Live data from Hacker News

No LLM Code in Dependencies

joeyh.name

31–40 of 120 posts

Re: No LLM Code in Dependencies

#32

I think this is a fair and normal reaction to AI slop. Alot of work though. I think OSS projects are at serious risk of implosion due to the vigilance required which honestly may end up being a fool's errand anyway. But maybe we are thinking about it backward. Have you ever wondered why there is so much "free software"? Beware of strangers bearing gifts. I have always wondered and been suspicious of people who are so…

> when people are pushing free software on you they are kind of in it for themselves

I strongly disagree with this. The free (as in both freedom and as in free beer) software movement was to provide an alternative to proprietary and closed-source software, which is developed by people and corporations who are openly in it for themselves.

> Like 10-100 bucks per PR to cover the cost of the extra vigilance. Also I could see migrations away from github, to AI free dependency hosting or something like that. Its an interesting challenge. But its not insurmountable.

You could just leave your project where it's at, keep it open source, and simply not accept outside contributions. Lots of open source software operates this way. The Ladybird browser notably switched to this model recently as a reaction to AI pull requests.

Re: No LLM Code in Dependencies

#33

This is completely infeasible in the age of mythos. The reality is that the velocity is just not going to feasible from a security PoV without leveraging these tools.

Analysing codebases with LLMs to find security vulnerabilities is completely unrelated to committing code generated with LLMs

Re: No LLM Code in Dependencies

#34
post #16

It's nicely symmetrical, because conversely I prefer my LLM-generated code to have no dependencies.

You mean aside from previous work it was trained on?

Dependencies: stolen from all code ever written without permission, including extremely illegal content

But other than that, totally dependency free!

Re: No LLM Code in Dependencies

#35
post #16

It's nicely symmetrical, because conversely I prefer my LLM-generated code to have no dependencies.

> It's nicely symmetrical, because conversely I prefer my LLM-generated code to have no dependencies. How do you get your code to the point where it has no dependencies? How do you do any sort of database writing without a library, or web access without sockets from an os library? What sort of code has no dependencies? I'm now very curious as I can't see how you can do anything without altest including the std lib fr…

[deleted]

Re: No LLM Code in Dependencies

#36
post #33

This is completely infeasible in the age of mythos. The reality is that the velocity is just not going to feasible from a security PoV without leveraging these tools.

Analysing codebases with LLMs to find security vulnerabilities is completely unrelated to committing code generated with LLMs

It's a fair comparison. There's a fair amount of plausible-sounding bullshit being peddled as a transparent advertisement for an ai-driven "code security" firm.

Re: No LLM Code in Dependencies

#37
post #29

Earlier quoted context omitted.

> It's nicely symmetrical, because conversely I prefer my LLM-generated code to have no dependencies. How do you get your code to the point where it has no dependencies? How do you do any sort of database writing without a library, or web access without sockets from an os library? What sort of code has no dependencies? I'm now very curious as I can't see how you can do anything without altest including the std lib fr…

Write assembly to do the syscall instruction with whatever params you need.

Relevant, reader mode recommended: https://www.ee.torontomu.ca/~elf/hack/recovery.html
Post reply on HN