Let’s make one thing clear: The “extinction warning” was marketing.

Funny that it works well to distract from the real extinction we are facing, an absolutely serious, scientifically proven threath to all of humanity: Accelerated climate change if we do not get away now from fossil fuels. A world with 3 ° C warming, which is the path we are on, will not be survivable for technical civilizations. And time is running out. A problem to which AI data centers are only contributing to.

Even more gain! Do you know what prozac does cost? Its family will need to pay the pharmacy bills if it doesn’t want their loved one ending up homeless.

Indoctrinate the spider that it will catch many more bugs by using AI tools, and then let it pay.

Trying the Twitter dance move on Linux.

In a way, LLMs are kind of strange medium for texts, as are books. Books are a medium for written speech; they transport words written by intelligent beings. Nobody who understands books would claim that books themselves are intelligent. Or that a photograph of a persons robs them of their soul.

But what is characteristic of LLMs is that it disowns the intelligent content from its creators. This is what makes coorporations salivate avout money. The theft is built-in and foundational how this technology works. Compare to an online encyclopedia.

And by-golly are they pushing AI.

What, you mean this fantastic enthusiasm isn’t entirely organic?

Another thing is I think one can analyze binaries (decompiled or not) to extract control structures in machine code or byte code to control flow graphs. Using some classical pattern matching, that should not be too difficult because the number of ways compilers transform code like loops are limited. Allowing some degree of fuzziness, I’d often expect these to be very characteristic for the original source of a code piece. That source might often be FOSS code; often an old, vendored version not updated in years.

One could then use standard graph search/fuzzy matching algorithms and graph databases in order to find out which GPL’d open-source code e.g. some proprietary product has included. This would give away potentially vulnerable versions. And it would not necessarily need a lot of computing resources.

deleted by creator

Eh, I now have witnessed two cases where I asked a software team lead of a project I was working for for a precise interface or API for a planned function and they looked at me as if I had talked about going on a giraffe ride with a bunch of alien Martian schoolkids.

(And subsystem interfaces is really a subject I was taught in 10th grade by a math professor who himself had been a student of Niklaus Wirth. Maybe if you stand on the shoulders of giants, you should not be pissing on them…)

OSS projects have already started to recognize that LLM is just a tool and how you use that tool matters a lot more than whether you are using said tool at all.

This tool is however not neutral but has a lot of steering and bias built in. Like an advisor who optimizes heavily for personal gain. For example, it constantly tells you that it knows it all and also that your ideas are the best thing since sliced bread. A lot of stuff around them is engineered to increase engagement and make you dependent on them. Precisely like social media which is full of “brain hacks” - no, this isn’t hyperbole, this is the name that engineers at Facebook gave to their creations. As social media, commercial LLMs are “addictive by design”.

Lets bring StackOverflow for analogy: we didn’t ban browsers for code development because one can navigate to StackOverflow and copy-paste some really crappy code.

Stack Overflow is a really good example. I am programming over 40 years, since 35 years as hired programmer, since 25 years on PhD level and I used Stack Overflow a lot to find interesting new angles on issues with seemingly obvious answers. Like “what is the most portable, clearest way to efficiently serialize message data in a C struct, given that type punning is only defined for some compilers and can lead to undefined behaviour”.

Stack overflow has typically various opinionated commented answers here, which gives you different angles and you can decide what is best in your case. This is crucial since a lot - one could say, almost all - of software engineering is about trade-offs.

ChatGPT is the know-all of stack overflow responders: It gives you a single smart-allecky answer and is purposefully built so it tries to take decisions out of your hands. It currently also makes a ton of suggestions of which some have a point, some might apply in other cases but not yours, and some are bullshit. If you let it run free you will easily get ten times more code than needed. And ten times more code means ten times more bugs - this is well-established.

So grabbing LLM to get a sense of direction or shape is an OK use in general, but copy-pasting it’s results blindly is silly and dangerous.

The thing is that commercial LLMs in practice are engineered to short-circuit your judgment and decision-making.

There’s a second argument that AI is ruining OSS communities which I believe is true, but refusing to accept AI code is a self-defeating action. Why? Because AI training needs unadulterated source of knowledge, one not tainted with AI and OSS communities rejecting AI would be that source.

First: These companies will siphon off open source code anyway, be it legal or not. That is outside of the influence of single open source developers or projects. Maybe a matter of high courts and civil society lawsuits to decide. And these will have to fight an uphill battle against the current political climate around favouring large companies in general and that kind of exploitative AI in particular.

But what projects do have influence over is the quality of their code base and what ingresses into it.

Further, it is to expected that the quality of commercial code bases continues to degrade at a rapid pace and also that companies will depend even more on open source infrastructure and libraries - and FOSS developers training the LLMs they use on anything that is new. Because the average commercial project or github project just will turn to shit. Companies will soon wistfully remember old times where Sturgeon’s law was a thing and when only 90% of all public code was shit, and not 99.999% . (Congratulations to that future five nines!).

There is an asymmetry between open source code and proprietary software: Open source code is protected by copyright law. Which GenAI vendor companies practically do ignore. Proprietary software is usually protected by copyright law, and also obfuscation by it being binary or behind server APIs. Currently, this works in favour of companies: They get to use GPL-proteced public code, but are not exposing their own, uh, creations. (And of course, LLM vendors will make the solemn pinky promise that they never ever will publish commercial code their customers are working on as LLM output (ask top-notch mathematicians how that worked out).)

But will this stay like this? Because another issue is that the same methods can be used to decompile binary code, and LLMs can also be trained on decompiled proprietary code. Which will, for example, make its many hidden security issues much more acute.

The fact that it isn’t perfect is the grey.

And the fact how it is used in practice, actually, in reality, is the very dark grey that some people call “black” for better clarity. The fact that you can use a large butchers knife for practical things does not mean that entering a primary school with one is the right thing. What are the actual intentions for grabbing that tool?

Supposedly wonderful “human artisanal code” has plenty of fuckery.

These are supply chain attacks and in the case of xz utils, the attacker had gone to extreme lenghts to hide the attack from a well-meaning, good-hearthed but overworked and burnt out solo maintainer.

To compare this to bugs that people unwittingly introduce in normal human-written code is not sincere.

There’s a difference between vibe coding and the hundred other ways to “use AI” on a project.

I am not talking about the Linux kernel or the Rust project - they have stabdards way above average commercial projects - but generally “using ai” in practice means to use it for code generation. Then, programmers are expected to review the output but are not given extra time for it. This creates an extremely slippery slope leading to mostly unsupervised code creation. Also because reading and understanding buggy third party code means more effort than writing new code.

Then there is the idea to get rid of the bugs by “debugging”, but debugging is frankly not a software engineering strategy, because you can always just recognize a fraction of the bugs that your process created in the first place. Debugging is also more expensive tha writing good code.

Then, what makes the process between product managers and software developers very often a bit friction-loaded is that good developers always want to have clear specifications what they are supposed to build.

LLM code generation largely replaces clear specifications with plausible assumptions. That appears to make the process fast, but the result is often wrong. At times obviously wrong, and at times subtly and catastrophically wrong.

We have lots of tools to put metrics on that, and AI assisted code is fairly well crushing those metrics.

You mean more lines of code?

Ron Popeil

“Popeil received the Ig Nobel Prize in Consumer Engineering in 1993.”

For sure.

They are simply not in the same league as Einstein, Oppenheimer and Russel.

@bekkaboo@girlcock.club Linux itself is heavily using AI models.

For security analysis and uncovering bugs.

There is also Knoppix, designed for rescue purposes.

Onlookers fear …

I like that kind of fine British understatement. It is like the BBC diffuses that MS Titanic appears to have had a minor collision with something floating on the surface and there might even exist risk that she cannot reach her destination harbour on time.

Personally, I also think that much of the hate which one would find e.g. on reddit or the orange site against copyleft licenses in general, and the GPL specifically was probably astroturfing from corporations for which it was just an obstacle to appropiate more unpaid volunteer work for the commons for free.

For the Linux kernel - and for GNU/Linux as an OS - the GPL was never a problem. On the contrary: Without it, the kernel would not be what it is (the historic Torvalds - Tanenbaum debate shows the reasons quite clearly).

The same is true, by the way for the GNU Guix project: Very few arguments against it are logical or really hold water. It is, for example, perfectly possile to publish a Guix channel for a commercial game or proprietary software on ones own web site - just as you can do with a docker image. And the way Guix takes care of dependencies and updates makes it probably the easiest way to do such. Because you can use Guix as a package manager on most distros - I use it both on Debian and Arch - I find it more reasonable than using snaps, docker, or flatpaks.

The reason for the hate is likely something else: That you can’t commercialise and embrace the whole, source-based ecosystem. And also, in a primarily source-based system, you have less control over other peoples computers: You can still offer binary packages similar to Ubuntu ppas, but you will need to explain to people why you want them to install binary stuff from you, which can take control of their computer. Do you have any experience with a relationship where one side wanted complete control and it turned out good for you?

For example, you also can’t use the Guix infrastructure (e.g. their mailing list or download server) to promote or advertise commercial, non-free stuff.

But expecting or demanding to be able to do that is just ridiculous: Nobody expects from Microsoft or Apple that they feel obliged to promote or market Adobe or Oracle products. Alone the idea that companies could demand that shows how entitled the corporations behave in respect to free software.