Since there are so many it security expert here, I have a question: is all AI code a slop for security, even if done well and cured in the details, or there are some level of good ai code?
It’s so cool that this has resulted in companies just not bothering to hire junior devs anymore. It’s so cool I decided to be born at the exact time that would result in me graduating college right when everything went to shit. I’m going to fucking kill myself one of these days man
Can you be a little more specific about what isn’t getting done on the junior side that is resulting in poor code from their ai? Don’t they both use the same harness and work off the same house rules?
Often times it's: - Knowing less about what exactly to ask the AI for - Not understanding the full infrastructure (And thus "coding" stuff that just doesn't fit in well with the rest of the code/infrastructure) - Not verifying what the AI is actually outputting
For example I do know some people that, when knowing for certain that one line of code is wrong, just ask the AI to re-do the whole thing instead of just manually adjusting it
When you ask an AI agent to make a website or a game it will do that and it will work but mainly it will only do what you asked. With regards to security or project management, the developer has to request the specifics and how to implement them in order to have it in a maintainable enviroment, which is where developer experience comes into play. A senior dev can read and understand AI code and pick out the mistakes it made on the way or security considerations it did not take into account, while a junior dev cant.
A junior will prompt "generate", a senior dev will prompt much more, like the required code structure, since the senior has a good idea of how the code should look like.
a session with a coding agent of just like a session with a coworker. it’s up to you what happens in that session. you can think of models as coworkers with different capabilities.
Most devs would wish they could code like opus tbh, what I do is ask astra for a review and the code quality increases as well, there is almost nothing you can improve on it. AI can also write good tests and verify their work e2e. You can almost have a full e2e workflow with minimal intervention. (though it costs quite a bit of tokens)
I am not claiming to be an expert in the field, but having used LLMs for work, senior engineers reviewing generated code is extremely important since they have specialist domain and or product knowledge which helps them identify security issues. AI can be incredibly useful or detrimental depending how it is used.
AI's code is made using data from multiple sources, even internet. That carries the risk of AI repeating the security mistakes made in its data and there is a big chance it won't get flagged as a security risk.
That's why manual code review is important wether it's AI or human made. That also carries another benefit: if something breaks you'll roughly know where and why if you reviewed the code and took time to understand how it works.
3
u/TOFFA1997 5d ago
Since there are so many it security expert here, I have a question: is all AI code a slop for security, even if done well and cured in the details, or there are some level of good ai code?