PentestGPT VS developer

👨‍💻 Source: https://github.com/GreyDGL/PentestGPT

A GPT-empowered penetration testing tool (https://github.com/GreyDGL/PentestGPT)

How you use it is up to you. There are hundreds of question answer clones with different data source adapters. Some projects that I found more interesting: https://github.com/GreyDGL/PentestGPT https://github.com/jina-ai/dev-gpt https://github.com/corca-ai/EVAL You can probably build something similar to smol developer with langchain too.

Look up langchain. Some example projects. https://github.com/corca-ai/EVAL https://github.com/jina-ai/dev-gpt https://github.com/GreyDGL/PentestGPT https://blog.langchain.dev/origin-web-browser/

> much of the work is repetitive, but it comes with its edge cases that we need to look out for

Then don't use AI for it.

Bluntly.

This is a poor use-case; it doesn't matter what model you use, you'll get a disappointing result.

These are the domains where using AI coding currently shines:

1) You're approaching a new well established domain (eg. building an android app in kotlin), and you already know how to build things / apps, but not specifically that exact domain.

Example: How do I do X but for an android app in kotlin?

2) You're building out a generic scaffold for a project and need some tedious (but generic) work done.

Example: https://github.com/smol-ai/developer

3) You have a standard, but specific question regarding your code, and although related Q/A answers exist, nothing seems to specifically target the issue you're having.

Example: My nginx configuration is giving me [SPECIFIC ERROR] for [CONFIG FILE]. What's wrong and how can I fix it?

The domains where it does not work are:

1) You have some generic code with domain/company/whatever specific edge cases.

The edge cases, broadly speaking, no matter how well documented, will not be handled well by the model.

Edge cases are exactly that; edge cases; the common medium of 'how to x' does not cover edge cases; the edge cases will not be covered and the results will require you to review and complete them manually.

2) You have some specific piece of code you want to refactor 'to solve xxx', but the code is not covered well by tests.

LLMs struggle to refactor existing code, and the difficulty is proportional to the code length. There are technical reasons for this (mainly randomizing token weights), but tldr; it's basically a crap shot.

Might work. Might not. If you have no tests who knows? You have to manually verify both the new functionality and the old functionality, but maybe it helps a bit, at scale, for trivial problems.

3) You're doing some obscure BS or using a new library / new version of the library.

The LLM will have no context for this, and will generate rubbish / old deprecated content.

...

So. Concrete advice:

1) sigh~

> a friend of mine came and suggested that I use Retrieval-Augmented Generation (RAG), I have yet to try it, with a setup Langchain + Ollama.

Ignore this advice. RAG and langchain are not the solutions you are looking for.

2) Use a normal coding assistant like copilot.

This is the most effective way to use AI right now.

There are some frameworks that let you use open source models if you don't want to use openAI.

3) Do not attempt to bulk generate code.

AI coding isn't at that level. Right now, the tooling is primitive, and large scale coherent code generation is... not impossible, but it is difficult (see below).

You will be more effective using an existing proven path that uses 'copilot' style helpers.

However...

...if you do want to pursue code generation, here's a broad blueprint to follow:

- decompose your task into steps

- decompose you steps in functions

- generate or write tests and function definitions

- generate an api specification (eg. .d.ts file) for your function definitions

- for each function definition, generate the code for the function passing the api specification in as the context. eg. "Given functions x, y, z with the specs... ; generate an implementation of q that does ...".

- repeated generate multiple outputs for the above until you get one that passes the tests you wrote.

This approach broadly scales to reasonably complex problems, so long as you partition your problem into module sized chunks.

I personally like to put something like "you're building a library/package to do xxx" or "as a one file header" as a top level in the prompt, as it seems to link into the 'this should be isolated and a package' style of output.

check out smol-developer (https://github.com/smol-ai/developer)

4. https://github.com/smol-ai/developer

How can ChatGPT be effectively utilized for reading library source code, resolving coding issues, and serving as a dedicated coding assistant tailored for a specific programming language?

The smol developer AI tool was built by a developer called Swyx using ChatGPT. This library is designed to act like a personal, junior developer, performing a huge array of simple, routine tasks as well as some sophisticated tasks. By using a spec that you provide in a prompt, you can even use smol developer to pair program with an AI tool!

And this is where most of these tools fall short, with tools like Smol-Developer creating decent client and server code that work great on their own, but unfortunately don’t work together!

1) Show HN: Bloop – Answer questions about your code with an LLM agent (github.com/bloopai)

https://news.ycombinator.com/item?id=36260961

2) https://github.com/paul-gauthier/aider

3) Show HN: GPT Repo Loader – load entire code repos into GPT prompts (github.com/mpoon)

https://news.ycombinator.com/item?id=35191303

4) https://github.com/smol-ai/developer

5) codium

6) copilot

7) using gpt in the playground / chatgpt

8) jam.dev/jamgpt

9) magic.dev

10) https://github.com/kristoferlund/duet-gpt

Which ones am I missing?

I had this same idea and started working on something for this purpose called j-dev [0]. It started as a fork off smol-dev [1] which basically gets GPT to write your entire project from scratch. And then you would have to iterate the prompt to nuke everything and re-write everything, filling in increasingly complicated statements like "oh except in this function make sure you return a promise"

j-dev is basically a CLI where it gives a prompt similar to the one in the parent article. You start with a prompt and the CLI fills in the directory contents (excluding gitignore). Then it requests access to the files it thinks it wants. And then it can edit, delete or add files or ask for followup based on your response.

It also addresses the problem that a lot of these tools eat up way too many tokens so a single prompt to something like smol-dev would eat up a few dollars on every iterations.

It's still very much a work in progress and i'll prob do a show hn next week but I would love some feedback

[0] https://github.com/breeko/j-dev

[1] https://github.com/smol-ai/developer

Smol AI’s “Smol-Developer” gained a lot of notoriety very quickly by being one of the first such tools on the scene. It is a simple set of python scripts that allow a user to build prototype apps using natural language in an iterative approach.