PostHole
Compose
Login
SE Radio 680: Luke Hinds on Privacy and Security of AI Coding Assistants
Luke Hinds, CTO of Stacklok and creator of Sigstore, speaks with SE Radio's Brijesh Ammanath about the privacy and security concerns of using AI coding agents. They discuss how the increased use of AI coding assistants has improved programmer productivity but has also introduced certain key risks. In the area of secrets management, for example, there is the risk of secrets being passed to LLMs. Coding assistants can also introduce dependency-management risks that can be exploited by malicious actors. Luke recommends several tools and behaviors that programmers can adopt to ensure that secrets do not get leaked.
Brought to you by IEEE Computer Society and IEEE Software magazine.
Luke Hinds, CTO of Stacklok and creator of Sigstore, speaks with SE Radio’s Brijesh Ammanath about the privacy and security concerns of using AI coding agents. They discuss how the increased use of AI coding assistants has improved programmer productivity but has also introduced certain key risks. In the area of secrets management, for example, there is the risk of secrets being passed to LLMs. Coding assistants can also introduce dependency-management risks that can be exploited by malicious actors. Luke recommends several tools and behaviors that programmers can adopt to ensure that secrets do not get leaked.
Show Notes
Related Episodes
- SE Radio Episode 533: Eddie Aftandilian on Github Copilot
- SE Radio Episode 633: Itamar Friedman on Automated Testing with Generative AI
- SE Radio Episode 606: Charlie Jones on Third-Party Software Supply Chain Risks
- SE Radio Episode 603: Rishi Singh on Using GenAI for Test Code Generation
- SE Radio Episode 535: Dan Lorenc on Supply ChainAttacks
- SE Radio Episode 666: Eran Yahav on the Tabnine AI Coding Assistant
Other References
Transcript
Transcript brought to you by IEEE Software magazine.
This transcript was automatically generated. To suggest improvements in the text, please contact [email protected] and include the episode number and URL.
Brijesh Ammanath 00:00:18 Welcome to Software Engineering Radio. I’m your host, Brijesh Ammanath. Today we’ll be discussing privacy and security of AI coding assistance with our guest Luke Hinds. Luke is the CTO of Stacklok. He created six stores while a distinguished engineer at Red Hat. He’s a security thought leader, engineer, public speaker who loves building open-source software and communities, as well as leading talented engineering teams to develop innovative cutting edge security technologies at scale. Luke, is there anything I missed that you would like to add to your introduction?
Luke Hinds 00:00:49 No, you pretty much caught it all there. Yeah, no, very succinct to Nonpoint. Thanks
Brijesh Ammanath 00:00:54 Luke, if you can start off by explaining the increased role of AI coding agents in improving programmer productivity.
Luke Hinds 00:01:01 Certainly. So this really harks back to 2017 when the paper came out of Google around the Transformers architecture. The paper was called Attention is All That You Need. Speaking about the attention mechanism. Prior to then we’d had AI machine learning own had been around for quite some time, but we hadn’t really seen any killer applications of it beyond statistical analysis and people would use it as a business tool essentially. And so we started to see these sort of general-purpose models come out. And then quite early on there was of course GitHub copilot. And this is where it was quite astonishing really, even though the quality was not quite there, the ability for these machines to generate code. It was noticed as being a very clear emerging use case application of these models was how good they were at generating code. And initially we started off with a system called ìfill in the middleî.
Luke Hinds 00:01:59 And ìfill in the middleî is auto completion of code. And what happens is the code is generated based on the prepend and the append. So the content that surrounds the prompt or effectively where the cursor is situated within an IDE. , so the prompt would fill up the code that’s above, so 10 lines and the 10 lines below the cursor. And then the model would have to predict what is in the middle. So it was called ìfill in the middleî. FIM is the term that they use. So I think this was one of the first times that we started to see AI really start to get some traction with software engineers. And you got this auto complete magical auto complete functionality that came around. And that was really where there would’ve definitely been a marked increase in productivity for people that were using that because as a software engineer there would be a lot of tasks that you would perform where you wouldn’t really need to exercise any level of really pushing your brain to the limits.
Luke Hinds 00:03:02 There’ll be things such as hashing out structs and setting up functions and just sort of general housekeeping type tasks. And AI proved to be very good at doing that. I remember when I started to use co-pilot myself, I was quite surprised at how it would understand precisely the response format that I would need to set out for a struct or it would somehow magically understand what I needed for a Json structure. And this was where we really started to see, I think a productivity increase was in a lot of ways it was a tool as a developer tool in much the same way as when Shells started to become more purpose to developers. And you started to get that sort of rich experience within a terminal and people made them very much their own thing because it improved their productivity essentially. And that was the start of the productivity gain that has happened within software development. I think there is a lot more future applications of AI that will increase productivity and will help a lot to reduce churn. It will take away the grind of a lot of stuff that engineers have had to do, they’ve had to live with and accept. I think we’ll start to see AI factor those away over time as well.
Brijesh Ammanath 00:04:14 Alright, we have covered GitHub Copilot in one of our previous Episode 533. I’ll make sure we’ll link it to that. Have any studies been done to quantify the improved productivity by using AI coding assistance?
Luke Hinds 00:04:27 Yes, there are. Now people have different views as to how accurate they are, but one of the ones that I heard was it was related to GitHub and it was around the region of 45 to 50%. I cannot remember the exact figure now, but there’s quite a substantial claim that productivity had been significantly raised through the use of AI.
Brijesh Ammanath 00:04:49 That’s quite a large number.
Luke Hinds 00:04:50 Certainly is, certainly is. And we have noticed a marked ability to be able to move more quickly with what we build. Thank you to AI. So, I’m part of a startup and we use AI very effectively for prototyping. So we wouldn’t really trust it in a large code base. It just doesn’t handle large code bases so well. But when you very quickly want to prototype and build something, that’s where AI is exceptionally strong. To move from zero to something, you can act very quickly. And that’s very useful in a fast-moving environment such as a startup where you need to quickly validate ideas, you need to connect up and integrate different systems. And AI can be great there because you just want to see something wiggle, you want to see something working, you want to prove the hypothesis to yourself. And that’s where I found AI. I’ve really embraced AI myself, is to do a lot of tasks where I need to move fast, I need to be reactive, I want to try something out, I want to validate something. That is where AI’s really come into its own for myself and some of the engineers that I have in my company working on producing software.
Brijesh Ammanath 00:05:58 And what are the key risks introduced due to the reliance on AI coding assistance?
[...]
📄 3f5ee243547dee91fbd053c1c4a845aa-Paper.pdf