Hacker News Reader

Comment by rawgabbit | Hacker News Reader

Help me understand. Snowflake configured their Github repo to allow auto fixes by Copilot. It got merged automatically without anyone's review? And introduced essentially script-injection vulnerability through the title field?

If this is the case, I would say Snowflake should shut down its repo and get off Github asap.

View on HN

No. A Snowflake maintainer opened a PR, Copilot suggested a change (introducing a vulnerability), the maintainer accepted and committed it to their PR, and another Snowflake maintainer approved and merged the PR.

And that's going to continue because no one is reading the code even when they approve it.

It's a very strange thing indeed, but not unexpected: we warned that skills not used will eventually atrophy.

Thanks.

I don't see anything in the article that says that two maintainers, let alone one, reviewed the PR manually and approved it before merging. Where are you getting this information from?

This is the PR: https://github.com/snowflakedb/snowflake-connector-net/pull/...

A human introduced the bug, not Copilot: https://news.ycombinator.com/item?id=49334262

Wow.

Admitting that there was human review from not one but two maintainers would entirely defeat the purpose of the article, which was to sell you an AI solution to the AI problem and insist that no human in the loop is better. Which, to be fair, in this case might have been better.

Reply on news.ycombinator.com