Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

No LLM Code in Dependencies

joeyh.name

Post reply on HN
Print view View original

11–20 of 120 posts

Re: No LLM Code in Dependencies

#11

Post by perrygeo »

api wrote: post #4
neutrinobro wrote: post #3

Was this done by manually reviewing commit messages? I think it would be interesting/useful to have a tool that could use some basic heuristics about LLM generated code to detect code-blobs even if they are not explicitly called out in a commit message.

Just like with writing, any kind of AI detection is going to be inaccurate to the point of snake oil. LLM detection in writing is basically today's polygraph test pseudoscience. There was a blog a while ago where someone fed classic literature into one and it was detected as probably AI.

It's not just "the code itself looks LLM generated" - it's also LOC/hr by a particular author which suggests vibe coding. You could look at the author's github contributions to identify time periods when the author was generating code at super-human speeds. Combine the two signals and you might get something better than a pseudoscience?

Re: No LLM Code in Dependencies

#13

Post by tuvix »

kstenerud wrote: post #12

[flagged]

They will absolutely be missed, maybe not by any individual but the impact of them leaving will be felt. People willing to go to bat for code quality and who are also careful about copyright and the community aspect of open source is why this whole thing worked in the first place.

Re: No LLM Code in Dependencies

#14

Post by zahlman »

StableAlkyne wrote: post #10

Clicking through to https://git-annex.branchable.com/no_llm_code/ It looks like git after 2.22 was dropped because it took an LLM commit. Same with ghc. If I have to choose between this or git and the latest ghc, I think I'm going to just wait for someone to fork annex. I don't even feel strongly one way or the other on AI stuff; pragmatically, I'm just not going to stop using the most widely used version controller,…

TFA is about the dependencies of this project. How does that prevent you from using those things yourself?

Re: No LLM Code in Dependencies

#15

Post by kstenerud »

tuvix wrote: post #13
kstenerud wrote: post #12

[flagged]

They will absolutely be missed, maybe not by any individual but the impact of them leaving will be felt. People willing to go to bat for code quality and who are also careful about copyright and the community aspect of open source is why this whole thing worked in the first place.

Copyright won't be a problem. There's enough big business wrapped up in AI usage that the laws will bend towards them. Code quality and community don't die just because people haven't quite figured out how to use the new tools properly yet; quality merely dips for awhile, and the community continues as before. We survived PHP. We can survive this.

Re: No LLM Code in Dependencies

#17

Post by zahlman »

api wrote: post #4
neutrinobro wrote: post #3

Was this done by manually reviewing commit messages? I think it would be interesting/useful to have a tool that could use some basic heuristics about LLM generated code to detect code-blobs even if they are not explicitly called out in a commit message.

Just like with writing, any kind of AI detection is going to be inaccurate to the point of snake oil. LLM detection in writing is basically today's polygraph test pseudoscience. There was a blog a while ago where someone fed classic literature into one and it was detected as probably AI.

The heuristics that would be used to "detect AI" here would be things that shouldn't be happening anyway, so false positives wouldn't matter.

Re: No LLM Code in Dependencies

#18

Post by remywang »

StableAlkyne wrote: post #10

Clicking through to https://git-annex.branchable.com/no_llm_code/ It looks like git after 2.22 was dropped because it took an LLM commit. Same with ghc. If I have to choose between this or git and the latest ghc, I think I'm going to just wait for someone to fork annex. I don't even feel strongly one way or the other on AI stuff; pragmatically, I'm just not going to stop using the most widely used version controller,…

> This will probably prevent git-annex from taking advantage of most new improvements to the Haskell language going forward. That is deeply unfortunate. This is the main reason why git-annex is not guaranteed to never change to depend on LLM generated code, because cutting it off from all future Haskell language improvements may be worse than the alternative.

Looks like they are aware, and git-annex has been around for decades written by one of the best Haskellers. “Some guys hobby project” is not fair

Re: No LLM Code in Dependencies

#19

Post by pseudalopex »

StableAlkyne wrote: post #10

Clicking through to https://git-annex.branchable.com/no_llm_code/ It looks like git after 2.22 was dropped because it took an LLM commit. Same with ghc. If I have to choose between this or git and the latest ghc, I think I'm going to just wait for someone to fork annex. I don't even feel strongly one way or the other on AI stuff; pragmatically, I'm just not going to stop using the most widely used version controller,…

They said the non LLM dependency build was not default and could become untenable.

They said git-annex supports git back to 2.22. Not git after 2.22 was dropped.

An incompatible change in ghc would break compilation of other software also.

Re: No LLM Code in Dependencies

#20

Post by pull_my_finger »

kstenerud wrote: post #12

[flagged]

Ethically, selling code or programs built on other peoples code without consent is wrong.

Legally, it's probably also unlawful, unless you believe that smoke they're selling that it was trained on code that was open licensed or in the public domain.

Professionally, it's a poor choice to ship code that wasn't produced with human care and consideration or even thorough oversight or understanding based on recent trends.

Software developers like to call themselves "engineers", but more and more they're showing they're more than happy to be configurators of black boxes of modular software. Whether that means pulling random NPM packages with thousands of other random packages as dependencies (none of which are even browsed or licenses checked), or "vibe coding" slop the LLM spits out.

When the main problem was people assembling random packages, I always likened it to "sandwich artists" at Subway. They just stand behind the counter and configure the product of random combinations of ingredients (someone else's NPM packages). Now it's like they can't even see the selection of ingredients, they just grab handfuls and shove it together until they get something sandwich shaped. Bad times in software.

Post reply on HN