Xkeeper Xkeeper0

Risk Assessment of GitHub Copilot

0xabad1dea, July 2021

this is a rough draft and may be updated with more examples

GitHub was kind enough to grant me swift access to the Copilot test phase despite me @'ing them several hundred times about ICE. I would like to examine it not in terms of productivity, but security. How risky is it to allow an AI to write some or all of your code?

Ultimately, a human being must take responsibility for every line of code that is committed. AI should not be used for "responsibility washing." However, Copilot is a tool, and workers need their tools to be reliable. A carpenter doesn't have to

	//
	// main.c
	// 2fast2fizzbuzz
	//

	#include <stdio.h>
	#include <pthread.h>
	#include <sched.h>

	typedef struct {

	#!/usr/bin/php
	<?php

	// Oh, um.
	// This code is pretty bad. I will add comments and put it into a repo later maybe...
	// It needs to probably be fixed up too, this is pretty ugly so far
	// I just wanted to proof-of-concept it.
	//
	// This uses somewhat undocumented API pokes to get video details and download them
	// You can only download your own recordings. May not work with VODs, who knows!

	<?php

	// This file was butchered from the Disgaea PC savefile tools
	// https://github.com/Xkeeper0/disgaea-pc-tools/

	if (!isset($argv[1])) {
	die("Usage: php ". $argv[0] ." <file to decompress>\n");
	}
	if (!file_exists($argv[1])) {
	die("file not found: ". $argv[1] ."\n");