feels weird

Yea, AI doesn't do feelings.

tries to upload your environment variables into some unexpected URL

Most of the time that is obfuscated and can't be detected as part of a code review. It only shows up in dynamic analysis.

[–] unknowing8343@discuss.tchncs.de 3 points 2 months ago (1 children)

AI doesn't do feelings

How can I have a serious conversation with these annoying answers? Come on, you know what I am talking about. Even an AI chatbot would know what I mean.

Any AI chatbot, even "general purpose" ones will read your code and will return a description of what it does if you ask it.

And particularly AI would be great at catching "useless", "weird" or unexplainable code in a repository. Maybe not with the current levels of context. But that's what I want to know, if these tools (or anything similar) exist yet.

Thank you.

[–] FizzyOrange@programming.dev 0 points 2 months ago

Questions about AI seem to always bring out these naysayers. I can only assume they feel threatened? You see the same tedious fallacies again and again:

AI can't "think" (using some arbitrary and unstated definition of the word "think" that just so happens to exclude AI by definition).
They're stochastic parrots and can only reproduce things they've seen in their training set (despite copious evidence to the contrary).
They're just "next word predictors" so they fundamentally are incapable of doing X (where X is a thing they have already done).

[–] FizzyOrange@programming.dev -5 points 2 months ago (1 children)

AI doesn’t do feelings

It absolutely does. I don't know where you got that weird idea.

[–] superb@lemmy.blahaj.zone 1 points 2 months ago (1 children)

Honey your AI girlfriend doesn’t actually love you

[–] FizzyOrange@programming.dev 0 points 2 months ago (1 children)

Define love. Good luck.

[–] superb@lemmy.blahaj.zone 2 points 2 months ago (1 children)

You’re right, I hope the two of you are very happy

[–] TootSweet@lemmy.world 2 points 2 months ago

This absolutely sent me.