• zieg989@programming.dev
    link
    fedilink
    English
    arrow-up
    163
    ·
    10 days ago

    I would not be surprized if Anthropic would actually hire a real developer to make these PRs as a marketing stunt

    • BestBouclettes@jlai.lu
      link
      fedilink
      arrow-up
      187
      ·
      10 days ago

      Well, if the model detected an issue, and a human tested it to make sure it was real and then fixed it, I think that’s an acceptable use of AI tools.

    • In 2021, when Amazon launched its first “just walk out” grocery store in the UK in Ealing, west London, this newspaper reported on the cutting-edge technologies that Amazon said made it all possible: facial-recognition cameras, sensors on the shelves and, of course, “artificial intelligence”.
      An employee who worked on the technology said that actual humans – albeit distant and invisible ones, based in India – reviewed about 70% of sales made in the “cashier-less” shops as of mid-2022

      Source: The Guardian

      UK AI company builder.ai has been tricking customers and investors for eight years – selling an advanced code-writing AI that, it turns out, is actually an Indian software farm employing 700 human developers.

      Source: ACS Information Age

      • baguettefish@discuss.tchncs.de
        link
        fedilink
        English
        arrow-up
        13
        ·
        edit-2
        10 days ago

        builder AI was genuine AI, it’s just that the company simultaneously also did contracted development with real humans. journalists got confused.

        there’s a really good youtube documentary i watched which actually got into the tools and software used, but I can’t find it anymore. either way, you can’t dress up humans coding as AI. it’s not fast enough.

  • General_Effort@lemmy.worldOP
    link
    fedilink
    arrow-up
    94
    ·
    10 days ago

    (In case someone has been living under a rock in the last 48 hours. Anthropic’s new model “Mythos” has been finding a lot of new vulnerabilities. This is about patching one.)

  • CannonFodder@lemmy.world
    link
    fedilink
    arrow-up
    80
    ·
    10 days ago

    ai tools can detect potential vulnerabilities and suggest fixes. You can still go in by hand and verify the problem carefully apply a fix.

    • shirasho@feddit.online
      link
      fedilink
      English
      arrow-up
      31
      ·
      10 days ago

      AI is actually SUPER good at this and is one of the few places I think AI should be used (as one of many tools, ignoring the awful environmental impacts of AI and assuming an on-prem model). AI is also good at detecting code performance issues.

      With that said, all of the fix recommendations should be fixed by hand.

      • _hovi_@lemmy.world
        link
        fedilink
        arrow-up
        12
        ·
        10 days ago

        Yeah I would add also ignoring how the training data is usually sourced. I agree AI can be useful but it just feels so unethical that I find it hard to justify.

        I’m a big LLM hater atm but once we’re using models that are efficient, local and trained on ethically sourced data I think I could finally feel more comfortable with it all. Can’t be writing code for me though - why would I want the bot to do the fun part?

        • shirasho@feddit.online
          link
          fedilink
          English
          arrow-up
          5
          ·
          10 days ago

          Exactly my thought. I got into software development because designing and writing good code is fun. It is almost a game to see how well you can optimize it while keeping it maintainable. Why would I let something else do that for me? I am a software engineer, not a prompt writer.

  • spectrums_coherence@piefed.social
    link
    fedilink
    English
    arrow-up
    77
    ·
    edit-2
    10 days ago

    LLM is very good at programming when there are huge number of guardrails against them. For example, exploit testing is a great usecase because getting a shell is getting a shell.

    They kind of acts as a smarter version of infinite monkey that can try and iterate much more efficiently than human does.

    On the other hand, in tasks that requires creativity, architecture, and projects without guard rail, they tend to do a terrible job, and often yielding solution that is more convoluted than it needs to be or just plain old incorrect.

    I find it is yet another replacement for “pure labor”, where the most unintelligent part of programming, i.e. writing the code, is automated away. While I will still write code from scratch when I am trying to learn, I likely will be able automate some code writing, if I know exactly how to implement it in my head, and I also have access to plenty of testing to gaurentee correctness.

    • Serinus@lemmy.world
      link
      fedilink
      arrow-up
      43
      ·
      10 days ago

      People have trouble with the middle ground. AI is useful in coding. It’s not a full replacement. That should be fine, except you’ve got the ai techbros and CEOs on one end thinking it will replace all labor, and the you’ve got the backlash to that on the other end that want to constantly talk about how useless it is.

        • MinnesotaGoddam@lemmy.world
          link
          fedilink
          arrow-up
          5
          ·
          10 days ago

          the times i trust LLMs: when i am using it to look up stuff i have already learned, but i can’t remember and just need to refresh my memory. there’s no point memorizing shit i can look up and am not going to use regularly, and i’m the effective guardrail against the LLMs being wrong when I’m using them.

          the times i don’t trust the LLMs: all the other times. if i can’t effectively verify the information myself, why am i going to an unreliable source?

          having to explain that nuance over and over, it’s just shorter and easier to say the llm is an unreliable source. which it is. when i’m not doing lazy output, it doesn’t need testing (it still gets at least 2 reviews, but the last time those reviews caught anything was years ago). the llm’s output always needs testing.

      • brianpeiris@lemmy.ca
        link
        fedilink
        English
        arrow-up
        5
        ·
        edit-2
        10 days ago

        I suspect the problem is that there are many developers nowadays who don’t care about code quality, actual engineering, and maintenance. So the people who are complaining are right to be concerned that there is going to be a ton of slop code produced by AI-bro developers, and the developers who actually care will be left to deal with the aftermath. I’d be very happy if lead developers are prepared to try things with AI, and importantly to throw the output away if it doesn’t meet coding standards. Instead I think even lead developers and CTOs are chasing “productivity” metrics, which just translates to a ton of sloppy code.

        • Serinus@lemmy.world
          link
          fedilink
          arrow-up
          1
          ·
          10 days ago

          Yeah, I don’t plan to leave in two years, so I’m motivated to not say “oh fuck” when I have to maintain the thing I built later.

          Plus, you know, I don’t want people to groan when they have to work on my code.

    • RamenJunkie@midwest.social
      link
      fedilink
      English
      arrow-up
      7
      ·
      10 days ago

      They are also great for programming one off personal projects that frankly, don’t have the use scale that needs rigerous security oversight. Especially since like, if you did it yourself, you probably were not sanitizing the inputs (etc) anyway. You were slapping down some Python code and moving on.

      Like, I don’t care if my script to convert Wordpress exports to Markdown files crashes if you feed it a JPEG. I am the only one using it, for this data manipulation task.

    • lonesomeCat@lemmy.ml
      link
      fedilink
      English
      arrow-up
      5
      ·
      10 days ago

      The thing is, you know how it is in your head and you need to lay out that entire context.

      And after that you MUST review the code because you’d never know. Wouldn’t call it automation if I have to double check EVERY TIME

      • definitemaybe@lemmy.ca
        link
        fedilink
        arrow-up
        2
        ·
        9 days ago

        It’s great for coding things that you don’t care if it gets it wrong, though. Like, I vibe coded a JavaScript injection to add a client-side accessibility feature to a website running a fairly complex tech stack. I don’t know JavaScript, but I know how to code, and I know enough HTML and CSS to do simple things.

        It failed quite a few times, but each time I just needed to refresh the page for a clean slate, tell the LLM how it fucked up, and try again. In about an hour, I had a functional script I could inject in the site to bolt on a new feature.

        I was reading the code along the way, so I know what it’s doing for the most part (not some of the JavaScript things, like why there are extra brackets in places I wouldn’t expect, but whatever.) It wasn’t doing anything dangerous.

        Not mission critical. A small block of code to do one simple thing. There was no real downside or cost of failure, aside from wasted time. And it’s small enough that it’s easy to understand from scratch; it’ll be fairly easy to update and maintain.

        On the other hand, it sounds like Microslop and NVidia (and many others) are using AI slop in complex, mission-critical projects. I’d be nervous for their future, if I cared about them.

  • railcar@midwest.social
    link
    fedilink
    English
    arrow-up
    56
    ·
    10 days ago

    It’s OK to hate AI slop and recognize the immediate threat to cyber security it brings. At least they are trying to mitigate it. There’s been no similar actions from other frontier models. They are deliberately helping open source projects with little funding to keep pace.

    https://www.anthropic.com/glasswing

    • sunbeam60@feddit.uk
      link
      fedilink
      arrow-up
      28
      ·
      10 days ago

      Anthropic right now are the good people.

      That probably won’t last. But out of a bad bunch they’re the least bad.

      • 0xDREADBEEF@programming.dev
        link
        fedilink
        English
        arrow-up
        30
        ·
        10 days ago

        the good people.

        You are limiting your own intelligence by thinking companies can be described in those words.

        They are not good. They are profit-seeking. Profit seeking doesn’t necessarily mean evil, but it can never mean good. A non-profit who’s goal is to improve their community around them, a co-op who’s goal is to treat their workers with respect etc etc can all be described as ‘good’ to varying degrees, but no for-profit entity, especially a publicly traded one, can ever be described as ‘good’

        • hitmyspot@aussie.zone
          link
          fedilink
          arrow-up
          8
          ·
          10 days ago

          Hence their point about being the best of a bad bunch. Remember the people making decisions are people. A corporation has no soul and only seeks profit. People work for them and can make good decisions and be good people whomever they work for.

          There were good people that worked for the nazis. Unless you think the cleaner, for instance of the Nazi headquarters cleaned as a way to speak evil.

          However. I take your point. I just think that’s not what is the point of the discussion here and is no different to both sides being bad on politics. It lacks nuance.

        • onlinepersona@programming.dev
          link
          fedilink
          arrow-up
          3
          ·
          8 days ago

          Yes yes, not marketing at all. “It’s so powerful, only those worthy enough can wield it.” Make it so exclusive it seems illicit to acquire, that people will pay anything to join the club.

  • SkunkWorkz@lemmy.world
    link
    fedilink
    arrow-up
    49
    ·
    9 days ago

    The ffmpeg team was mad at Google when they reported a bug that was found and reported automatically with an AI. Google reported the bug without providing a fix and also gave an ultimatum. Google would publicize the bug report after 60 days. That’s what pissed off the ffmpeg devs. Not to mention that it was a very obscure bug, like ffmpeg didn’t decode a video file from a 90’s videogame correctly.

    Anthropic on the other hand found a bug and provided a fix. So why would they be mad if the fix is properly written and fixes the bug ?

      • General_Effort@lemmy.worldOP
        link
        fedilink
        arrow-up
        3
        ·
        9 days ago

        It’s really only a minority, or else the world would not work. Think how the theory of evolution gained mainstream acceptance, despite resistance by fanatics who had support by society,

  • sun_is_ra@sh.itjust.works
    link
    fedilink
    English
    arrow-up
    28
    ·
    10 days ago

    Maybe he meant code quality was so good its like a human wrote it.

    After all if the code is good and follow all best practices of the project, why reject it just because it was an AI who wrote it. That’s racism against machines.

    • lath@lemmy.world
      link
      fedilink
      arrow-up
      52
      ·
      10 days ago

      If it’s racism, it’s also slavery. Can’t have one without the other here.

    • Mark with a Z@suppo.fi
      link
      fedilink
      arrow-up
      45
      ·
      10 days ago

      One big reason people outright reject AI generated code is that it shifts the work from author to the reviewer. AI makes it easier to make low effort commits that look good on surface, but are very flawed. So far LLMs don’t match the wisdom of an experienced software dev.

      • bamboo
        link
        fedilink
        English
        arrow-up
        11
        ·
        10 days ago

        This is what happened with FFMpeg when Google was trying the same thing to promote their models. If the code is good, and doesn’t put unnecessary burden on the reviewer, then that’s great. But when the patches are sloppy or the reviews are overwhelming, it doesn’t help the project, it hinders it.

        • Serinus@lemmy.world
          link
          fedilink
          arrow-up
          3
          ·
          10 days ago

          It’s almost like there should be a human in the loop to guide and review what the ai is doing.

          The thing works a lot better when I give it smaller chunks of work that I know are possible. Works best when I know how to implement it myself and it just saves me from looking up all the syntax.

      • sun_is_ra@sh.itjust.works
        link
        fedilink
        English
        arrow-up
        7
        ·
        10 days ago

        totally agee also same problem with published scientific papers .

        I just assume that since this code submission was done by Anthropic itself - probably to demonstrate how good their AI has became ( I don’t know what is the actual background to this story) - FFmpeg team gave it more consideration as opposed to a random amature.

  • Onno (VK6FLAB)@lemmy.radio
    link
    fedilink
    arrow-up
    15
    ·
    10 days ago

    Hold on, wasn’t one of the “features” of the “leaked” Assumed Intelligence source code the “human”-like version?