Commenter reports AI-assisted discovery of critical vulnerabilities, predates article
3 Nov 1 8:00 PM · 11d ago · 1 post · 12 comments · 2 sources · development 3 of 4
A Hacker News commenter disclosed finding dozens of security-class bugs in PostgreSQL using LLMs over the summer—serialization anomalies, foreign key integrity issues, CVE-worthy vulnerabilities—and noted the discovery rate was so high they had to triage reports rather than submit them all.
“I did a little AI-assisted bug-hunting in Postgres this summer… Multiple serialization anomalies, foreign key integrity issues, planner correctness bugs. Various CVE-worthy vulnerabilities.”
tibbarRobert Haas PostgreSQL major contributor, Databricks Sr. Staff Engineer
The whole story postscomments the bright band is this development · numbered dots are the others · click one to jump
What people said 12 voices · verbatim
-
I'm not very positive on the social, technical, or intellectual impact of AI on software development. Actually, that's understating it. I think AI is basically cancer for the mind. That said, this framing gave me pause:> The long-term picture is less clear and in some ways more troubling: given that we have forty years of bugs that humans were…
-
I have found major bugs in late beta's of postgres long before AI came along. I found a bug where malformed json would segfault the entire server (a segfault in a server process forces the entire cluster to shut down by design) when using jsonb in a release candidate once. They fixed it rather than ripping the entire feature…
-
> This year is going to be different. PostgreSQL 19 most likely won’t be released until November… […] So, what happened? The short answer is that LLMs happened. […] There’s a huge amount of code, and that code contains a huge number of bugs. […] What’s different now is that it’s become vastly easier to find those bugs.This seems…good?That it might…
-
I did a little AI-assisted bug-hunting in Postgres this summer in between jobs, and the haul was staggering. Multiple serialization anomalies, foreign key integrity issues, planner correctness bugs. Various CVE-worthy vulnerabilities. An unfixable timezone bug. The list got so long that I had to triage what I even had time to report, and settled…
-
I feel like AI is amazing for read only “search” tasks (query this, look for bugs, find vulnerabilities) but it’s not quite as good for “write” tasks like “add this feature”. Search tasks are easily verified, code changes are much harder to verify
-
Yes, exactly. The only question I have is whether the delay is attributable to high-quality bug reports or the burden of triaging low-quality ones. It's not completely clear which situation they're experiencing.
-
Exactly. There's so much negativity, it sometimes borders Luddism."We found a bunch of ways to make our product safer and better. We need more time to ship a higher quality product."PICKET SIGNS
-
i assume the magnitude of impact for a bunch of [now] glaring holes in popular software is unknowable.question is, how long do you think this persists before there's only a long tail of minor exploits left?
-
> unfixable timezone bugVery curious about the details and why it’s unfixable. Is it just because timezones are such a mess it’s logically impossible to satisfy every constraint?
-
"it's AI's fault"I missed when AI became accountable for Postgres releases, when did that happen?
-
“A wizard is never late, nor is he early; he arrives precisely when he means to” -- Gandalf
-
I’m still amazed that with all the vibe coding, no one has created a Postgres alternative
All 4 developments of PostgreSQL 19 delayed to November as LLM-found bugs… →
Hacker NewsNewswiresMastodonLobsters