0xabad1dea

Risk Assessment of GitHub Copilot

0xabad1dea, July 2021

this is a rough draft and may be updated with more examples

GitHub was kind enough to grant me swift access to the Copilot test phase despite me @'ing them several hundred times about ICE. I would like to examine it not in terms of productivity, but security. How risky is it to allow an AI to write some or all of your code?

Ultimately, a human being must take responsibility for every line of code that is committed. AI should not be used for "responsibility washing." However, Copilot is a tool, and workers need their tools to be reliable. A carpenter doesn't have to

nurdabolatov

# Source: https://nurdabolatov.com/parallel-processing-large-file-in-python

import multiprocessing as mp
import time
import os


def process_line(line):
    # Count frequency for every character
    counter = {}

s-m-e

# -*- coding: utf-8 -*-
# QGIS 3.x / Python 3.x

from math import sqrt, ceil
from multiprocessing import Pool, Process, Queue
from multiprocessing.pool import ThreadPool

WORKERS = 2

def worker_task(number):

bmegli

Motivatation

• modern CMake is required for building a lot of new software
• CMake is dependency for many packages (e.g. ROS related)
• we don't want to remove CMake (which would remove packages that depend on it)
• we want safe procedure to update CMake that can be reversed easily

Current version in OS

Check current version

sindresorhus

Pure ESM package

The package that linked you here is now pure ESM. It cannot be require()'d from CommonJS.

This means you have the following choices:

1. Use ESM yourself. (preferred)
   Use import foo from 'foo' instead of const foo = require('foo') to import the package. You also need to put "type": "module" in your package.json and more. Follow the below guide.
2. If the package is used in an async context, you could use await import(…) from CommonJS instead of require(…).
3. Stay on the existing version of the package until you can move to ESM.

migurski

malchata

React Bias

It may seem like a bold suggestion that we as web developers can choose the wrong tools for the job because we tend to be swayed by appeals to popularity or authority, but simple statistics imply just that. For example, React (https://reactjs.org/) is a JavaScript framework that emphasizes componentization and simplified state management. It enjoys strong advocacy from a vocal and dedicated userbase within the developer community.

Despite React’s apparent popularity, however, The HTTP Archive observed in 2020 that React only accounted for 4% of all libraries in use across the 7.56 million origins it analyzed (https://almanac.httparchive.org/en/2020/javascript#libraries).

For context, The State of JS 2020 Survey (https://2020.stateofjs.com/en-US/), which surveyed roughly 23,765 respondents, offers the following statistics:

• 70.8% of respondents identified as white.
• 91.1% identified as male, whereas 5.8% identified as female and 0.9% identified as non-binary/third gender.

zit0un

openapi: 3.0.0
info:
  version: 1.0.1
  title: GeoJSON format
  description: >
    This document defines the GeoJSON format as an OpenAPI.
    It contains the definitions for 'Feature' object and 'FeatureCollection'
    objects, as well as the definitions for all 'Geometry' objects.
    It conforms with the 'RFC-7946' standard from IETF (August 2016 version)

adactio

// Licensed under a CC0 1.0 Universal (CC0 1.0) Public Domain Dedication
// http://creativecommons.org/publicdomain/zero/1.0/

(function (win, doc) {
    // Cut the mustard.
    if (!win.localStorage) return;
    // You should probably use a more specific selector than this.
    var textarea = doc.querySelector('textarea');
    // The key for the key/value pair in localStorage is the current URL.
    var key = win.location.href;

kissgyorgy

import asyncio
import psycopg2

# dbname should be the same for the notifying process
conn = psycopg2.connect(host="localhost", dbname="example", user="example", password="example")
conn.set_isolation_level(psycopg2.extensions.ISOLATION_LEVEL_AUTOCOMMIT)

cursor = conn.cursor()
cursor.execute(f"LISTEN match_updates;")