Microsoft: Use AI to ruin your code at high speed.

[cr0w@infosec.exchange]

Microsoft: Use AI to ruin your code at high speed. On GitHub.

Microsoft: Use AI to find bugs. On GitHub.

Microsoft: Use AI to remediate bugs. On GitHub.

GitHub: can't be bothered to stay online

AI Bros: AI is making people so productive that GitHub can't keep up! Maybe more AI will fix things...

[jscybersec@infosec.exchange]

@cR0w Is this like the fortune cookie thing where instead of adding "in bed" you basically just add "AI/Github" to the end of everything Microslop?

[cr0w@infosec.exchange]

@JSCybersec The marketing materials all seem to give that impression.

[capn_b@beige.party]

@JSCybersec @cR0w using AI to find bugs. In bed.

[cr0w@infosec.exchange]

@capn_b @JSCybersec Ewwww. I'd rather have a ../ than bed bugs.

[aakl@infosec.exchange]

@cR0w Okay, serious question (two, actually): Is AI better than humans at finding bugs?

And is AI better than humans at tracking down the buggy code AI created?

[cr0w@infosec.exchange]

@AAKL Not to be too pedantic but how do you define better? More energy efficient? More total number of bugs found regardless of resources? Ability to find obscure bugs? Ability to find exploitable bugs? If it takes the energy of a small nation to find a few unexploitable bugs and brag about them then I have a hard time saying that it's better than humans but it does come down to definitions.

[aakl@infosec.exchange]

@cR0w A fair question. Now that you mention it. this feels like comparing apples and oranges.

Does an AI model verify the bugs it finds or does it just dump them on the humans to verify?

Does the AI model patch these vulnerabilities or is that up to the humans?

If the AI model only hunts for vulnerabilities, obscure and otherwise, without verifying and fixing them, then how much time is saved, compared to a similar hunt by a smarter, more experienced and intuitive human?