Live data from Hacker News

Open Source Isn't Dead

strix.ai

21–30 of 200 posts

Re: Open Source Isn't Dead

#21
post #20
post #3

I have an open source project and started receiving a lot of security vulnerability reports in the last few months. A lot of them are extremely corner cases, but there were some legit ones. They're all fixed now. Closed source software won't receive any reports, but it will be exploited with AI. So I definitely agree with the message of this article.

given what the clankers can do unassisted and what more they can do when you give them ghidra, no software is 'closed source' anymore

Guess that kind of depends on your definition of "source", I personally wouldn't really agree with you here.

Re: Open Source Isn't Dead

#22

All content is going to go behind paywalls. There is zero incentive or reason for content creators to let AI slurp their content for free and distribute it and get all the money from it. Everything new will be licensed and if AI companies want access to it, they will need to pay for it, just like we will.

I don't think this will happen. If most content goes behind a paywall, releasing content for free will again become a valuable source of attention. It used to be so before the web got filled with so much free content that it lost any value.

Re: Open Source Isn't Dead

#24
post #20

Earlier quoted context omitted.

given what the clankers can do unassisted and what more they can do when you give them ghidra, no software is 'closed source' anymore

Guess that kind of depends on your definition of "source", I personally wouldn't really agree with you here.

absolutely agree with you if we're talking about clean room reverse engineering; but in the context of finding vulnerabilities it's a completely different story

Re: Open Source Isn't Dead

#25
I have a large open source project and noticed the number of LLM generate PR is making it unmanageable. Every two weeks, I go in, kill all of them and when someone complains or asks why, I realize it was a real person and then I merge it.

is anyone else seeing this / fixed this problem ?

Re: Open Source Isn't Dead

#27
Open source is dead, AI-pundits are applying the wrong lessons. No one has to accept AI or play the game all these AI companies don’t work if everyone stops publishing. Let the AI generated content industry have the publish space, they're very adamant about taking it over and watering it down with slop.

I wrote some very nice expressive text for our deployment guide. My project manager took the guide and had Gemini break it down into plain boring bullet points. AI and the pundits can gf themselves in their journey to kill human expression.

Here is what I wrote in the guide:

"Post Deploy Responsibility

If you made it this far, say “Wow I really did it and it was so easy!”

Did you say it? Good. Now you are entirely responsible for any issues or bugs that may arise from the newly deployed code. Don’t go anywhere until the deploy has finished (usually takes a few minutes). While an issue or bug may not leave you directly at fault, you are responsible for coordinating any rollbacks or remediations that may be needed until the next deploy."

Here is what the product manager slopped it into:

"- Post deploy responsibility

  - You are responsible for performing QA upon deployment 

  - You are responsible for any issues or bugs that may arise from newly deployed code 

  - You are responsible for coordinating any rollbacks or remediations that may be needed until the next deploy"
My paragraph wasn't long, hard to understand, or poorly written. I wouldn't have objected to a rewording or some changes but the project manager chose to just copy paste it into Gemini and copy and paste it back. So my take is that they didn't understand what I wrote. Which is a few sentences long and frankly sad if a paragraph is too intense for you to read. When my project manager did this during the meeting I said, "RIP human expression" and their response was a very hasty "no that's not what's happening". This is what all the pundits want to do to everyone and society. Don't believe them that "it's just a tool", that is just a tactic to get you to rollover so they can shove more AI in your face.

Re: Open Source Isn't Dead

#28

> The reasoning provided by their CEO, Bailey Pumfleet, is that AI has automated vulnerability discovery at scale, That sounds like an excuse. The real reason is probably that it's hard to make a viable business out of developing open source.

I'd think it's also much easier to spin up a (in some area) slightly better clone and eat into their revenue.

This is part of it for sure. It is also true that many open source business depended on it not being worth the trouble to figure out the hosting setup, ops etc, and the code. Typical open source businesses also make a practice of running a few features back on the public repo.

Now I can take an open source repo and just add the missing features, fix the bugs, deploy in a few hours. The value of integration and bug-fixing when the code is available is now a single capable dev for a few hours, instead of an internal team. The calculus is completely different.

Re: Open Source Isn't Dead

#29

> The reasoning provided by their CEO, Bailey Pumfleet, is that AI has automated vulnerability discovery at scale, That sounds like an excuse. The real reason is probably that it's hard to make a viable business out of developing open source.

separating codebase and leaving 'cal.diy' for hobbyists is pretty much the classic open-core path. the community phase is over and they need to protect their enterprise revenue.

blaming AI scanners is just really convenient PR cover for a normal license change.

Re: Open Source Isn't Dead

#30
So Cal.com favors security through obscurity.

Open Source was always open to "many eyes" in theory exposing itself to zero-day vulnerabilities. But the "many eyes" go for the good and the bad actors.

As far as I am concerned... Way to go Cal.com, and a good reminder to never use your services.

Post reply on HN