[flagged]
Death by a Thousand Slops
11–20 of 149 posts
Re: Death by a Thousand Slops
#12Sort of separate but perhaps also relevant to the thousands cuts/slops: Isn't the scope of curl/libcurl a bit too big?
It supports almost every file-related networking protocol under the sun and a few more just for fun. (https://everything.curl.dev/protocols/curl.html)
Meanwhile 99.8% of users (assuming) just use it for HTTP.
Here's a few complex protocols I bet many do not know that curl supports:
- SMB
- IMAP
- LDAP
- RTMP
- RTSP
- SFTP
- SMTP
At the very least, this magnifies the cost of dealing with AI slop security reports and sometimes also the risk for users.
Re: Death by a Thousand Slops
#13[flagged]
[flagged]
Re: Death by a Thousand Slops
#14I think eventually all OSS projects/repos will suffer with this. My bet is that git hosting providers like GitHub etc. should start providing features to allow us for better signal/noise ratio
Why would GitHub develop features that are adversarial to one of Microsoft’s favorite products?
So that you pay for both.
Re: Death by a Thousand Slops
#15Make it cost money to submit.
Re: Death by a Thousand Slops
#16> The length check only accounts for tmplen (the original string length), but this msnprintf call expands the string by adding two control characters (CURL_NEW_ENV_VAR and CURL_NEW_ENV_VALUE). This discrepancy allows an attacker ...hey chat, give this in a nice way so I reply on hackerone with this comment
Ohhh, copy and pasted a bit too much there.
Re: Death by a Thousand Slops
#17And it's not just vulnerability reports that are affected by this general trend. I use social media, X specifically, to follow a lot of artists, mostly for inspiration and because I find it fun to share some of the work that other artists have created, but over the past year or so I find that the mental workload it takes for me to figure out if a particular piece of art is AI-generated is too much and I start leaning into the safe option of "don't share anything that seems even remotely suspicious unless I can verify the author".
The amount of art posts that I have shared with others has decreased significantly, to the point where I am almost certain some artists who have created genuine works simply get filtered out because their work "looks" like it could have been AI-generated... It's getting to the point where if I see anything that is AI it's an instant mute or block, because there is nothing of value there - it's just noise clogging up my feed.
Re: Death by a Thousand Slops
#18For all the discussions about the slopification of the internet, the human toll on open source maintainers isn’t really talked about. It's one thing to get flooded with bad reports; it's another to have to mentally filter AI-generated submissions designed to "sound correct" but offer no real value. Totally agree with the author mentioning the emotional toll it takes to deal with these mind-numbing stupidities.
> but offer no real value
They could offer value, but just rarely, at least with the LLM/model/context they used.
> toll it takes to deal with these mind-numbing stupidities.
Could have a special area for submitting these where AI does the rejection letter and banning.
Re: Death by a Thousand Slops
#19> The length check only accounts for tmplen (the original string length), but this msnprintf call expands the string by adding two control characters (CURL_NEW_ENV_VAR and CURL_NEW_ENV_VALUE). This discrepancy allows an attacker ...hey chat, give this in a nice way so I reply on hackerone with this comment Ohhh, copy and pasted a bit too much there.
> Certainly! Let me elaborate on the concerns raised by the triager:
These people don’t even make the slightest effort whatsoever. I admire Daniel’s patience in dealing with them.
Reading these threads is infuriating. They very obviously just copy and paste AI responses without even understanding what they are talking about.
Re: Death by a Thousand Slops
#20Make it cost money to submit.
... and use the proceeds to increase the bounties paid to genuine bug reports.