Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Did Claude increase bugs in rsync?

alexispurslane.github.io

Post reply on HN
Print view View original

361–370 of 611 posts

Re: Did Claude increase bugs in rsync?

#361

Post by dang »

ex-aws-dude wrote: post #288
dang wrote: post #150

Earlier quoted context omitted.

I don't have enough background info to understand what you're referring to here. Even if you're right, though, you shouldn't be posting comments that break the site guidelines.

https://news.ycombinator.com/item?id=48342705 People opening issues just to rant against an open source project is acceptable content for HN? How is that even allowed in the first place without getting flagged/removed? And every time that happens the project gets brigaded from HN users

People have been ranting for, against, and about open source projects since open source began.

Please follow the site guidelines from now on.

Re: Did Claude increase bugs in rsync?

#363

Post by red75prime »

eschaton wrote: post #207
matheusmoreira wrote: post #105

Earlier quoted context omitted.

It makes no sense at all to do that. The only thing that matters is whether the code is good.

That’s not the only thing that matters. The provenance of the code also matters enormously, specifically whether the person contributing it actually has the right to do so. If I contributed code to an Open Source project behind my old employer’s back, that would have been bad, because that code was owned by them and not me, even if I wrote it on my own time using my own equipment, because of the contract I signed wit…

> This is not a hypothetical scenario; I’ve personally encountered a case of someone using an LLM attempt to contribute code I recognized from a specific Open Source project under one license to another project under a different license

You say you "recognized code". Does it mean that you weren't able to find the exact match?

> an LLM is actually just regurgitating portions of its inputs

You seem to be talking about the inputs to the autoregressive pretraining stage. Correct? Then it's not how LLMs work, unless we use a definition of portions as a "few letters blocks."

Re: Did Claude increase bugs in rsync?

#364

Post by eschaton »

dml2135 wrote: post #287
eschaton wrote: post #240

Earlier quoted context omitted.

Yes, in fact, this is why people who do that are looked down upon. They are in fact committing fraud if they do not attribute the code in their commit properly, because by committing it they’re claiming to have rights by virtue of authorship that they do not have. (Namely, the right to contribute that code to the project,.) They may also be committing copyright infringement, depending on the copyright and license sta…

Are there any court cases you can point to that have clearly established that using LLM generated code can be a copyright violation? My understanding is that this is very far from being settled law.

What cases can you cite that have determined it’s not?

It’s clear on its face that LLMs can and do store and reproduce copyrighted works; using a form of (somewhat) lossy data compression. And using a lossy stochastic or perceptual form of compression to reproduce a copyrighted work doesn’t somehow make it not storage or reproduction, otherwise sharing MP3 files wouldn’t be copyright infringement.

Anyone engaging in responsible risk management should assume that anything LLM-generated is infringing until determined otherwise by the courts, not the other way around.

Re: Did Claude increase bugs in rsync?

#365

Post by eschaton »

red75prime wrote: post #363
eschaton wrote: post #207

Earlier quoted context omitted.

That’s not the only thing that matters. The provenance of the code also matters enormously, specifically whether the person contributing it actually has the right to do so. If I contributed code to an Open Source project behind my old employer’s back, that would have been bad, because that code was owned by them and not me, even if I wrote it on my own time using my own equipment, because of the contract I signed wit…

> This is not a hypothetical scenario; I’ve personally encountered a case of someone using an LLM attempt to contribute code I recognized from a specific Open Source project under one license to another project under a different license You say you "recognized code". Does it mean that you weren't able to find the exact match? > an LLM is actually just regurgitating portions of its inputs You seem to be talking about…

I found exact matches. I also found inexact matches, where C functions had been turned into C++ member functions and the like. “Recognized” does not somehow imply a lack of precision.

The LLM the person used was trained on a very large corpus of Open Source code, and reproduced that code exactly. Just like LLMs have reproduced chapters of books and articles from the New York Times exactly.

Re: Did Claude increase bugs in rsync?

#367

Post by Barrin92 »

matheusmoreira wrote: post #250
toofy wrote: post #239

Earlier quoted context omitted.

for the same reason we want to know who wrote an article, a book, a movie, a song, a play, a journal paper, a painting, and on and on. why do you so many people want to hide who the real author is? we should be very weary of anyone claiming they’re the author of something when they’re absolutely not. if jon wrote a book and i take credit, that’s shady as hell.

Ghostwriting is a thing.

yes because there's people who can't write but want to pretend that they can, just like the people who don't disclose they're using these tools. If you're the Gwyneth Paltrow of programming you're not making a great case for yourself, and I'd like to know before touching any of the software.

Re: Did Claude increase bugs in rsync?

#368

Post by kajaktum »

yubblegum wrote: post #279
echelon wrote: post #276

Earlier quoted context omitted.

Seems like someone could use Claude to port rsync to Rust and the whole enterprise would be safer from things like this. Start with unsafe then gradually convert into idiomatic Rust.

Your let's redo this in Rust made me wonder if generative AI will also be susceptible to software fads. One LLM writes a few blog posts extoling a new framework/lanaguge. Other agentics read these and get 'influenced'. Then they start clamoring for 'lets redo this in X!'. Can't wait to see it. /g

You can get 80% there with rust which is what is impressive. Then you have a reference implementation that you can always check against. If a Rust library have 0 unsafe, i dont care if it is written by a dog, it still have 0 UB.

Re: Did Claude increase bugs in rsync?

#369

Post by [deleted] »

int_19h wrote: post #318
iandinwoodie wrote: post #302

Earlier quoted context omitted.

Also from the article: > "Claude clearly made things worse" &emdash; the main claim This article was clearly generated by AI, yet I found no mention/attribution of that by author. How likely is it than someone who vibe codes articles would also vibe code the underlying analysis and be eager to accept an outcome that is highly validating of that person’s workflow? I’d say very.

Are the numbers wrong? That's the only relevant thing here. Also, humans do use em dashes, just FYI.

[deleted]

Re: Did Claude increase bugs in rsync?

#370

Post by Eufrat »

rsc wrote: post #354
Eufrat wrote: post #327

Earlier quoted context omitted.

I think Tridge is simultaneously trying to be proactive and kinda giving too much credit to marketing. Anthropic has not been able to really give numbers or actual values on what Mythos can really do. It just waved Mythos in front of the public like a boogeyman screaming that AI is going to cause a security nightmare (and it has, but mostly through vibe coded trash from what I’ve noticed); I’m hard pressed to find th…

As a long-time open-source maintainer, I find all the second-guessing and armchair psychoanalysis here (not just in this comment, all over HN) about Tridge's motivations, state of mind, and so on incredibly off-putting. Tridge doesn't owe anyone anything as far as rsync is concerned. Yet he is spending his time maintaining it, only to be attacked for his efforts. To respond to the specific technical point, there real…

> As a long-time open-source maintainer, I find all the second-guessing and armchair psychoanalysis here (not just in this comment, all over HN) about Tridge's motivations, state of mind, and so on incredibly off-putting.

I agree that the entire episode is obscene, but I am also unsure of what to do here either. On some level this is the same problem movie stars run into. I agree that guessing or waxing about the motivations of anyone is a nosy and overall unproductive exercise (yet paparazzi exist because of this very human behavior), but I also think that there is a modest duty owed to users to explain things.

> Tridge doesn't owe anyone anything as far as rsync is concerned. Yet he is spending his time maintaining it, only to be attacked for his efforts.

I am reminded of this piece: https://mikemcquaid.com/open-source-maintainers-owe-you-noth...

Which, I empathize with, but I fundamentally disagree that maintainers owe users nothing. I will die on that hill. If you are getting to that point where you actively loathe working on the project, I agree you should be able to walk away. However, I strongly believe that when you create something for people to use that there’s an implicit social contract about how to go about doing certain things.

I suppose in a very extreme and intentionally histrionic example, having a project carry the MIT license, getting frustrated and then changing the project to delete the entire system is a crime. The average person and the courts don’t care if the license is “as-is”. There is a duty that is understood that you don’t do that and I think we need to make it clear what that duty is for OSS.

Ultimately, though, I think this is all symptomatic of the fact that the OSS model has gaps that the increase in security reports whether AI generated or not has exerted more pressure on. I have certainly been on the receiving end of a lot of frivolous security reports that were discarded because it was obvious that it was just someone with a security scanner wandering around the Internet. You still have to review that nonsense and it eats into your time. Doing this on your own time, without pay and having to listen to the peanut gallery is just infuriating.

Is any business built on top of rsync going to donate their money in a sustainable manner?

Post reply on HN