223
FFmpeg to Google: Fund Us or Stop Sending Bugs (thenewstack.io)
submitted 9 months ago by to c/foss@beehaw.org
50 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 39 points 9 months ago (2 children)

if Google has the resources to put AI to slop bug reports, then it also has the resources to put AI to also post the fixes. So, they should get going. No one owes Google of all corporations free labour.

  • permalink
  • fedilink
  • source
  • hideshow 4 child comments
    •
  • [–] 49 points 9 months ago (1 child)

    I think the last thing ffmpeg devs want is AI generated bugfixes to their assembly-heavy codebase. What they should do is dedicate time for experienced devs to fix the bugs instead.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 9 months ago (1 child)

    ffmpeg devs can refuse the AI generated bugfixes for all we care. What I'm heading at is if Google is going to spend AI on posting a problem, then they should also post the solution. At their own expense.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 5 points 9 months ago (1 child)

    ffmpeg devs can refuse the AI generated bugfixes for all we care.

    This is a separate problem, but it's still a problem. Many projects have seen a rise in slop PRs. curl is notorious for complaining about AI slop vulnerabilities and patch requests.

    But I think we both agree that Google needs to be doing something more rather than putting the workload entirely on the ffmpeg devs.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 30 points 9 months ago (1 child)

    Better suggestion: Stop using AI to do any of this shit. Security research and vulnerability patching should not be reliant upon de facto black-box random number generators.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 23 points 9 months ago (2 children)

    I have no issue with using AI to find otherwise undiscovered security bugs. But attempting to fixing them with AI I'm not in favor of.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 13 points 9 months ago* (last edited 9 months ago) (1 child)

    The user's code is vulnerable to a buffer overflow in certain edge cases. I need to patch the vulnerability and commit the patch to the repo.

    I should rewrite the existing memmanage() function to handle these edge cases. (Silently removes all other functionality)

    I should modify garbagecollect() to detect these edge cases. I'll rename it to garbage_collector() for clarity and readability. (Renames the function, calls it no where)

    (Confidently) I modified the program as requested, the new version of your application should be more secure and handle memory issues much more efficiently.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 4 points 9 months ago

    You seem to be under the impression that AI is a good tool for finding undiscovered security bugs. It's not. It's a crapshoot that requires a ton of extra effort to verify. Using it to find bugs wastes time and has a high risk of side-effects, given that AI has no understanding and thus cannot know if an issue is important, if fixing it has unwanted implications, or if there even is one at all. And if you're going to try to solve that with human supervision, then you may as well just have the human do the review to begin with and leave the AI out of it.

  • permalink
  • fedilink
  • source
  • parent