9 ms·
Peer review of changes is still important.
by forestry 1mo ago
Peer review of changes is still important.
- Twirrim 1mo agoYou can't rely on people spotting the significance of such changes
- fn-mote 1mo ago^^ Absolutely. Nothing in the PR jumps out as a red flag. Unless you know how the internals work, I suppose.
- chrisjj 1mo ago> Nothing in the PR jumps out as a red flag. Made by AI?
- larsonian 1mo agoAre you kidding? It's a very obvious case of quote injection. Not some subtle race condition or anything.
- joombaga 1mo agoI think it's obvious too. I'd call out any case of `${{ }}` interpolation in a `run` block, and it's something I watch for in PRs. I also know other people don't watch for this, as I've corrected it about a hundred times. Over the last 10 years my average colleague understands less and less about injection or to watch for it at layer boundaries.
- bigfishrunning 1mo agoShouldn't anyone reviewing such a PR know how the internals work?
- koiueo 1mo agoNot anymore, it seems
- eithed 1mo agoTests would have caught it = https://github.com/rhysd/actionlint https://github.com/rhysd/actionlint injection check
- thejosh 1mo agoalso been a huge fan of zizmor (https://github.com/zizmorcore/zizmor https://github.com/zizmorcore/zizmor) lately, basically: "am I going to footgun myself?"
- dv_dt 1mo agoI have been talking to people who want to autoreview and autoapprove "minor" AI prs. For security especially, I think if the models weren't enough to prevent the issues, they aren't enough to judge what is minor.
- Rumudiez 1mo agoMulti-model cross-review is important
- acedTrex 1mo agoIt's not actually, thats just shoving more shit into the shit pipeline. Humans need to review this stuff yall there's no way around that, apparently to some, very inconvenient reality.
- devin 1mo agoIt’s clear that they want this to be true so bad that they’re just not going to do it, and will spend a ton of money on quality gates and mitigation strategies instead of just reading some code.
- _joel 1mo agoI'm all for using a council of LLMs, I wrote a tool for it https://github.com/joelio/owl https://github.com/joelio/owl - but you still need to read through PRs yourself, at the very least.
- throwlifeaway 1mo ago[dead]