GitHub Copilot

https://news.ycombinator.com/item?id=27676266&p=2

https://news.ycombinator.com/item?id=27676266&p=3

https://news.ycombinator.com/item?id=27676266&p=4

https://news.ycombinator.com/item?id=27676266&p=5

(Comments like this will go away when we turn off pagination. I know it's annoying. Sorry.)

It's really like pair programming, even though I'm coding alone. I have a better understanding of my own code, and I tend to give better names and descriptions to my methods. I write better code, documentation, and tests.

Copilot has made me a better programmer. No kidding. This is a huge achievement. Kudos to the GitHub Copilot team!

Hundreds of developers are using it every day internally, and the most common reaction has been the head exploding emoji. If the technical preview goes well, we'll plan to scale this up as a paid product at some point in the future.

  #!/bin/bash
  # List all python source files which are more than 1KB and contain the word "copilot".
  find . \
    -name "*.py" \
    -size +1000 \
    -exec grep -n copilot {}\;

The "1000" in "-size +1000" has a unit of 512 byte blocks so it is looking for files that are greater than 512000 bytes, not 1KB. This would be very easy to miss in a code review and is one of those terrible bugs that causes the code to mostly work, but not quite.

https://linux.die.net/man/1/find

As someone more aligned with the Dijkstra perspective, this seems to me like one of the single worst ideas I've ever seen in this domain.

We already have IDEs and other tools leading to an increase in boilerplate and the acceptance of it because they make it easier to manage. I can only imagine what kinds of codebases a product like this could lead to. Someone will produce 5000 lines of code in a day for a new feature, but only read 2000 of those lines. Folks that still expect you to only check in code you understand and can explain will become a minority.

I wonder how long it will be until someone sets up the rest of the feedback loop and starts putting up github projects made of nothing but code from this tool, and it can start to feed on itself.

Cargo-cult programming has always been a problem, but now we're explicitly building tools for it.

It’s a pretty bad feedback loop that robs us of our independent thought by way of falling victim to laziness, a fundamental human weakness. You can imagine something where in this case the code autocomplete is so large that you really want to make that autocompletion work, even if you know it’s not elegant or possibly even correct code… or maybe it’s just repetitive and not abstracted well, but here it is autocompleted and done so why would you fight that?

If we continue abstracting more and more of this way, based upon datasets that are averaged across everyone, we lose the individual in favor of the masses, bringing us all down to a common denominator.

If we must lose our humanity to the machine, I’d at least like to see an autocomplete from Peter Norvig’s code, or writing from particularly effective communicators or famous authors.

So everything generated also GPLv2?

A couple weeks ago I ran a few experiments with AI-based code generation (https://news.ycombinator.com/item?id=27621114 ) from a GPT model more suitable for code generation: it sounds like this new "Codex" model is something similar.

If anyone from GitHub is reading this, please give me access to the Alpha so I can see what happens when I give it a should_terminate() function. :P

OpenAI’s tech opens an ethical Pandora’s box:

1. It’s clear that the raw inputs to all of OpenAI’s outputs originated with real, human creativity.

2. So, in a sense, OpenAI is laundering creativity. It reads in creative works, does complicated (and, yes, groundbreaking) transformations, and produces an output that is hard to trace to any particular source.

3. Yet, isn’t that effectively what human brains do too? Perhaps OpenAI lacks the capacity for true invention, but I’d argue that most people live their whole lives without a meaningful creative contribution as well.

All told, I don’t have a good framework for thinking about the ethics here. So instead, I’ll simply say:

Wow.

This may be the first time that a proprietary coding tool offers such a great value preposition that I am actually interested in trying it out and potentially even paying for it. It's also a bit concerning that this will probably be extremely hard, if not impossible, to create an FOSS version of this technology, just because of the immense amount of computing power, and by extension money, needed to create GPT3.

I'm not that comfortable with the idea of a future where proprietary AI-based solutions and libraries (e.g. automatic testing libraries, which have been mentioned here a few times) are so powerful that I'll be forced to use them if I don't want to waste my time.

I think it would make the most sense as a really advanced static-analysis tool/linter/etc. Imagine writing something like C where whole classes of errors can't be checked statically in a mechanical way, but they could be found by a fuzzy ML system automatically looking over your shoulder. Imagine your editor saying "I'm not sure, but that feels like a memory error". And of course you can dismiss it "no, good thought, but I really meant to do that". Imagine an editor that can automatically sniff out code-smells. But the human, at the end of the day, still makes the call about what code to write and not write; they're just assisted with extra perspective while doing so

This raises two questions.

- is there a way (right now or planned for the future) for library maintainers to mark suggestions to be removed from the suggestions? I can foresee Copilot being used as a source of 'truth' among less experienced developers, and getting people turning up in the Issues or Discord asking why the suggestion doesn't work might be a bit jarring if the maintainers have to argue that "Github was wrong."

- if a library is hosted on Github is there a way to mark some examples as Copilot training data? Maybe by having a 'gh-copilot' branch in the repo that represents high quality, known-good examples of usage?

    def strip_suffix(filename):
        """
        Removes the suffix from a filename
        """
        return filename[:filename.rfind('.')]

    import unittest

    def test_strip_suffix():
        """
        Tests for the strip_suffix function
        """
        assert strip_suffix('notes.txt') == 'notes'
        assert strip_suffix('notes.txt.gz') == 'notes.txt'

Personally I think this whole class of feature only offers trivial short-term efficiency gains at the expense of long-term professional development and deeper understanding of your field.

  - I write GPL'ed code.

  - Someone uses this tool to develop a proprietary solution. 

  - I later prove that the tool generated code that is equal to mine.

How I'd defend myself? I'd only use such a tool if there are guarantees of the licenses of the code it was trained on. Without such guarantees, it is just too risky.

And yeah that's a niche example, maybe this is super helpful for writing a react app or something very library heavy. But gut feeling without trying it is that there's no way this could actually work on anything but the most common tasks that you can google and find solutions for already, just made easier so you don't actually have to google for it.

When I used tabnine which learned from you as you edit, it was fairly helpful for very repetitive code within the same project. But it was no where near "read english and write the code I meant for it". I'm curious to know how well this actually performs for non-common tasks, and whether it can understand ideas in your codebase that you come up with. If I make a WorldAbstractionOverEntities thing in my code, and then later use it in the project, will the AI be able to help me out? Or is it going to go "sorry, no one on github has used this thing you came up with an hour ago, I can't help you". An AI that could understand your own codebase and the abstractions you make and not just popular libraries would be infinitely more useful imo.

That said, I haven't tried this, maybe it'll turn out really good.

If you need to go through the suggested code to ensure it's correct, you may as well write it yourself?

If you glance at it and it looks about right, you can potentially overlook bugs or edge cases, you'll lose confidence in your own code since you didn't properly conceptualise it yourself.

Potentially for newer developers it robs them of active experience of writing code.

Much like learning an instrument, improvisation, or say physics, a lot of people learn by doing it, even if it's grunt work. IMO this is necessary for any professional.

Maybe it will be seen as a crutch, maybe I'm getting old? I have tons of code snippets, but it's usually stuff I've written and understood and battle tested, even if it was initially sourced from SO. Having it in the text editor and appear out of nowhere with no context seems like it'd need some adjustment in apprehension.

Edit: I should have been clear, I'm not against others using Copilot and will try it out myself. I can see it being useful in replacing one-line libs like in nodejs, i.e., copying a useful well-known and needed snippet vs installing yet another lib that could be a sec issue.

Also the industry is the real gatekeeper—we have tools that don't require us to repeat prior-art, yet have to go through hurdles of leetcode-style interviews for a job. Maybe in the future the hardest part of being a (AI-driven) developer will be getting a job?

Sure, you might say "it's all marketing and if AP exists nobody would buy CP", but I don't think it's that simple. Customers understand when their expectations are being met, exceeded, or let down.

However, I find the process of writing these sorts of functions cathartic and part of the process to get into zen-mode for coding. I think I'd feel less joy in programming if all of this was just done by glorified commenting and then code-review of the robot.

I like to think of coding in terms of athletic training, which usually is comprised of difficult tasks that are interspersed with lighter ones that keep you moving (but are giving you a bit of a break). Training for soccer teams often involved lots of sprinting and aerobic exercise - and in between those activities we would do some stretching or jogging to keep our body moving. These sorts of small functions (write a function to fetch a resource, parse an input payload, etc.) are when my brain is still moving but getting ready for the next difficult task.

https://copilot.github.com/#faqs

>> How does GitHub Copilot work?

>> OpenAI Codex was trained on publicly available source code and natural language, so it understands both programming and human languages.

I want to propose a new Bingo style game where you get points when AI researchers (or rather their marketing teams) throw around big words that nobody understands, like, er "understands" with abandon. But I can't be bothered.

An AI researcher called Drew McDermot warned against this kind of thing in a paper titled "AI meets natural stupidity":

http://www.cs.yorku.ca/~jarek/courses/ai/F11/naturalstupidit...

In 1976.

Why doesn't anybody ever learn from the mistakes of the past?

For foss ones it could be great though.

I think the best part for me is that how it's going to introduce even more low code devs to the worker pool, which means I will be able to raise my price again. Last time this happens, when designers got to the backend, I got +30% in a year once my clients figured out the difference in output.

Like… a bubble of developing code from yesterday’s code (plenty flawed itself) and with exponential growth based on feedback loops of self-fulfilling prophecy —— I’m assuming copilot (and every openai variant to come) will essentially retrain itself on new code developed,which overtime might all be code it wrote itself.

Did we just create a hamster wheel for the industry, or high-rise elevator?

2 security thoughts that I couldn't find answers to:

1. how does the input fed into OpenAI codex filter out malicious code pollution? or even benign but incorrect code pollution (relevant research on stackoverflow for example - https://stackoverflow.blog/2019/11/26/copying-code-from-stac...)

2. In an enterprise setting, what does the feedback loop look like? How do you secure internal code that is being fed back to the model? Does it use some localized model? HE, etc?

Although if a license can permit or prohibit use in training commercial models, does that mean that the lack of permission implies a prohibition on it?

From the examples:

    body: text=${text}

    rows, err := db.Query("SELECT category, COUNT(category), AVG(value) FROM tasks GROUP BY category")
        if err != nil {
            return nil, err
        }
        defer rows.Close()

    float(value)

    create_table :shipping_addresses do |t|

      var date1InMillis = date1.getTime();

I could go on, but literally the first five examples I looked at are buggy in some way.

Edit:

   const markers: { [language:string]: CommentMarker } = {
      javascript: { start: '//', end: ''},

Edit 2:

    function collaborators_map(json: any): Map<string, Set<string>> {

What about

    new Map(json.map(({name, collaborators}) => [name, new Set(collaborators)]))

Edit 3:

      const images = document.querySelectorAll('img');
      for (let i = 0; i < images.length; i++) {
        if (!images[i].hasAttribute('alt')) {

    document.querySelectorAll('img:not([alt])').forEach(

    img:not([alt]) { border: 1px solid red; }

    eslint-plugin-jsx-a11y because that maybe that img was rendered through react.

    it should really be an `outline` because we don't want this to reflow the page and we can. And maybe a will-change.

But I'm worried these kinds of AI-assist tools will lead to "code spam" that may increase developer productivity even more, yet we no longer have Moore's law to absorb the additional inefficiency in performance these tools may introduce.

1. A lot of people on this thread are concerned about licensing issues with GPL etc. I am sure Github will restrict the beta until it figures out that stuff.

2. I wonder if eventually our corrections to the code suggested by the model would be used to feedback to the model, and if that'll lead to a differential pricing - If I let it see my code, I get charged lesser.

3. I believe a mini-GPT-3 model is where it's at. GPT-3 (and similar) models look to be to too big to run locally. I've been using TabNine for past year or so & it gives me anywhere between 5-10% productivity boost. But one of the main reasons why it works so well is because it trains on my repo as well. TabNine is based off GPT-2 from what i've heard.

4. prediction: Microsoft is probably going to milk GPT-3. Expect a bumpy ride.

5. In all likeliness, this would be a great tool to make developers productive, rather than take their jobs - at least at levels that are more than just code-coolie.

6. Eventually all tasks with enough data around it will see automation using AI.

While they may be useful in propaganda, state or commercial, I'm not sure why Microsoft GitHub would find it useful to generate volumes of bullshit source code.

(Yes that’s an HN-frowned-upon joke comment, but that is my dev environment)

AI for maintaining, upgrading, improving, and fixing code.

After all, devs spend 80%+ of their time doing those things and they’re WAY more painful than writing code imo.

Isn't that the wrong way around? I'd like to start by writing the tests, and for GitHub Copilot to please implement the function that makes them pass.

- Copilot suggests me a snippet of code

- It's almost what I wanted. I fix the code

- Copilot sends back the fixed code to GitHub

- Copilot gets better at guessing my (and others) wishes

Unless Copilot is running locally, I won't use it.

- Could someone deliberately publish poor code to reduce the overall performance of the model?

- Could someone target a specific use case or trigger word by publishing deliberately poor code under similar function definitions?

[1] https://docs.github.com/en/early-access/github/copilot/resea...

It uses Open Source as its input but, as far as I can tell (and I would be pleasantly surprised if I was wrong), CoPilot itself is not Open Source.

It is also tied to Visual Studio, making Visual Studio, a Microsoft Product and on its way to monopoly position even more up the power law curve to monopoly status.

This would be much more interesting and less concerning if CoPilot was Open Source and designed to plug in to other Editors / IDEs like via lsp or something similar.

One example of where this can be a problem is numerics - most software developers don't understand it and routinely do questionable things. I'm curious what effort the authors have put in to mitigate this problem.

Well, isn't GitHub part of Microsoft now? No wonder it has gained telemetry...

I'm a bit worried that this thing will lead to even more bugs like the typical StackOverflow copy&paste which compiles fine, runs OK, but completely doesn't understand the context and thereby introduces subtle difficult to find issues.

My personal take on autocomplete has always been that I only use it so that I can use longAndDescriptiveFunctionNames. Apart from that, if your source code is so verbose that you wish you didn't have to type all of it, something else probably already went wrong.

And even if you're okay with sending your code, what about hardcoded secrets? What's to prevent Copilot clients from sending things that should never leave the user's computer? Heuristics? Will we be able to tell what part of the code is about to be sent? And is the data stored?

Until this is fixed, good luck but not thank you Microsoft.

AI tools like this will be force multipliers, the same way that IDEs are. SWEs 20 years ago decried the rise of the IDE the same way that some are moaning about this. "It'll lead to a generation of know-nothing programmers." Instead, SWEs are more productive today than they ever have been before.

Software engineers should welcome the day that an AI makes it possible to describe what you want instead of telling the machine exactly what to do. That's where I see this technology going in 20 years. That said, it will likely never be good enough to replace an engineer completely because the value of an engineer is in deciding what to build and how to build it. Not in determining exactly which lines of code to write. SWE will be more enjoyable as a field in 20 years because we won't have to wrangle compilers, or deal with fundamental limitations of how computers express ideas versus how humans express concepts. Instead, we'll let the AI translate for us and deal with all those problems automatically.

In the short term, I see lots of potential for this technology to make something like the ultimate cross-compiler. If you can take someone's code, convert it to some kind of universal representation (embedding), and then convert that to another language (and get working code that verifiably produces the same results) you would make a ton of money.

What this really displaces is StackOverflow (or some of its users...)

I'm picturing the StackOverflow problem where the accepted answer is actually wrong, and actively pushing it into more peoples code is just proliferating the problem into more places. Making people faster at building mostly the write but sometimes the subtly wrong thing.

A lot of the time, I'm thinking pretty deeply about the code I'm writing, and as I'm writing code I'll also be thinking about how it applies in context.

Having some external agent inject new code into my editor would shatter my thought flow, since I'd then have to grok whatever it just spit out instead of continuing on with whatever thought I was pursuing at the time.

> I agree to these additional telemetry terms as part of the technical preview

https://www.folklore.org/StoryView.py?story=Negative_2000_Li...

What you didn't write or deleted does not contain errors and you do not need to support or fix it.

(dang please don't ban me for a low-quality comment :) i couldn't resist but will not make it a habit!)

https://github.com/semiosis/pen.el/

http://historymesh.com/object/power-loom/?story=textiles

The absolute gall of Microsoft claiming fair use to gate keep knowledge of millions of minds...

I suspect that for drudgery or work stuff I would happily take some help with typing, but I am not sure (beta access please!) if I would want if for my novel, or my sales copy.

I am (optimistically) hoping that my novel has my voice - my unique fingerprint of tone and vocab.

And I wonder if my software has similar tone. A much more restricted syntax of course, but my choice to use meta programming here, an API design there. I may be over thinking it.

Now there are only three questions left: how will this be monetized? Will it recoup the purchasing price of Github? And how can vendor lock in be achieved with this or sny follow up products?

I am looking forward to AI testing the programs I write though. That would be awesome.

I think AI in software development will save us a lot of time, so we can focus on more interesting things. It may replace a few humans in the long term, but as software developers we shouldn't be hypocrite because we work hard to replace humans by software.

- Intentional poisoning the model with difficult to recognize and exploitable faults - Unintentional poisoning from flawed generation habits which are further reinforced by the usage being eventually fed back into the model

I don’t know how it maps to code, but in my experiments generating text with GPT-3, I have started to get a feel for its ‘opinions’ and tendencies in various situations. These severely limit its potential output.

[0] https://www.tabnine.com

Obviously a program that is able to write actual great code reliably would be spectacular, but we aren't there yet, I don't think Copilot presently is able to make me meaningfully more productive.

Never realised they'll read my code to make something like this and maybe even make profit from it.

If this improves developer efficiency by 10%, 10% fewer developers are required.

How did you construct the Copilot? Did you use a learning approach based on data from actual pair-programming sessions? Or did you take tons of code as your input and use that to suggest next methods based on input code?

I learned a ton whenever I pair programmed, but now I'm at a small company so I'm looking for fun ways to learn new methods :)

- You only need code relevant to your language.

- The amount of unique code in your language is going to be relatively small in compared to say, the entire history of internet comment.

- Training a model also shouldn't take long.

I personally would never use an online version feeding all my code back to a home server somewhere, and leaving breadcrumbs that might suggest I'm violating the GPL.

I remember over a decade ago seeing a grad student project with a very straightforward and very clever idea: extending JavaDocs based on code snippets of actual use (to address the common pattern problem in Java code that you often get an instance of an object not by direct construction, but by calling a factory function or singleton getter somewhere). Kicking myself that I didn't see this day coming.

1: https://twitter.com/gr2m/status/1409909849622601729

[1] https://www.kite.com

To some extent, it seems like this could suggest code chunks found somewhere else verbatim, which sounds like a copyright issue, but I also don't know if open-source licenses inherently allow you to train on their code in the first place?

Currently consulting for a bank who takes their security very seriously. Would there be extra hurdles here to make sure there's no calls or requests being made using our data?

https://www.kite.com/

https://www.tabnine.com/

Also, this tool will enable more cheap LOC churn for those gaming performance reviews (not that this is currently difficult, but it will be even easier).

Other than that single issue, which is really a set of issues, it seems to work really well from the videos I've seen.

However, the elephant in the room is definitely a tool that can auto fix bugs - the type of bug that is usually given to a junior developer because the team doesn’t want them building features yet.

I don't know if Copilot does it already but I would love if there was a tool that does exactly the opposite — convert code to comments and documentation.

https://madnight.github.io/githut/#/pull_requests/2021/1

I don’t see this going anywhere.

If it’s really good and we can actually have 1 developer instead of 2 now why would any developer want to do this? this would basically be a piece of automation that diminishes the value we are creating.

If it’s crap it’s going to create mountains of verbosity and code written to pump up the LOC numbers. It’s terrible. After that you’re gonna end up maintaining and enhancing what an “ai” spew out.

I’m not buying the argument this is a problem that needs solving. It’s in the same vein with self driving cars. It looks impressive, it’s good PR, it’s absolutely insanely hard to get right and the benefits (even if we get it right) are questionable.

the way it was introduced is also disingenuous.

Another extra work for code reviewer. However on the right hand it will be very powerful!

In that case? Are those who don't control the AI needed? What about when those optimizations can be made by the AI itself also?

It would be nice if github made this tool publicly available in a good spirit of open-source instead of straight up monetizing it.

I get that github is not a non-profit but still.

I assume companies that were fine with providing you functionality for free may think about this twice because with that they're giving away knowledge of how to build functionality.

Autocompleting code in general? Sounds like a bad idea, imho.

We genuinely don’t know what it means for licenses or whatnot right now.

I really like thar Tabnine train against your own codebase and suggest things based on it. It’s crazy accurate and smart a surprising amount of time.

of course I guess copilot won't be perfectly accurate right now or even maybe for a long time but it is interesting to imagine a future where the programmer can think and get code written without lifting a finger.

I mean, I understand (I think) how Bert/gpt works, but I can’t quite see how you would train this.

Has anyone seen anything about this system? Are others able to build upon it?

https://haskellwingman.dev/

This product seems to encourage the complete opposite - hack together stuff without thinking about how it could fit into your accumulated Baukasten of components.

This must be easy to measure, over the entire open source corpus.

How about two lines?

How can one signed up? This could make one programmer an army.

Now, how about you use that to implement a non-horrible search experience?

I don't use autocomplete nor syntax highlighting, this thing feels almost hostile to my ways.

(the only non linear help I love, is jump to definition)

nope, it’s not April 1

Your move, AI.

maybe sooner than we think?