OBJ is a file format for describing 3D shapes of things, e. g. for 3D printing. A .obj file contains data lines that define coordinates of points, corners and colors of polygons, curved surfaces, etc.
Today I learned that version 3.0 of the OBJ format may include lines like this:
csh <command>
Executes the requested UNIX <command>.
Sigh. Have we learned nothing since the Morris Internet Worm?
I have heard of IT security managers horrified by the code that programmers now write with the "help" of LLMs.
But the difference is just where the code is being run.
Automatically running untrusted code without a proper sandbox is a bad idea.
In one scenario the code is run without the possibility of any review. In principle a sandbox can address the risks in that (I hope you didn't let an AI implement your sandbox).
In the other scenario the code can in principle be reviewed by a human before being run. But I don't think either of trust that such a review will happen.
More likely many developers will run the code produced by the AI without reading it first, and they will do so in an environment which isn't properly sandboxed.
And if they don't notice anything wrong they may submit it for review where the first person to read the code will be somebody else, who may or may not know that it was written by AI.
Forbidding the use of such code generators may be a bit extreme. But maybe that's what we need to balance out the current hype.
I fully agree that using automated tools for tasks you don't know how to do manually is bad because you don't know what you are doing.
The area where I see the most potential for AI generated code is for unit tests. But before doing that we need better tools for evaluating some sanity aspects of unit tests.
Code coverage is one measurable metric, but I would take it a step further and not just require each line to be covered by tests. Instead I want each conditional in the code to be tested with both a true and a false value.
Moreover I want it to be such that if you actually negate a condition in the code itself, there must be a unit test failing. And if a particular test case passed regardless of what modification was being made to the code being tested, then that test case was not particular useful in the first place.
If generated test cases satisfy all of that, then there is a chance that reviewing those test cases could be less work than writing the from scratch yourself. All of this is of course hypothetical, as I have not yet seen an AI as capable as what I describe (and I haven't been looking for one either).
But never send them to somebody else for review without reviewing them first for yourself.
Jorge Stolfi
Michael Westergaard
kasperd