AI for the People
summary
Built an incremental Infer-based analyzer that runs on code changes against 100,000 commits per week, comments on pull requests and shifts fix rate from effectively 0% to 70% by staying in developers’ workflow; contrasted that with a Zolan-style over-approximate taint analyzer covering >500M LOC that found ~40% of serious security issues across Facebook in batch mode. Also describes Lacework products combining static and runtime signals, agentless workload snapshots, attack-path graphs and practical tradeoffs between build-full and build-less analyses.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 3:14Abstract interpretation fundamentals
- 7:04Deploying Infer at Facebook
- 13:48Fix rate vs false positives
- 20:27Taint analysis at Facebook
- 25:31Scaling static analysis at Lacework
- 32:17Agentless workload scanning
- 36:30Scaling dynamic analysis challenges
- 40:22Q&A
related talks
28mAI for Everything After Code
31mAI for Web3 Security
14mAI for Web3 Security: Real-World Use Cases — Dr. Stefan Beyer
42mAI for security - friend or foe?
15mAI's Impact on Development, Post-Production & Support Journeys
46mAI for Kernel Engineers
44mTL;DR: Applying AI to Security
21mAI-driven optimization of CI/CD pipelines