Live data from Hacker News

Slopsquatting

en.wikipedia.org

41–50 of 51 posts

Re: Slopsquatting

#41
post #29

Earlier quoted context omitted.

We still barely know how LLMs really work. Hard to tune things you dont understand. Inbefore people telling me "akshually we know all about bla bla bla..." no we dont.

which is why in order to appear smart and well informed, it's recommended to point out how my question is nonensense rather than legitimately trying to figure it out.

Just tech things. This place isn't different from Stack Overflow attitude wise.

Re: Slopsquatting

#42
post #29

Earlier quoted context omitted.

We still barely know how LLMs really work. Hard to tune things you dont understand. Inbefore people telling me "akshually we know all about bla bla bla..." no we dont.

which is why in order to appear smart and well informed, it's recommended to point out how my question is nonensense rather than legitimately trying to figure it out.

you're not entitled to an explanation of your nonsense.

Re: Slopsquatting

#43

We need to have a professional software engineering license, at least for applications that are handling sensitive data. Why is it that it takes 1000 hours of study to cut people's hair, but anyone off the street can write some software that collects people's driver's licenses? (Looking at you, Tea app developers)

What does this have to do with the article? Naming a package to match LLM patterns has nothing to do with licensing.

You could imagine that to get a SWE license, you would have to have learned basic security practices which could include things like dependency management.

Re: Slopsquatting

#44

Earlier quoted context omitted.

Like I said, the license should be for handling sensitive data. You're free to make doodle jump if you like.

I just don't like when comments on things like this don't engage with the downsides. Gatekeeping isn't "free" or strictly better

The status quo is that anyone can make an application that leaks a million drivers licenses, with no oversight, penalty, or restrictions whatsoever. This is good?

If hairdressers have to take time to learn how to not cut people's ears off, people publishing applications should have to learn basic security practices. I think you will find that no one finds this controversial. And yet, we are moving to a world where AI is making it easier than ever for an army of vibe coders to make apps without knowing the literal first thing about security.

Re: Slopsquatting

#45

We need to have a professional software engineering license, at least for applications that are handling sensitive data. Why is it that it takes 1000 hours of study to cut people's hair, but anyone off the street can write some software that collects people's driver's licenses? (Looking at you, Tea app developers)

The company was at had to change all of the job titles at one point because the local regulatory agency said that you cannot call yourself an engineer unless you pass the engineering license, which most software developers could not even hope to do with a few years of study

Re: Slopsquatting

#46
post #2

I’ve used the reverse. When making a new module I’ve let the llm make up an api and I’ve used the names suggested as inspiration of what might come natural to others, to make the use more intuitive.

I too am keen on letting the AI pick names. I'll often be vague about what I want so that it can fill in the blank before I refine it. Comes up with some good stuff.

Re: Slopsquatting

#47

Earlier quoted context omitted.

> Why is it that it takes 1000 hours of study to cut people's hair... Protectionism by a de facto trade guild was always my assumption. There are a lot of activities where bad practitioners present significant danger to society and licensure makes sense. I never understood how cutting hair rises to that level. I'd love to know how licensure in the barber profession is anything other than a bald-faced attempt at build…

> It seems like the market could correct for a bad practitioner in the barber space pretty easily, Why do you assume that? I bet most people don't know their barber personally, and just go to the shop to get a cut. Should getting a haircut be fraught with having to go online and read a bunch of reviews, followed by the inevitable bickering between fake reviews and fake responses on top of that? No, I just want to get…

My wife just paid $300 for a root touchup and the stylist did an awful job. Apparently money and licenses and who knows how much experience aren't guarantees of a good result either.

I've had bad haircuts too. And I have the simplest hair cut ever. Just buzz it off. But noooo.. on multiple occasions they've missed way too many strands of hair.

Re: Slopsquatting

#48

Earlier quoted context omitted.

What does this have to do with the article? Naming a package to match LLM patterns has nothing to do with licensing.

You could imagine that to get a SWE license, you would have to have learned basic security practices which could include things like dependency management.

I was thinking the opposite direction. Squatting is malicious and could cost you your license.

Re: Slopsquatting

#49

Earlier quoted context omitted.

I just don't like when comments on things like this don't engage with the downsides. Gatekeeping isn't "free" or strictly better

The status quo is that anyone can make an application that leaks a million drivers licenses, with no oversight, penalty, or restrictions whatsoever. This is good? If hairdressers have to take time to learn how to not cut people's ears off, people publishing applications should have to learn basic security practices. I think you will find that no one finds this controversial. And yet, we are moving to a world where AI…

I'm thinking about this selfishly. I'd have to go and take a test. But my employer would probably pay for it. Maybe if I wasn't already employed, it'd be on my own dime, but even that isn't too unlike the school I've already paid for. And I'm sure I'd pass the test. As long as I don't have to recertify too frequently, it probably wouldn't be awful. And also selfishly, if it keeps some riffraft out, I wouldn't hate that either.

I guess my biggest concern, with parallels to that time I sold life insurance, is that they test for one thing and then in practice you do a different thing. I hear the same is true for realtors. So.. it becomes an exercise in memorizing some BS that you won't use again after the test. If we do this, the software engineering test would need to be updated at least annually, and better be written by some well respected security researchers.

Re: Slopsquatting

#50

Earlier quoted context omitted.

I think something like professional licenses are easy to see benefits of but really hard to see the downsides. How many wonderful things _wont_ be created when you start gatekeeping something? Maybe it is worth it but it's not some free win

> easy to see benefits of but really hard to see the downsides I think like most hypothetical discussions, the commenters proposing these ideas aren’t interested in practical versions of the idea with tradeoffs. They imagine a perfect version of it in their minds with no downsides that accomplishes everything they want. The demand for professional licensure doesn’t even make sense in this context. Is professional lic…

Yes. If they nefariously typosquat, that could be grounds for losing your license.

Adding a link to your verified license in your package.json or personal website so that installers can check that the author of the package they are using does have a license sounds perfectly fine.

Proving you reside or are licensed in some country before you can publish to that countries repository sounds very doable too.

We don't even have to do this perfectly. It's not about preventing people from skirting the system, it's about giving users and developers the option to install from only verified sources.

Would you rather get heart surgery from a licensed doctor or an unlicensed one? What if both existed where you live? I'd probably ask to see their license before going through with it.

Post reply on HN