{"id":52750,"date":"2023-07-13T00:00:00","date_gmt":"2023-07-13T00:00:00","guid":{"rendered":"urn:uuid:e49db5b3-4876-be94-ee16-ae4ae701a2ad"},"modified":"2023-07-13T00:00:00","modified_gmt":"2023-07-13T00:00:00","slug":"ai-coding-companions-comparing-aws-github-google","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/ai-coding-companions-comparing-aws-github-google\/","title":{"rendered":"AI Coding Companions: Comparing AWS, GitHub, & Google"},"content":{"rendered":"

<\/p>\n

<\/div>\n

Generative AI<\/a> has gotten a lot of press this year as a revolutionary, paradigm-shifting technology that could alter the destiny of humankind. Civilization\u2019s fate is a little out-of-scope for us at the Trend Micro DevOps Resource Center<\/a>, but we can say with confidence that generative AI is already having a big impact on software development, especially with the rise of AI coding companions.<\/p>\n

Developers have relied on machine intelligence for years: automation, code completion, low-code development, static code analysis, and the like. But generative AI marks a distinct and major leap forward.<\/p>\n

Today\u2019s AI coding companions\u2014such as Amazon CodeWhisperer<\/a>, GitHub Copilot<\/a>, and Google Bard<\/a>\u2014can suggest or complete bits of code in nearly any language or framework. Trained on massive databases, they promise to help developers generate code faster, offload routine tasks, and generally lead happier lives. There are many commonalities in how they each do this\u2014and a few notable differences as well. Let\u2019s explore them\u2026<\/p>\n

AI code companions in profile<\/span><\/p>\n

Amazon CodeWhisperer<\/a> supports developers as they work by suggesting snippets of code, whole functions, and logical blocks of up to 15 lines in multiple languages. It does this inside the code editor environment, analyzing code and comments automatically and intelligently matching the developer\u2019s style and naming conventions when it makes suggestions.<\/p>\n

Not surprisingly, Amazon CodeWhisperer optimizes for AWS APIs including Amazon Elastic Compute Cloud (Amazon EC2), AWS Lambda, and Amazon Simple Storage Service (Amazon S3). Its suggestions include relevant cloud services and public software libraries to achieve specified functionalities, and the code snippets it recommends meet AWS best practices.<\/p>\n

The tool has a \u201creference tracker\u201d to identify any potential open-source code that may appear in its suggestions, giving relevant details such as a repository\u2019s URL, file reference, and license information. Developers can assess instances on a case-by-case basis or choose to filter out any possible open-source code completely.<\/p>\n

Languages: <\/b>Python, Java, JavaScript, TypeScript, C#, Go, Rust, PHP, Ruby, Kotlin, C, C++, Shell scripting, SQL, and Scala.<\/p>\n

Integrated Development Environments (IDEs): <\/b>JetBrains IDEs (IntelliJ IDEA, PyCharm, WebStorm, and Rider), Visual Studio Code, AWS Cloud9, AWS Lambda, JupyterLab, and Amazon SageMaker Studio.<\/p>\n

Like Amazon CodeWhisperer, GitHub Copilot<\/a> suggests code and whole functions inside the code editor environment. It covers a range of IDEs and languages, and offers an extension<\/a> specifically for Microsoft Visual Studio Code.<\/p>\n

Copilot uses the OpenAI Codex. It makes inline suggestions automatically as developers work on their code, often giving more than one suggestion at a time. Similar to Amazon CodeWhisperer, it respects developer style conventions. It also provides a filter to check suggested code against public open-source code on GitHub and avoid open-source suggestions.<\/p>\n

Copilot has both an inline chat that allows developers to communicate with the AI while working and a dedicated chat view for asking questions and help. The chat responses are context-aware\u2014specific to the code at hand, the developer\u2019s workspace, extensions, settings, and so on.<\/p>\n

Languages supported: <\/b>Several languages and frameworks; is especially well suited to Python, JavaScript, TypeScript, Ruby, Go, C# and C++<\/p>\n

IDEs supported: <\/b>Microsoft Visual Studio and Visual Studio Code, Neovim, and JetBrains IDEs.<\/p>\n

In April 2023, Google announced<\/a> its AI chatbot, Bard, was now outfitted to serve as an AI coding companion capable of generating, debugging, and explaining code. Developers who use Google Colaboratory (\u201cColab\u201d) will be happy to know that Bard exports Python code directly to Colab without cutting and pasting. Bard can also be used to write functions for Google Sheets.<\/p>\n

Google notes Bard\u2019s ability to respond to natural language prompts as a key feature. Developers can ask it to, \u201cFix this broken code,\u201d when something isn\u2019t working, or \u201cMake my code faster,\u201d to discover hidden efficiencies.<\/p>\n

Similar to Amazon CodeWhisperer and GitHub Copilot, Bard checks against open-source projects, providing citations any time it \u201cquotes at length\u201d from open-source code.<\/p>\n

Languages supported: <\/b>More than 20, including C++, Go, Java, Javascript, Python and Typescript.<\/p>\n

IDEs supported: <\/b>Can be incorporated into existing IDEs.<\/p>\n

When to use which AI coding companion?<\/span><\/p>\n

All three of the AI coding companions profiled here suit a broad range of activities, languages, and environments. Choosing among them may come down to a dev team\u2019s subjective preferences and where the software is ultimately going to be deployed. As mentioned, Amazon CodeWhisperer optimizes applications for AWS APIs. Microsoft owns GitHub and has a partnership with OpenAI<\/a>, so Copilot is a natural fit for applications destined to run in Azure . Likewise, as a Google product integrated with apps like Google Sheets and Google Colab, Bard makes sense for Google environments and the Google Cloud Platform.<\/p>\n

In all cases, one question comes up consistently across blogs, web searches, and message board threads: \u201cAre these tools safe and secure?\u201d<\/p>\n

Using AI securely for coding<\/span><\/p>\n

Security experts have long cautioned that AI could be used to generate highly effective\u2014and destructive\u2014malicious code. But AI security isn\u2019t just about defending against new vulnerabilities and attack types. Bad code is also a concern: code that doesn\u2019t work, has unintended consequences, or inadvertently exposes private information. A previous Trend Micro blog<\/a> cited a 2021 study that found GitHub Copilot produced security issues around 40% of the time. The bottom line: AI-generated code is famously fallible, and it doesn\u2019t automatically include security features and apply best practices.<\/p>\n

Coding companion providers are aware of the risks. \u201cResponsible AI\u201d is the new catchphrase\u2014meaning \u201cuse it wisely\u201d. Google explicitly reminds developers to verify and test any code developed with Bard\u2019s help.<\/p>\n

The crucial takeaway here is that software developers and the companies they work for have a proactive role to play in defending against AI coding risks. Best practices strongly recommended by Trend Micro and cybersecurity analyst firms like Gartner include:<\/a><\/p>\n