Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

No LLM Code in Dependencies

joeyh.name

Post reply on HN
Print view View original

61–70 of 120 posts

Re: No LLM Code in Dependencies

#61

Post by gspr »

hypfer wrote: post #50

What confuses me about this stance is that LLMs are basically indistinguishable from any mid-to-low-tier dev. And those we've let into our codebases with no concerns. Hell, some even threw parties inviting in more of them. At least LLMs don't call HR on you when you rightfully tell them that they're full of shit. Though.. well. Claude probably might.

> What confuses me about this stance is that LLMs are basically indistinguishable from any mid-to-low-tier dev.

I disagree. Behind an LLM sits a developer. They steer the LLM. For them, directions to the LLM is the preferred form of modification of the software. The output of the LLM is not a preferred form anymore. This poses a huge problem for free software, especially when the LLM that translates preferred form into "source code" is not FOSS.

The low-tier dev was not used in this way.

Re: No LLM Code in Dependencies

#62

Post by hypfer »

moffkalast wrote: post #45
InTheArena wrote: post #30

This is completely infeasible in the age of mythos. The reality is that the velocity is just not going to feasible from a security PoV without leveraging these tools.

In ten years we'll look at human written code like the unreliable garbage it is, and never rely on anything that wasn't at least seriously looked over by an LLM. It won't be even close.

Yes, the same way 10 years from now-10years, we'd all be looking back at how insane it was for people to drive cars.

Man do I enjoy my totally real full self driving.

Re: No LLM Code in Dependencies

#63

Post by gspr »

sscaryterry wrote: post #53
hypfer wrote: post #50

What confuses me about this stance is that LLMs are basically indistinguishable from any mid-to-low-tier dev. And those we've let into our codebases with no concerns. Hell, some even threw parties inviting in more of them. At least LLMs don't call HR on you when you rightfully tell them that they're full of shit. Though.. well. Claude probably might.

This. So many assumptions. If you disclose you used an LLM, it is immediately assumed all of it is done by an LLM. If there is a bug, its because you are a lazy piece of shit, not because humans make mistakes, and you missed it. It is branded slop. We're living in interesting times, socially, OSS will die because of this. Contributors are dwindling, and will continue to do so. If you want to play in your sandbox, ple…

I think you're wrong. And I think that FOSS is our last best hope to keep software under the control of the individual.

The sloppers are diving head-first into a world where not knowing how a basic idea translates to code is embraced. This is not true of every slopper, but it is true of enough that sloppers are a threat.

Re: No LLM Code in Dependencies

#64

Post by scotty79 »

porphyra wrote: post #55

How come all the open source projects are fretting over the copyright status of LLM code but big companies are just vibe coding slop all day for their internal closed source projects without a care in the world?

Because open source community is idealistic and corporations are pragmatic.

Re: No LLM Code in Dependencies

#65

Post by hypfer »

lmkg wrote: post #58
hypfer wrote: post #50

What confuses me about this stance is that LLMs are basically indistinguishable from any mid-to-low-tier dev. And those we've let into our codebases with no concerns. Hell, some even threw parties inviting in more of them. At least LLMs don't call HR on you when you rightfully tell them that they're full of shit. Though.. well. Claude probably might.

Godot's recent announcement spelled something out clearly: when a mid-tier rando contributes, you can provide feedback to that person and possibly help them grow into being a senior contributor or even a maintainer. That possibility of helping the human behind the code is part of the motivation for doing open-source. Mentoring shitty devs is itself giving back to the community, in a different form than the code itsel…

That is a good point indeed.

I am wondering though if that was really the world we were living in just before chatGPT launched, given that the whole OSS thing was already harvested super hard.

The "mentoring opportunities" often were just extracting free consulting out of experts + building a portfolio for getting hired by big tech.

Would we really want to go back to that?

So I agree with the idea but only in a vacuum, I think.

Re: No LLM Code in Dependencies

#66

Post by gspr »

bsamuels wrote: post #51
20k wrote: post #33

Earlier quoted context omitted.

Analysing codebases with LLMs to find security vulnerabilities is completely unrelated to committing code generated with LLMs

and how do you propose fixing the hundreds, if not thousands, of valid, impactful security bugs that frontier models will find?

If you can't fix them without LLMs, then you can't fix them. You probably shouldn't be trusted with maintaining the codebase in the first place.

Re: No LLM Code in Dependencies

#67

Post by gspr »

moffkalast wrote: post #45
InTheArena wrote: post #30

This is completely infeasible in the age of mythos. The reality is that the velocity is just not going to feasible from a security PoV without leveraging these tools.

In ten years we'll look at human written code like the unreliable garbage it is, and never rely on anything that wasn't at least seriously looked over by an LLM. It won't be even close.

Alternate take: in ten years we'll be pulling our hair out cursing at the world over how we could possibly accept "10k lines added, 8k lines removed" as the normal everyday churn of software development. We'll curse the morons who gave up understanding our own code.

Re: No LLM Code in Dependencies

#68

Post by scotty79 »

pull_my_finger wrote: post #20
kstenerud wrote: post #12

[flagged]

Ethically, selling code or programs built on other peoples code without consent is wrong. Legally, it's probably also unlawful, unless you believe that smoke they're selling that it was trained on code that was open licensed or in the public domain. Professionally, it's a poor choice to ship code that wasn't produced with human care and consideration or even thorough oversight or understanding based on recent trends.…

Most software of the future will have userbase of 1.

You won't be selling software. You'll be selling a service of assisting someone so they can build software for themselves.

Re: No LLM Code in Dependencies

#69

Post by scotty79 »

botfriendsarent wrote: post #9

I think this is a fair and normal reaction to AI slop. Alot of work though. I think OSS projects are at serious risk of implosion due to the vigilance required which honestly may end up being a fool's errand anyway. But maybe we are thinking about it backward. Have you ever wondered why there is so much "free software"? Beware of strangers bearing gifts. I have always wondered and been suspicious of people who are so…

Paywalling contributions is an interesting idea. You could auction maintainer capacity. I'm super cutious how much people would pay to get their code into a popular oss project.

Re: No LLM Code in Dependencies

#70

Post by simonw »

gspr wrote: post #66
bsamuels wrote: post #51

Earlier quoted context omitted.

and how do you propose fixing the hundreds, if not thousands, of valid, impactful security bugs that frontier models will find?

If you can't fix them without LLMs, then you can't fix them. You probably shouldn't be trusted with maintaining the codebase in the first place.

How about if you don't have time to fix them without LLMs?
Post reply on HN