It's rather ironic that in profit making enterprises using AI are not only encouraged but also part of KPIs. But in open source it's scourge
How is that ironic? It’s literally two sides of the same coin.
Rsync 3.4.3 has hundreds of Claude commits
61–70 of 86 posts
Re: Rsync 3.4.3 has hundreds of Claude commits
#62Earlier quoted context omitted.
So? May main point is: Which commits actually broke the functionality? Going from 3.4.3 to 3.4.2 to test should be easy for anyone affected and would have been more helpful than this rant. I'm not defending bad slop commits, especially for such a long running project but the tribal Fediverse outrage whenever LLMs are involved is often just lazy and uninformed. To quote this PR: https://github.com/RsyncProject/rsync/i…
Figuring out which commit broke what functionality is not something you can expect users to do.
If you're willing to build from source it's not particularly difficult with git bisect
Re: Rsync 3.4.3 has hundreds of Claude commits
#63Maybe he got notified from the mythos team of a bunch of vulnerabilities and then followed up using claude. Doesn't seem that unlikely. What would you do if suddenly there were a dozen exploitable CVEs in your highly used open source project staring you down? Maybe you'd use the tool that found them to patch them as quickly as possible.
Looks like at least one of these issues was from a CVE [0], they don’t call out Mythos specifically though (“security researchers”). Many teams are sprinting on security issues atm (including mine, who put all product priorities aside two sprints ago), it must suck to be responsible for high-visibility/high-risk projects like rsync right now.
Re: Rsync 3.4.3 has hundreds of Claude commits
#64I saw an exceptionally long and thoughtful post on Mastodon from "Space Hobo" https://teh.entar.net/@spacehobo that definitely deserves reprinting here ----- I actually worked at the same place as Andrew Tridgell, over a quarter-century ago. I got to know a few of the OzLabs folks during their immediate post-IBM years, and always had the highest respect for them in that way where you feel acute impostor syndrome when…
“letting the stochastic parrots do his work for him” or “overwhelmed with publicly released vulnerabilities and using any tool he can find to stop the bleeding”; same same.
Re: Rsync 3.4.3 has hundreds of Claude commits
#65Earlier quoted context omitted.
> If TRIDGE of all people can't handle #LLMs without a slopocalypse, no one can. > That means you. That means someone you admire who is intelligent and careful and considerate. Not even someone whose opinions on technology you respect a great deal. I disagree. The amount of commits is not from somebody who is carefully reviewing the new code and considering the changes done. It's from somebody who thinks they are in…
This is a common fallacy: that vibecoding is not that bad if one carefully reviews the output. It's true in a vacuum, but what happens when you're late and stressed out and can't be bothered with doing a proper job. Humans are lazy, and the mistakes of being lazy when vibe coding are orders of magnitude larger than being lazy when you have to do the damn thing yourself. In fact in the latter case, laziness is a featu…
or more generously, replace lazy with tired. even if you have all the intention of reading all the code in detail, when you are tired you are less attentive.
finally, reading code can never achieve the same detailed understanding that you would get from writing it. reading anything in general can't achieve the same understanding as writing. our brain tries to optimize. you see something familiar, you skip over it because you recognize it, and that causes you to miss subtle details.
the one thing i wonder though is, how much would it help if i use AI to generate some code but then, instead of just copying the whole thing, i type it all in by hand. does that give me enough attention to review? does that still give me any benefit of using AI with less downsides?
Re: Rsync 3.4.3 has hundreds of Claude commits
#66Earlier quoted context omitted.
> Everyone is still learning how and how much AI should be used and we shouldn't be too harsh on opensource developers. The main problem with using AI in open source software is that millions of people rely on your code, but you risk exposing them all to something unverified.
Well maybe we shouldn't then? Before LLMs some not just clueless but also malicious rando could've send a PR too. And the maintainers might've gotten burned out any and just said f-it and merged stuff randomly. I don't see how AI changed the calculation here much.
Before, there was a chance to spot it (and things like XZ Utils backdoor were rare), now it will be well hidden in the ocean of slop PRs.
Re: Rsync 3.4.3 has hundreds of Claude commits
#67Earlier quoted context omitted.
This is a common fallacy: that vibecoding is not that bad if one carefully reviews the output. It's true in a vacuum, but what happens when you're late and stressed out and can't be bothered with doing a proper job. Humans are lazy, and the mistakes of being lazy when vibe coding are orders of magnitude larger than being lazy when you have to do the damn thing yourself. In fact in the latter case, laziness is a featu…
or more generously, replace lazy with tired. even if you have all the intention of reading all the code in detail, when you are tired you are less attentive. finally, reading code can never achieve the same detailed understanding that you would get from writing it. reading anything in general can't achieve the same understanding as writing. our brain tries to optimize. you see something familiar, you skip over it bec…
At what point it’s just easier to do the whole thing yourself, perhaps prompting AI to give you guidelines and which whom to discuss the design, but never using it to code?
But then again, the day one is lazy or tired, one will choose the shortcut of having the machine just write the code.
Re: Rsync 3.4.3 has hundreds of Claude commits
#68Earlier quoted context omitted.
> Everyone is still learning how and how much AI should be used and we shouldn't be too harsh on opensource developers. The main problem with using AI in open source software is that millions of people rely on your code, but you risk exposing them all to something unverified.
Well maybe we shouldn't then? Before LLMs some not just clueless but also malicious rando could've send a PR too. And the maintainers might've gotten burned out any and just said f-it and merged stuff randomly. I don't see how AI changed the calculation here much.
No reasonable maintainer would recklessly merge something he/she hasn’t reviewed. Well, those who blindly accept whatever AI outputs… perhaps it’s time for them to find another job.
Just because one offers software for free doesn’t mean there shouldn’t be standards.
Re: Rsync 3.4.3 has hundreds of Claude commits
#69Earlier quoted context omitted.
Well maybe we shouldn't then? Before LLMs some not just clueless but also malicious rando could've send a PR too. And the maintainers might've gotten burned out any and just said f-it and merged stuff randomly. I don't see how AI changed the calculation here much.
No reasonable maintainer would recklessly merge something he/she hasn’t reviewed. Well, those who blindly accept whatever AI outputs… perhaps it’s time for them to find another job. Just because one offers software for free doesn’t mean there shouldn’t be standards.
That's an interesting use of the word 'job'. How much is the rsync maintainer paid?
Re: Rsync 3.4.3 has hundreds of Claude commits
#70Earlier quoted context omitted.
No reasonable maintainer would recklessly merge something he/she hasn’t reviewed. Well, those who blindly accept whatever AI outputs… perhaps it’s time for them to find another job. Just because one offers software for free doesn’t mean there shouldn’t be standards.
That's an interesting use of the word 'job'. How much is the rsync maintainer paid?
My bad, I meant profession.