Hacker News Reader

Comment by CodeWriter23 | Hacker News Reader

I think the emergence of the LLM-integrated IDE can be leveraged to transform a powerful yet unsafe language like c into a safe language.

View on HN

Strong disagree. Unless you're talking about using an LLM to help transform C into e.g. Rust. I don't see formal methods being unseated by probabilistic techniques (LLMs included) any time soon.

Funny, I would expect the opposite, or at least there would be a different class of problems with LLM assisted C. What guardrails would prevent this, and if there are no tradeoffs with the power of C, why haven't we put those guardrails on for human crafted code?

Static analyzers be entering a new era

How? I don’t see the connection

Generated C code can be safer than hand written C code if you can prove properties of the generator or carefully test and review the generator itself.

2 examples that come to mind are wuffs and wasm2c. Both produce C code that can be shown to be safe due to the properties of the code generator and its input language.

I am not sure LLM output is amenable to same kind of analysis, but you could conceive of an LLM trained on exclusively safe code.

An LLM trained on exclusively safe code could can still combine it in unsafe ways.

IDC about being downvoted, got points to burn. But I would like some downvoters to explain how given:

A) “safe” languages at compile time or run time can avoid vulnerabilities

B) it is possible for a human to code safe patterns in an unsafe language (human error notwithstanding)

C) an LLM can detect patterns even adapt to an individual coder’s style

And then conclude:

There’s no possible way an LLM in real time can detect known vulnerability-causing patterns and recommend safe patterns

I’ll wait…

I don't understand why people downvote this comment. It is perfectly reasonable and we can assume with no doubt that AI based analyzers become much better in future in analyzing large code bases and discovering unhandled states, or deviations from specifications, or contradictions or specification gaps.

C is unsafe by design, especially once you think about things like your code calling and being called by other code which you don’t develop. An IDE can only help so much unless what we’re saying is that you’re using it to convert logic into an actually-safe language like Rust.

A lot of things in our daily lives are "unsafe by design"; just go to a kitchen and grab a knife; our common solution is to keep those things out of the hands of children until they have learned to safely use it.

Concerning an IDE: you vision apparently doesn't reach far enough; imagine AI tools which are able to understand both, the requirements and the code, and are able to recognize logic deviations and other unmitigated risks. Btw. Rust is far from "actually-safe"; it helps avoid some memory issues (not all), but there is still a wide range of possibilities to create safety issues, even in Rust.

C isn’t unsafe like a kitchen knife, it’s unsafe like a folding knife with a hinge which collapses while you’re using it. We’ve been saying programmers need to be better for decades but it’s not just skill but also the undefined behavior, unsafe APIs, and backwards compatibility which have made that much less successful than hoped.

Now, the techno-mysticism will eventually become true when we get the AGI you describe but that’s both far beyond what we have now and would immediately raise the question of whether it’d be effort better spent migrating to a less poorly-designed language.

Reply on news.ycombinator.com