Hacker News Reader

Comment by dabedee | Hacker News Reader

How many of those automated fixes were reverted? How many introduced a new bug? What's the false positive rate on the finding agents? The post has counts for everything that went right and nothing for what could go wrong.

View on HN

Exactly, also it lacks a lot of context as to why they did that.

Possible (probable?) scenario:

- Marketing: "we found and fixed lots of bugs thanks to AI"

- Reality: the KPI is now to fix as many bugs as possible with the help of AI, so they used AI to search old and easy bugs in the backlog, and then fixed it manually

Huh? Maybe a third scenario is that AI helped fix the bugs? Like described in the actual post you are replying to? This level of conspiracy theory is getting a bit ridiculous.

I think you’re right, my base assumption is that the models can code and can fix bugs, and can code more in parallel and faster than humans at a lower cost.

If Google are tackling lower value bugs with AI the number is in a way inflated compared to some utility measure (fixing a smaller number of worse bugs could be preferable) but it’s still things fixed.

There's no reasoning with the folks who are anti-ai and claim LLM's cannot produce anything worthwhile. They are basically flat-earthers or anti-vaxxers at this point. There is literally no amount of evidence that will convince them. They will always say that LLMs cannot produce anything but garbage just like the anti-vaxxers who state vaccines just cause autism. They are both fucking morons who no one with any grip on reality should indulge.

> The post has counts for everything that went right and nothing for what could go wrong.

That's AI for you.

At Amazon we have many forums to share our AI wins, but none to share AI failures or disappoinments.

No wonder execs make bad decisions regarding AI, they only hear completely one-sided stories.

At my company there's a lot of discussion about AI and complaints that people run out of tokens within a day, but zero results are shown. No measurable (or measured) gains. Or nothing that people are willing to talk about, in any case.

I’ve been asking since months on HN for proofs that companies using AI see positive ROI from it. So far I didn’t get a single concrete example

At my company the performance improvements channels has been exploding, with people claiming giant improvements in latency, throughput, and decreased cost of the services. The cost decreases itself is order of magnitude more (at annualized run rate) more than we pay for tokens. YMMV.

I hope to see more of this across the industry.

I definitely make use of AI but in my experience I almost always could have done it better myself, the places where I threw AI at the problem I didn't care about the results being good, only good enough.

When we see memory and compute requirements for version x+1 of software decrease instead of increase I will happily say AI is the oracle people proclaim it to be.

In $COMPANY, for the mid-yearly review, the employees were asked whether their AI usage was 1/ efficient, 2/ adoptive (integrated in the way they work) or 3/ transformative.

Saying “never used it” or “I tried and it was useless” was literally not possible.

You'd have to be a pretty stubborn software engineer to not find AI useful for anything at this point, unless they're making you use Github Copilot or something far behind the frontier. You don't have repetitive tests to write? You never need to write a script to run something?

And you'd have to be a pretty pig-headed exec to assume that the only experience an employee could possibly have with LLMs is positive.

I don’t use AI for ethical reasons. I don’t want to support companies that are destroying the planet and inflating hardware prices.

Currently the only thing I personally find LLMs useful for are code reviews.

"It can't be that stupid—you must be prompting it wrong." - Ed Zitron

> At Amazon we have many forums [...], but none to share AI failures or disappoinments.

I come to HN to read about AI failures and disappointments.

This is kind of a weird take.

If you were the CEO of Amazon, would you be setting up channels for people to talk about their AI failures? The general way technology is deployed is that we try to find ways to make it work, because those are the most interesting. We're not as interested in all the ways it doesn't work.

From my perspective, some people are trying to use AI in the same way somebody might use a laptop to paddle a canoe. Sure, you can do it, but it's not a good idea. The fact that it doesn't work well is not particularly interesting.

If I steelman your position, I guess the ideal repository would be a set of cases where it's known to work well and a set of cases where it's known to not work well. A little bit like ProtonDB or SteamDB, perhaps.

>The general way technology is deployed is that we try to find ways to make it work, because those are the most interesting.

That's not the way AI is being deployed. At all.

Sure it is. It's just like the .com bust: people didn't know what the internet was good for, so they did a lot of stupid stuff with it before settling on the most interesting uses.

No, AI is more like: people do know what it is good for, but that's immaterial because hundreds of billions of dollars of debt were poured into it, such that the only glimmer of hope of getting an ROI out of it is force-feeding AI everywhere, good or bad, and normal people are sick of that.

That's fair. I still think there big similarities (people with money seeing it as the future and investing heavily, even if in reckless ways), but I agree there's a forcefulness to it this time that wasn't present before, for the reasons you outline.

> If you were the CEO of Amazon, would you be setting up channels for people to talk about their AI failures?

I would set up channels to talk about AI, encouraging both successes and failures, with proofs required for both, and punishing people who intentionally misreport on either.

Wow. Setting up a forum for discussion where people could potentially be punished for what they say is not going to encourage discussion.

That's fine, lies are more harmful than anecdotes are beneficial. There's no forum to discuss the best IDE and people still manage, in reality there's no need for a forum around AI.

Well, you're at Amazon. Is the Dev Improvement discussion group still around? I feel like that was a pretty good place to learn about neat stuff (in my case, Emacs-related). I enjoyed the discussion.

They also don’t really provide an explanation for the big uptick in bugs found M146+ in the first place.

Is that better testing? Or more bugs were being introduced in the first place?

> How many introduced a new bug?

I'd say that one is not really an issue. In 2012 the Pinkie Pie exploit chain already required chaining 6 bugs to lead to an exploit [1]. Since then we've seen chains requiring more than 10 bugs (!).

If you fix any one of those bugs, the exploit is non-functional anymore. Sorry out of luck.

So if, say, for every ten bugs you fix, you introduce two new ones then it's still a very net win. Unless of course it introduces a bug so bad it becomes a simple exploit not requiring a long chain of exploits.

But in the case of browsers we've only ever been moving to longer and longer chains of exploits required to pwn a browser.

A great many window of opportunities are closing for dark-side hackers / north korean intelligence etc.: there were probably exploit chains still open for exploitation in April that just got closed by Google.

If anything, besides the supply chains attacks in amateur-land, the world didn't stop working: projects (not just browsers but OSes too) are being hardened left and right.

Using AI to find potential bugs is an amazing use case and there really aren't many downsides.

> The post has counts for everything that went right and nothing for what could go wrong.

I'm not saying there aren't a few downsides but the benefits are just too good to ignore.

[1] https://blog.chromium.org/2012/05/tale-of-two-pwnies-part-1....

And how many were introduced by AI?

It's the opposite: humans. The most critical one (sandbox escape) has been sitting there for 13 years.

The question is how many new bugs were introduced through those AI fixes.

Is it less than a human would have? Is it more? Is it the same type of bugs?

I could be convinced either way and it's an interesting thing to ponder in my opinion.

This is the thing the anti-ai zealots will never admit. Humans fucking suck at writing code. They talk about software development as if it's only ever performed by the top 1% of the top 1%. They never acknowledge that humans make mistakes. No. Humans create perfect code every fucking time while LLM's only produce slop. It's such a fucking mind-numbingly stupid position that I have to think they have never actually worked in an organization which produced code as a value. These fucking morons want to pretend a human never introduces a memory leak when it's plain as fucking day that vulnerabilities that these "expert programmers" introduce to software are rampant. But no. The anti-ai zealot likes to pretend that only LLMs ever produce bad code. The only bugs in existence are due to LLM slop and not the literal decades of fucking slop produced by humans without any LLM assistance. It's so fucking tired at this point. They will never be able to admit that current day LLMs are far beyond the median human programmer. Their opinions are fucking useless at this point. These idiots think The Daily WTF started with LLM code. They are basically anti-vaxxers wrt to their grasp on reality. No one should take them seriously to any degree.

Fucking humans and their shitty creations eh?

I assumed it was really just AI that found them, which allowed Google to know to fix them.

Reply on news.ycombinator.com