Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Slopsquatting

en.wikipedia.org

Post reply on HN
Print view View original

11–20 of 51 posts

Re: Slopsquatting

#11

Post by prmoustache »

snapcaster wrote: post #4
Invictus0 wrote: post #3

We need to have a professional software engineering license, at least for applications that are handling sensitive data. Why is it that it takes 1000 hours of study to cut people's hair, but anyone off the street can write some software that collects people's driver's licenses? (Looking at you, Tea app developers)

I think something like professional licenses are easy to see benefits of but really hard to see the downsides. How many wonderful things _wont_ be created when you start gatekeeping something? Maybe it is worth it but it's not some free win

Mandating a professional license for hairdressers to work professionally does not prevent you from cutting your partner/friends/family hair as long as you don't ask any money in return.

Re: Slopsquatting

#13

Post by voidUpdate »

kouteiheika wrote: post #6

> LLMs hallucinated a package named "huggingface-cli" [...] it is not the name of the package [...] software is correctly installed with [...] huggingface_hub It would be a good idea to disallow registering packages which only differ by '-'/'_'. Rust's crates.io does this, so if you register `foo-bar` you cannot register `foo_bar` anymore.

That wouldnt help in this case though, one is -cli, the other is _hub

Re: Slopsquatting

#14

Post by Pxtl »

kouteiheika wrote: post #6

> LLMs hallucinated a package named "huggingface-cli" [...] it is not the name of the package [...] software is correctly installed with [...] huggingface_hub It would be a good idea to disallow registering packages which only differ by '-'/'_'. Rust's crates.io does this, so if you register `foo-bar` you cannot register `foo_bar` anymore.

Case insensitivity is so important.

Underscore is just capital hyphen.

Re: Slopsquatting

#15

Post by Invictus0 »

snapcaster wrote: post #4
Invictus0 wrote: post #3

We need to have a professional software engineering license, at least for applications that are handling sensitive data. Why is it that it takes 1000 hours of study to cut people's hair, but anyone off the street can write some software that collects people's driver's licenses? (Looking at you, Tea app developers)

I think something like professional licenses are easy to see benefits of but really hard to see the downsides. How many wonderful things _wont_ be created when you start gatekeeping something? Maybe it is worth it but it's not some free win

Like I said, the license should be for handling sensitive data. You're free to make doodle jump if you like.

Re: Slopsquatting

#16

Post by lan321 »

Invictus0 wrote: post #3

We need to have a professional software engineering license, at least for applications that are handling sensitive data. Why is it that it takes 1000 hours of study to cut people's hair, but anyone off the street can write some software that collects people's driver's licenses? (Looking at you, Tea app developers)

Uni graduates do that still. I wouldn't trust myself to set that up either, as a matter of fact.

Optimally, you'd probably have seniors do some "Security Compliance Certification" and the company do it, then the product has to be approved by the certified, and if an issue arises, the certified get to be reprimanded, especially the company certification in some exponentially scaling manner so that it doesn't become the cost of doing business.

Re: Slopsquatting

#17

Post by Aurornis »

Invictus0 wrote: post #3

We need to have a professional software engineering license, at least for applications that are handling sensitive data. Why is it that it takes 1000 hours of study to cut people's hair, but anyone off the street can write some software that collects people's driver's licenses? (Looking at you, Tea app developers)

What does this have to do with the article? Naming a package to match LLM patterns has nothing to do with licensing.

Re: Slopsquatting

#18

Post by add-sub-mul-div »

Invictus0 wrote: post #3

We need to have a professional software engineering license, at least for applications that are handling sensitive data. Why is it that it takes 1000 hours of study to cut people's hair, but anyone off the street can write some software that collects people's driver's licenses? (Looking at you, Tea app developers)

1. Most everyone needs haircuts and licensure allows us to take it for granted that we'll get someone with basic competence and that there won't be a citywide outbreak of lice. So much so that we've forgotten the point of the licensure and cite it as folly.

2. Computing was new and mysterious and developed faster than lawmakers could understand it, and by now it's given so much power to the top 1% that they're for all intents and purposes above the law. Cosmetology licensure is from a time when legislation still helped us.

Re: Slopsquatting

#19

Post by Aurornis »

snapcaster wrote: post #4
Invictus0 wrote: post #3

We need to have a professional software engineering license, at least for applications that are handling sensitive data. Why is it that it takes 1000 hours of study to cut people's hair, but anyone off the street can write some software that collects people's driver's licenses? (Looking at you, Tea app developers)

I think something like professional licenses are easy to see benefits of but really hard to see the downsides. How many wonderful things _wont_ be created when you start gatekeeping something? Maybe it is worth it but it's not some free win

> easy to see benefits of but really hard to see the downsides

I think like most hypothetical discussions, the commenters proposing these ideas aren’t interested in practical versions of the idea with tradeoffs. They imagine a perfect version of it in their minds with no downsides that accomplishes everything they want.

The demand for professional licensure doesn’t even make sense in this context. Is professional licensing supposed to stop developers from naming their packages names that LLMs produce? Is it going to force the package repos to check that everyone has a professional license before submitting packages from the United States (or other countries with licensure)? Can it be worked around by changing your country in the drop-down box to a country that doesn’t have licensing?

The calls for software licensure never seem to take into account the global nature of the Internet and software development.

Re: Slopsquatting

#20

Post by ikari_pl »

Pxtl wrote: post #14
kouteiheika wrote: post #6

> LLMs hallucinated a package named "huggingface-cli" [...] it is not the name of the package [...] software is correctly installed with [...] huggingface_hub It would be a good idea to disallow registering packages which only differ by '-'/'_'. Rust's crates.io does this, so if you register `foo-bar` you cannot register `foo_bar` anymore.

Case insensitivity is so important. Underscore is just capital hyphen.

I’d rather say underscore is a capital space :D
Post reply on HN