Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Death by a Thousand Slops

daniel.haxx.se

Post reply on HN
Print view View original

81–90 of 149 posts

Re: Death by a Thousand Slops

#81

Post by rambambram »

leovingi wrote: post #33
DaSHacka wrote: post #25

Earlier quoted context omitted.

Genuine question; if you cant tell, why does it matter?

It's a fair question and one that I've asked myself as well. I like to use the example of chess. I know that computers can beat human players and that there are technical advancements in the field that are useful in their own right, but I would never consistently watch a game of chess played between a computer and a human. Why? Because I don't care for it. To me, the fun and excitement is in seeing what a HUMAN can a…

> As I'm currently learning how to draw myself, I know how difficult it is and seeing other people working hard at their craft to eventually produce something beautiful, after months and years of work - it's a shared experience. It makes me happy!

Today I learned: LLMs and their presence in society eventually force one to producing/crafting/making/creating for fun instead of consuming for fun.

All jokes aside, you got the solution here. ;)

Re: Death by a Thousand Slops

#82

Post by rwmj »

konsalexee wrote: post #2

I think eventually all OSS projects/repos will suffer with this. My bet is that git hosting providers like GitHub etc. should start providing features to allow us for better signal/noise ratio

qemu & libvirt are already seeing a bunch of these. Here's a recent spammer sending AI slop reports:

https://gitlab.com/ququruza

Re: Death by a Thousand Slops

#83

Post by Aurornis »

raywatcher wrote: post #5

For all the discussions about the slopification of the internet, the human toll on open source maintainers isn’t really talked about. It's one thing to get flooded with bad reports; it's another to have to mentally filter AI-generated submissions designed to "sound correct" but offer no real value. Totally agree with the author mentioning the emotional toll it takes to deal with these mind-numbing stupidities.

The most notable thing about this article, in my opinion, is the increase in human generated slop.

Everyone is talking about AI in the comments, but the article estimates only 20% of their submissions are AI slop.

The rest are from people who want a curl contribution or bug report for their resume. With all of the talk about open source contributions as a way to boost your career or get a job, getting open source contributions has become a checklist item for many juniors looking for an edge. They don’t have the experience to know what contributions are valuable or correct, they just want something to put on their resume.

Re: Death by a Thousand Slops

#84

Post by IsTom »

You could require that submissions include an expletive or anything else that LLMs are sanitized to not produce. With how lazy these people are that ought to filter out at least some of them.

Re: Death by a Thousand Slops

#85

Post by deepdarkforest »

xg15 wrote: post #32
friedel wrote: post #18

Earlier quoted context omitted.

> but offer no real value They could offer value, but just rarely, at least with the LLM/model/context they used. > toll it takes to deal with these mind-numbing stupidities. Could have a special area for submitting these where AI does the rejection letter and banning.

I think looking at one example is useful: https://hackerone.com/reports/2823554 What they did was: 1) Prompt LLM for a generic description of potential buffer overflows in strcopy() and a generic demonstration code for a buffer overflow. (With no connection to curl or even OpenSSL at all) 2) Present some stack traces and grep results that show usage of strcopy() in curl and OpenSSL. 3) Simply claim that the strcopy()…

> The problem is in strcpy in the src files of curl.. have you seen the exploit code ??????

The worst part is that once they are asked for clarifications by the poor maintainers, they go on offense and become aggressive. Like imagine the nerve of some people, to use LLMs to try to gaslight an actual expert that they made a mistake, and then act annoyed/angry when the expert asks normal questions

Re: Death by a Thousand Slops

#86

Post by Aachen »

anthonyryan1 wrote: post #59

As the only developer maintaining a big bounty program. I believe they are all trending downward. I've recently cut bounties to zero for all but the most severe issues, hoping to refocus the program on rewarding interesting findings instead of the low value reports. So far it's done nothing to improve the situation, because nobody appears to read the rewards information before emailing. I think reading scope/rewards…

Similarly from a hacker's point of view, I also think vulnerability reporting is in a downwards spiral. Particularly the ones organised through a platform like this just aren't reaching the right people. It used to be pgp email to whoever needs to know of it and that worked great. I have no idea if it still would today for you guys, but from my point of view it's the only reliable way to reach a human who cares about the product and not someone whose job it is to refuse bounties. I don't want bounties, I've got a day job as security consultant for that, I'm just reporting what I stumble across. Chocolate and handwritten notes are nice, but primarily I want developers and sysadmins to fix their damn software

Re: Death by a Thousand Slops

#87

Post by latexr »

armchairhacker wrote: post #60

You could charge a fee and give the money back if the report is wrong but seems well-intentioned. I see the issue with this, it's payment platforms. Despite the hate, cryptocurrency seems like it could be a solution. But in practice, people won't take time to set up a crypto wallet just to submit a bug report, and if crypto becomes popular, it may get regulations and middlemen like fiat (which add friction, e.g. char…

> You could charge a fee and give the money back if the report is wrong but seems well-intentioned.

That idea was considered and rejected in the article:

> People mention charging a fee for the right to submit a security vulnerability (that could be paid back if a proper report). That would probably slow them down significantly sure, but it seems like a rather hostile way for an Open Source project that aims to be as open and available as possible. Not to mention that we don’t have any current infrastructure setup for this – and neither does HackerOne. And managing money is painful.

Re: Death by a Thousand Slops

#88

Post by nkrisc »

notachatbot123 wrote: post #61
nkrisc wrote: post #4

Earlier quoted context omitted.

Why would GitHub develop features that are adversarial to one of Microsoft’s favorite products?

Learning from Cloudflare: Host malware and DDOSsers AND provide protection against them = $$$

I feel my question is naive in retrospect.

Re: Death by a Thousand Slops

#89

Post by bit1993 »

AI slop is rapidly destroying the WWW, most of the content is becoming more and more low-quality and difficult to tell if its true or hallucinated. Pre-AI web content is now more like the golden-standard in terms of correctness, browsing the Internet Archive is much better.

This will only cause content to go behind pay-walls, allot of open-source projects will be closed source not only because of the increased work maintainers have to do to not only review but also audit patches for potential AI hallucinations but also because their work is being used to train LLMs and re-licensed to proprietary.

Re: Death by a Thousand Slops

#90

Post by Aurornis »

bit1993 wrote: post #89

AI slop is rapidly destroying the WWW, most of the content is becoming more and more low-quality and difficult to tell if its true or hallucinated. Pre-AI web content is now more like the golden-standard in terms of correctness, browsing the Internet Archive is much better. This will only cause content to go behind pay-walls, allot of open-source projects will be closed source not only because of the increased work m…

There’s more to this story than AI slop:

> The general trend so far in 2025 has been way more AI slop than ever before (about 20% of all submissions)

Of course that 20% of AI slop submissions are not good, but there’s an overarching problem with juniors clamoring for open source contributions without having the skills or abilities to contribute something useful.

They heard that open source contributions gets jobs, so they spam contributions to famous projects.

Post reply on HN