7 comments

  • dabinat 1 hour ago
    It’s interesting how AI may both raise and lower the quality of software. It’s very easy to send an AI agent on an open-ended bug hunt, and if it wastes a bunch of time and effort and finds nothing, no big deal. Time is much more important for a human developer with a salary.
    • dmix 1 hour ago
      Finding the bugs with LLMs is easy. Reviewing the output, cleaning it up, and making sure it doesn't break something else is the hard part.
      • nonethewiser 8 minutes ago
        No one can keep up with the volume of code AI produces.

        We wont stop using AI.

        We will use AI to check AI.

        Of course this is crazy, but it will also unlock pretty insane scaling and productivity and ultimately we will manage it on either end via requirements and tests.

        • krona 3 minutes ago
          You're suggesting that LLMs get better at fixing bugs/vulnerabilities, but at the same time stop getting better at finding them? What if this difference is inherent and essential?
      • hombre_fatal 13 minutes ago
        The missing part of this is that verifying the bug with LLMs is also easy, and so is adversarially reviewing the proposed fix with LLMs.

        The only thing left for you to do should be directional decisions. The LLMs should pause and rope you in if the fix involves directional/invariant changes.

      • bewareofscams 1 hour ago
        [flagged]
        • shevy-java 1 hour ago
          > LLMs do find bugs, do save time

          They find bugs but whether they save time is nowhere near as clear as you try to insinuate here.

          • pixl97 1 hour ago
            They save time in finding bugs.
            • lukan 1 hour ago
              And for me they also save time in fixing bugs.
    • evenhash 53 minutes ago
      > It’s very easy to send an AI agent on an open-ended bug hunt, and if it wastes a bunch of time and effort and finds nothing, no big deal.

      No big deal? It’s not like it’s free… tokens cost money.

    • Supermancho 1 hour ago
      I don't care if you call it an over-engineered looping machine or what, there are concrete benefits to using LLMs for this. They work faster than developing your own looping algorithm and more often produce useful results than not.
    • eviks 1 hour ago
      But what's your expectation of the net?
    • shevy-java 1 hour ago
      I dislike AI, but if AI finds real bugs then this is in my opinion objectively a positive thing. Of course the question is what constitutes a real bug.
      • pixl97 1 hour ago
        Unfiltered models will help build exploits for the bugs they find, so there is some means of measuring their efficacy.
  • ks2048 46 minutes ago
    No doubt fuzzers (vibecoded or otherwise) can be powerful, but can't you just mark all "/" as potential divide by zero errors?

    I guess sometimes developers think they "know" some variable won't be zero, but unless it checked explicitly or by the compiler, that shouldn't be trusted.

    • Someone 28 minutes ago
      > but can't you just mark all "/" as potential divide by zero errors?

      If you’re accepting large false positives rates: yes.

      If you want users to take your warnings serious: no.

      (Nitpick: you certainly don’t want to flag _all_ of them. Divisions by non-zero constants definitely should be excluded, for example (integer division by -1 can lead to overflow, but that would be a different warning))

    • saghm 25 minutes ago
      Fuzzers find inputs, not just "potential" errors that aren't triggerable.
    • dooglius 37 minutes ago
      What are you suggesting and how would it be different than how SIGFPE already works?
    • wvbdmp 40 minutes ago
      I mean there could be a guard clause? But yeah, seems like this could be statically evaluated like how some IDEs see a null check and don’t complain about nullability within the same scope.
  • robertlagrant 27 minutes ago
    What we need is a numeric type that cannot be zero.
    • drdaeman 18 minutes ago
      What we need are refinement types, where there’s a base type and a predicate. F* has this:

           val (/) : int -> (divisor:int { divisor <> 0 }) -> int
  • akshay_akula 55 minutes ago
    The open ended bug hunt is the best use case for these agents. Finding nothing costs a few dollars, finding a division by zero in ffmpeg pays for itself.
    • wy35 5 minutes ago
      Unrelated to the submitted link -- just checked your comment history and all of your comments are AI-generated like this one. What's the motivation for this?
  • 12j3afAv 1 hour ago
    Generating an incorrect input file seems to be the easiest task of all for any fuzzer.

    Generating correct input to get deep into the call stack and then finding something is the hard part.

  • Surac 1 hour ago
    send patches
    • rs_rs_rs_rs_rs 52 minutes ago
      ...they did.
      • ligarota 41 minutes ago
        Where?

        They only suggested a basic guard, chich can be useless if this case never happens

  • VCFundedGenYer 1 hour ago
    The fruits of using LLMs to code. You'll waste far more time finding what it quietly and subtly wrecked than you would have if you just coded it yourself.
    • jaggederest 1 hour ago
      Those sneaky LLMs going 7 years into the past and committing as a human:

      https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/8eda3c7f91e1a5b...

      • wiseowise 47 minutes ago
        It’s obviously Claude 69 with time travel functionality, that’s too dangerous to release to public. They’re working on space-time limiting sandbox to prevent these issues.
        • six_seven 27 minutes ago
          Its all fun and games until the Claude-who-remains hunts you down
    • vegnus 1 hour ago
      You're not reading it right. The bug was found using a vibecoded fuzzer.
      • 12j3afAv 1 hour ago
        I wonder from where Claude stole this fuzzer.
        • pjankiewicz 48 minutes ago
          Or it used something called an "analogy" which is a valid way to solve new problems.