Finding a vulnerability by looking at the diff that fixed it is very different than just looking through the code.
replyThey're saying to do that scan to every diff before release, to see if it finds anything.
replyThe point is that even if all code commits are scanned as safe by ai, black hats can still analyse the commits and diffs to find vulnerabilites for people who havent patched yet.
replyScanning every commit doesnt automatically make everyone in the world patch immediately, vulns can still be found from commits and diffs and used against those who havent patched yet.
I believe their point was that:
reply"How likely is this diff a patch for an existing vulnerability?"
Seems to be an easier question to answer than
"Are there any new vulnerabilities introduced by this diff?"
In other words identifying that a patch is for a vulnerability is typically easier than finding the vulnerability in the first place.
If the diff will just be fed to LLMs regardless then what is easier is probably a moot point.
replyThe diff yields the patched code which is used to produce the exploit.
reply> it'll become common/forced practice to pre-scan code.
replyYou'd think.
But then you'd think people would do a lot of other things too. I hope, I guess.
The other danger is that "the cloud" may become even more overwhelmingly dominant. Which of course has its own large security costs.
Remeber (to you both) extrapolation is a perilous business.
replyObligatory xkcd https://xkcd.com/605/