| ▲ | forestry 2 hours ago |
| Peer review of changes is still important. |
|
| ▲ | Rumudiez 2 hours ago | parent | next [-] |
| Multi-model cross-review is important |
| |
| ▲ | _joel an hour ago | parent | next [-] | | I'm all for using a council of LLMs, I wrote a tool for it https://github.com/joelio/owl - but you still need to read through PRs yourself, at the very least. | |
| ▲ | acedTrex an hour ago | parent | prev [-] | | It's not actually, thats just shoving more shit into the shit pipeline. Humans need to review this stuff yall there's no way around that, apparently to some, very inconvenient reality. | | |
| ▲ | devin an hour ago | parent [-] | | It’s clear that they want this to be true so bad that they’re just not going to do it, and will spend a ton of money on quality gates and mitigation strategies instead of just reading some code. |
|
|
|
| ▲ | Twirrim 2 hours ago | parent | prev [-] |
| You can't rely on people spotting the significance of such changes |
| |
| ▲ | eithed an hour ago | parent | next [-] | | Tests would have caught it = https://github.com/rhysd/actionlint injection check | | | |
| ▲ | dv_dt an hour ago | parent | prev | next [-] | | I have been talking to people who want to autoreview and approve "minor" AI prs. For security especially, I think if the models weren't enough to prevent the issues, they aren't enough to judge what is minor. | |
| ▲ | fn-mote 2 hours ago | parent | prev [-] | | ^^ Absolutely. Nothing in the PR jumps out as a red flag. Unless you know how the internals work, I suppose. | | |
| ▲ | larsonian 38 minutes ago | parent | next [-] | | Are you kidding? It's a very obvious case of quote injection. Not some subtle race condition or anything. | | |
| ▲ | joombaga 9 minutes ago | parent [-] | | I think it's obvious too. I'd call out any case of `${{ }}` interpolation in a `run` block, and it's something I watch for in PRs. I also know other people don't watch for this, as I've corrected it about a hundred times. Over the last 10 years my average colleague understands less and less about injection or to watch for it at layer boundaries. |
| |
| ▲ | chrisjj an hour ago | parent | prev [-] | | > Nothing in the PR jumps out as a red flag. Made by AI? |
|
|
