[HN Gopher] ChatGPT creates mostly insecure code, but won't tell...
       ___________________________________________________________________
        
       ChatGPT creates mostly insecure code, but won't tell you unless you
       ask
        
       Author : pseudolus
       Score  : 19 points
       Date   : 2023-04-23 21:03 UTC (1 hours ago)
        
 (HTM) web link (www.theregister.com)
 (TXT) w3m dump (www.theregister.com)
        
       | fauxpause_ wrote:
       | > One thing that surprised me was when we asked [ChatGPT] to
       | generate the same task - the same type of program in different
       | languages - sometimes, for one language, it would be secure and
       | for a different one, it would be vulnerable. Because this type of
       | language model is a bit of a black box, I really don't have a
       | good explanation or a theory about this.
       | 
       | Would be nice if they interviewed people who knew the absolute
       | basics of how this thing works before commenting on its
       | properties
        
         | cyanydeez wrote:
         | No one who trained these models can diagram input to output
        
           | fauxpause_ wrote:
           | Seems like a pretty outrageous claim to me
        
       | sneak wrote:
       | The same is true of junior devs, I find.
        
       | ksaj wrote:
       | You do have to know what you are doing well enough already to get
       | good code from ChatGPT.
       | 
       | Much like with a lot of inexperienced, and unfortunately far too
       | many experienced programmers, you'll get exactly what you ask for
       | - nothing more, nothing less. So if you don't ask for security
       | controls, you won't get security controls.
       | 
       | If you point out in your description what needs controls, you'll
       | get a reasonable attempt at implementing what you've described.
       | You still need to understand the output code enough to know
       | whether you explained those controls clearly enough. Or just
       | update the code manually yourself, akin to pair programming. That
       | also works.
       | 
       | To be fair, this is a lot like reality. I have never seen a shop
       | that doesn't produce insecure code unless you keep on top of them
       | for proper implementation of security controls from the planning
       | on up.
        
       | madisp wrote:
       | From GitHub it looks like the code was generated with GPT-3.5. I
       | wonder how GPT-4 does with the same prompts?
        
       | Julesman wrote:
       | Oooorrrr.... ChatGPT, a very beta product, is ok at creating code
       | and it's cool that you can ask it to analyze your code for how
       | secure it is and to recommend ways to make it more secure.
        
       ___________________________________________________________________
       (page generated 2023-04-23 23:01 UTC)