Post B7WuuP2H89UzrL9n6W by juliancalaby@social.treehouse.systems
(DIR) More posts by juliancalaby@social.treehouse.systems
(DIR) Post #B7WuuP2H89UzrL9n6W by juliancalaby@social.treehouse.systems
0 likes, 0 repeats
RE: https://social.treehouse.systems/@ariadne/116769651521628628But ... surely ... surely some decent static analysis could find the same issues, on someone's normal, everyday computer, without burning 5000 tonnes of energy to do so. Right? RIGHT???The thing I don't understand about "AI security analysis" or "AI code review" is that in my experience 90%+ of issues in code are either:1. Variable can be ether A or B and the code assumes it's A and breaks if it is B.2. If you go on this very specific path through this code, we "allocate" something and don't "deallocate" that thing before we drop references to it.Both of which can be found with a decent static analysis tool, and we have been doing that for decades. (And a lot of modern programming languages will find these issues during compilation)So what value is an AI code analysis tool actually adding here?How is "Hey Claude find me a security vulnerability in this code" better than "static_analysis --level max"?(And I get that a lot of security issues cannot be found using static analysis, and I'd suggest that the next step here is content- and code-aware fuzzing, which are, again, tools that already exist.)#ai #techRT: https://social.treehouse.systems/users/ariadne/statuses/116769651521628628
(DIR) Post #B7WuuPGoG77oaPxOl6 by ariadne@social.treehouse.systems
1 likes, 0 repeats
@juliancalaby the pkgconf project already uses static analysis tools.and I prefer using deterministic tools like coccinelle over LLMs to do code transformations
(DIR) Post #B7XXSnRmfk7vfqupjk by juliancalaby@social.treehouse.systems
0 likes, 0 repeats
@ariadne I'd be shocked if you didn't. You're sane.This wasn't supposed to be a reply, this was just me bitching about people sending LLMs to do static analysis tools' jobs.