• sp3ctr4l@lemmy.dbzer0.com
    link
    fedilink
    English
    arrow-up
    39
    arrow-down
    1
    ·
    edit-2
    5 hours ago

    Jesus fucking christ, did Github expose its own fucking Github credentials?

    Via having LLMs write and push its own updates, live, to production, where they were immediately scruntinized by… other LLMs doing ‘penstesting’?

    We’re gonna run outta honking noses and squirting flowers, the clown show is becoming too immense.

    Either that or we’re going to need to quarantine Github, actually make the fucking Blackwall before these things gain not sentience, but roughly the judgement skills of a toddler, armed with nuclear weapons.

    • JATothrim_v2@programming.dev
      link
      fedilink
      arrow-up
      14
      ·
      edit-2
      6 hours ago

      Every technology invented is a dual edge sword. Other edge propulses deluge of misinformation, llm hallucinations, brain washing of the masses, and exploit exploit for profit. The better side advances progress in science, well being, availbility of useful knowledge. Like the nuclerbomb, LLM “ai” is currenty in its infancy and is used as a weapon, there is a literal race to who makes the “biggest best” fkn “AI” to dominate the world. Eventually, the over optimistic buble bursts and reality of the flaws and risks will kick in. (Hopefully…)

      I posted this 9 months ago, and we are now at somewhere “brain washing of the masses, and exploit exploit for profit”.

      • sp3ctr4l@lemmy.dbzer0.com
        link
        fedilink
        English
        arrow-up
        4
        arrow-down
        1
        ·
        6 hours ago

        Butlerian Jihan when?

        This would all be less funny to me if it wasn’t so incredibly broadly predictable.

  • Ephera@lemmy.ml
    link
    fedilink
    arrow-up
    69
    ·
    edit-2
    6 hours ago

    Last week, some LLM bot commented under one of our issues and it became apparent pretty quickly, that it is a bot. So, I went to report it (incredibly the report menu did say they want reports for bots).

    I filled out the reporting form probably five times in total, trying at different times of the day. Every time, I got an error 500 (Internal Server Error) as response.
    Later, I checked my mails, and saw that actually two of my reports did go through, meaning I created two tickets on their side.

    What those mails also said: They’re very sorry, if it takes longer, since they’re currently experiencing a higher number of reports.

    Gee, I wonder why.

  • onlinepersona@programming.dev
    link
    fedilink
    English
    arrow-up
    51
    arrow-down
    1
    ·
    11 hours ago

    Microslop does it again! But it will take much more than this for people to leave GitHub. Someone will have to start making private repositories public to show that GitHub can’t be trusted for companies to leave. And someone will have to insert malware into GitHub releases from inside the system to make opensource people leave.

    • lastweakness@lemmy.world
      link
      fedilink
      arrow-up
      1
      ·
      2 hours ago

      Codeberg is constantly 504ing and private repos aren’t encouraged. Sourcehut is paid. GitLab is GitLab. So where are people leaving to?

      • onlinepersona@programming.dev
        link
        fedilink
        arrow-up
        1
        arrow-down
        1
        ·
        43 minutes ago

        I’m just reading “I don’t want to leave, whatever happens”. There’s nothing I can say that you will agree with, so we might as well not waste that energy.

        • lastweakness@lemmy.world
          link
          fedilink
          arrow-up
          1
          ·
          15 minutes ago

          I have no idea why you would assume that. You need to stop thinking in binaries and be pragmatic. All my stuff is already on self-hosted Forgejo. So personally, I’m fine for now.

          But genuinely, where am I supposed to tell people to host their stuff? When a college student tells me they want to host their first project somewhere, what is an actually viable answer at this point? My answer would have been Codeberg if not for the 504s, but I’m a bit lost now since that became a daily occurrence, so tell me yours.

        • trolololol@lemmy.world
          link
          fedilink
          arrow-up
          1
          ·
          18 minutes ago

          I already left for codeberg, but I want another one. What else is out there? And don’t say self host, life’s too short for that.

    • Quetzalcutlass@lemmy.world
      link
      fedilink
      English
      arrow-up
      12
      ·
      10 hours ago

      And someone will have to insert malware into GitHub releases from inside the system to make opensource people leave.

      And even that wouldn’t be enough for some of them, given SourceForge’s continued existence.

    • Godort@lemmy.ca
      link
      fedilink
      arrow-up
      17
      ·
      11 hours ago

      Someone will have to start making private repositories public to show that GitHub can’t be trusted for companies to leave.

      What if it’s private, but used as training data for copilot, and can only be accessed publicly through prompt injection?

      • onlinepersona@programming.dev
        link
        fedilink
        English
        arrow-up
        2
        ·
        8 hours ago

        Bad, but not the same, IMO. Microslop could shove it under the rug as a glitch. Oh wait… they would do that in this case too. Yeah, maybe it’d have to be more severe than that, but I don’t know what’s more severe to a private company than getting their IP leaked because of slopcoding.

    • Windex007@lemmy.world
      link
      fedilink
      arrow-up
      4
      ·
      8 hours ago

      As someone who has never really used github (I have for a few minor FOSS contributions… very short touchpoints) but use self hosted git…

      … what is github even fucking offering???

      From my naive perspective it’s a light touch web ui on git?

      I don’t understand what gravity well it provides… what escape velocity is required to bail on it.

      From my naive perspective, I’d have as much allegiance to ot as I would be to an ftp server. Not happy? NP, I’ll take 17 minutes to move to 1 of 9999999 other equivalent services, or take 95 minutes to self host a functional equivalent.

      • psycotica0@lemmy.ca
        link
        fedilink
        arrow-up
        1
        ·
        3 hours ago

        For an honest answer, from an Open Source perspective, it’s mostly auth, profiles, and discoverability.

        Presuming I have a GitHub account, when I encounter a library or tool or something that’s hosted on GitHub that means I can fork it, make issues, comment on issues, make pull requests from my fork to upstream tied to issues, and generally have seamless interaction with any and all software on GitHub.

        Or, if I have my account added to a project, then I can also merge PRs and push to master and be a maintainer of that software without any friction.

        When I see that software is hosted on KDE’s thing it’s like “Ugh”. I have to login to that, and create a profile for that, and then figure out how tickets work there, and how do I contribute to that. It’s enough to just not, most of the time. And maybe I do that for kdenlive. Then I have a bug for Gimp. Okay, what the heck do they use? Is that another login? How do I contribute over there? Is registration even open? Okay guix, oh boy a mailing list. Do I want to subscribe to a dev mailing list just to submit a 2 line patch? I think I’ll just not… I’m sure someone else will fix it eventually…

        So besides all that, some people like their GitHub profile, and like that people can see all the things they’ve contributed to from one spot. That’s why it’s often linked on resumes, but beyond that there’s also a kind of cultural cachet to having a diverse and positive profile, should someone look. If someone is a maintainer of a repo with a lot of stars, that might tell you they’re “important” even if you don’t know why. Because maybe you’re a JS programmer, but this person seems to be big in the Java community, because they seem to maintain a few high profile java libraries.

        And then lastly, it’s sometimes useful as a shortcut in searching. “Source code” is kind of a useless term for searching, so if I search “ruby Ledger file library” I’m more likely to get some docs or a rubygems page, but if I search “ruby Ledger file GitHub” I’m probably going to get what I actually want, which is a readme and a git uri I can clone and play around with. Or a web view of the source I can search through to debug something without cloning. At least assuming that is what I want, it depends on what my goals are, but it’s useful often enough that I do it sometimes as a way of jumping to the source part.

        I’m typically anti-centralization, and anti-microsoft, and if we all move away from GitHub I’m sure I’ll live, but this is why I like it despite its problems. And sometimes I want a webview of file contents, with search, without cloning, so sue me 😛

      • NewOldGuard@lemmy.ml
        link
        fedilink
        English
        arrow-up
        10
        ·
        edit-2
        8 hours ago

        There is a lot offered on the enterprise side. My company uses GH Actions for CI/CD, uses GitHub for OAUTH, it hosts our git LFS server, and it’s where the slop lovers in the executive and management offices get their copilot fix. That doesn’t cover half of it really, but it’s a lot more than a git forge. I despise it nonetheless and think all of these use cases have better tools available