Fuck AI

rsync is thirty years old. It has been mature and reliable. But now we're victim-blaming someone that hasn't (yet) cleaned up somebody else's mess?

Yep. A solo dev working on a project. Legitimate security flaws found by people who don't know much of anything about coding, but can prompt an LLM. They don't even understand the bugs they're submitting, so if he has questions they can't help.

His choice is either to spend all of his free time trying to patch these bugs, or to look for help. It's very hard to find help as a solo dev on an unsexy but essential tool. So, he turned to LLMs to help. And, who knows, maybe he's able to use them slightly more responsibly than other devs. But, LLMs almost inevitably lead to their own bugs because LLMs are always confident, and are designed to produce something that looks as much as possible like real working code, but without any actual thought or analysis behind them.

If you read the discord chat logs, it makes sense. He's being bombarded by security vulnerabilities discovered via LLMs, from people who barely know how to code and can't even explain the flaw that their LLM discovered. He's a solo maintainer, and his choice is either to leave these security vulnerabilities open, or to turn to LLMs to try to keep up with the need for patches.

I don't think he made the right choice, but I think he's probably a much better programmer than me.

Okay, I imagine that using an LLM is like having several Tasmanian Devils on your team.

But when it worked there was no work being done. The repo just stayed there, working. Doing nothing.

A few LLM commits have kickstarted the process of a lot of people checking their rsync versions, choosing the correct one. And so on. That is work that wasn't being done before, and now it is done thanks to LLMs. Truly a wonder of our times.

Reminds me of that Douglas Crockford talk on managers. I'll see if I can dig it up.

I wonder what he thinks about LLMs.