Alex Nisnevich AlexNisnevich

Risk Assessment of GitHub Copilot

0xabad1dea, July 2021

this is a rough draft and may be updated with more examples

GitHub was kind enough to grant me swift access to the Copilot test phase despite me @'ing them several hundred times about ICE. I would like to examine it not in terms of productivity, but security. How risky is it to allow an AI to write some or all of your code?

Ultimately, a human being must take responsibility for every line of code that is committed. AI should not be used for "responsibility washing." However, Copilot is a tool, and workers need their tools to be reliable. A carpenter doesn't have to

Principles of Adult Behavior

Be patient. No matter what.
Don’t badmouth: Assign responsibility, not blame. Say nothing of another you wouldn’t say to him.
Never assume the motives of others are, to them, less noble than yours are to you.
Expand your sense of the possible.
Don’t trouble yourself with matters you truly cannot change.
Expect no more of anyone than you can deliver yourself.
Tolerate ambiguity.
Laugh at yourself frequently.

NextBus API

http://www.nextbus.com/xmlFeedDocs/NextBusXMLFeed.pdf

Agency list

http://webservices.nextbus.com/service/publicXMLFeed?command=agencyList

Obtain a list of available transit agencies.

	-- Given a list of values, returns a list of the differences between
	-- neighbouring pairs of values.
	nextLevelDiffs (a:b:rest) = (b - a):(nextLevelDiffs (b:rest))
	nextLevelDiffs _ = []

	-- Given a list of values, returns a list of the differences such that the
	-- first element is the 0-level differences, the second the 1-level and so
	-- on.
	nLevelDiffs [] = []
	nLevelDiffs elms = elms:(nLevelDiffs (nextLevelDiffs elms))

	<!--ADD THE FORM RESPONSE ACTION HERE, WITH A REDIRECT-->
	<script type="text/javascript">var submitted=false;</script>
	<iframe name="hidden_iframe" id="hidden_iframe" style="display:none;" onload="if(submitted) {window.location='http://cdb.io/1be11H7';}"></iframe>
	<form action="https://docs.google.com/forms/d/17EeoLaAVeGrLYhOGyvy7-jC9ukc90F-UvrAMz_x_LUA/formResponse" method="POST" id="ss-form" target="hidden_iframe" onsubmit="submitted=true;">

	#!/bin/sh

	# Read _why's SPOOL in real time.
	# Requires `lp` and a printer.

	BASEURL=http://whytheluckystiff.net
	if [ ! -d SPOOL ]; then
	mkdir SPOOL
	fi

	/*
	* RIFFWAVE.js v0.03 - Audio encoder for HTML5 <audio> elements.
	* Copyleft 2011 by Pedro Ladaria <pedro.ladaria at Gmail dot com>
	*
	* Public Domain
	*
	* Changelog:
	*
	* 0.01 - First release
	* 0.02 - New faster base64 encoding

	easterEgg.BadWorder.list={
	"4r5e":1,
	"5h1t":1,
	"5hit":1,
	a55:1,
	anal:1,
	anus:1,
	ar5e:1,
	arrse:1,
	arse:1,