Seems like he’s been pushed into using LLMs as a way to cope with the deluge of LLM-generated security reports.

  • slacktoid@lemmy.ml
    link
    fedilink
    English
    arrow-up
    57
    arrow-down
    14
    ·
    2 days ago

    I’ve said this before and I’ll say it again. If an established dev uses AI and you don’t want that? Then get involved.

    • VitoRobles@lemmy.today
      link
      fedilink
      English
      arrow-up
      37
      arrow-down
      10
      ·
      2 days ago

      Yep. All the bitching is exhausting.

      Talk is cheap. Send contributions or fuck off.

      • binux@sh.itjust.works
        link
        fedilink
        English
        arrow-up
        29
        arrow-down
        2
        ·
        edit-2
        2 days ago

        Well rsync is a pretty integral utility for a whole array of software at this point, and I guarantee you that not all of its userbase has the expertise required for direct contributions. I don’t think it’s fair to write off the complaints of people like that as irrelevant, especially if they have a stake in rsync working well for them without having to worry about AI hallucinations screwing them over.

        • Phoenixz@lemmy.ca
          link
          fedilink
          arrow-up
          6
          ·
          2 days ago

          Well yes but.

          This guy is already retired, he wants to spend his days sailing and here we are bitching about rsync not being good enough while we all use if for free

          Most of us won’t be able to help code

          But most of us could help with translations

          Many of us could help with documentation

          Some of us could contribute regularly nwith small financial donations

          Some of us might have enough knowledge and expertise and experience to help code

          The point is: rsync need more resources. Either we get him more resources or we STFU about the retired dev using AI. We can’t have it both ways

          • wewbull@feddit.uk
            link
            fedilink
            English
            arrow-up
            5
            ·
            1 day ago

            Then retire. All the time people think it’s maintained it feels safe to not get involved.

            • Evotech@lemmy.world
              link
              fedilink
              arrow-up
              1
              ·
              8 hours ago

              I agree. Either retire and pass the torch or stop using “im retired” as an excuse. You can’t have both

        • slacktoid@lemmy.ml
          link
          fedilink
          English
          arrow-up
          13
          arrow-down
          5
          ·
          2 days ago

          I agree with the worry and wanting an alternative but demanding what the dev does is where it crosses a line I feel

          • binux@sh.itjust.works
            link
            fedilink
            English
            arrow-up
            15
            ·
            2 days ago

            I agree with that too, though I think the self-righteous attitude like that of the person I’m replying to swings in the opposite direction a little too hard for my liking. There’s a happy balance, y’know?

            People shouldn’t complain in a dev’s ear like they owe them something they never promised, and people trying to call that out shouldn’t counter it with a demeaningly confrontational demeanour. Obviously that’s a lot to ask for on the internet, but it’s a good thing to try for at least.

            • slacktoid@lemmy.ml
              link
              fedilink
              English
              arrow-up
              1
              ·
              2 days ago

              Tell me about it, I am skeptical about AI and I kinda wanna know the True Positive, true negative, false positive, false negatives with these AI classified bugs. Still a useful tool.

              I just think it’s unreasonable to ask someone to do dev work for free, either pay or contribute (code, docs, help in misc ways) or cash (and pull out when they do something you don’t approve that’s your right). But until there’s real fuckery let’s just open bug reports and complain about real issues that can be fixed.

        • onlinepersona@programming.dev
          link
          fedilink
          arrow-up
          8
          arrow-down
          7
          ·
          edit-2
          2 days ago

          It’s provided as is, no warranty, no guarantee. If you built your life around it, that’s on you, not the dev. If you want something else, do it yourself or pay somebody to do it for you.

          • binux@sh.itjust.works
            link
            fedilink
            English
            arrow-up
            14
            arrow-down
            4
            ·
            2 days ago

            Fair, but a little empathy for rsync users who only mean well would go a long way. The everyone-for-themselves mentality doesn’t tend to be very helpful most of the time, if ever.

            • onlinepersona@programming.dev
              link
              fedilink
              arrow-up
              8
              arrow-down
              2
              ·
              1 day ago

              Meaning well and blasting the rsync maintainer with absolutist anti-LLM messages are very different things.

              Th rsync maintainer is ironing out issues. Use an old version and let him cook. Once things are stable, then pull the new version. If you’re on arch or another unstable distro that always pulls the latest version, this is what you signed up for. Staying on the bleeding edge means you’ll bleed.

              It doesn’t excuse attacking he maintainer who seems to be making a genuine effort. That shows a lack of empathy.

              • binux@sh.itjust.works
                link
                fedilink
                English
                arrow-up
                4
                ·
                1 day ago

                Meaning well and blasting the rsync maintainer with absolutist anti-LLM messages are very different things.

                …Which is why I specified those who only mean well. Obviously that doesn’t include the less pleasant crowd.

              • hendrik@palaver.p3x.de
                link
                fedilink
                English
                arrow-up
                3
                arrow-down
                1
                ·
                edit-2
                1 day ago

                We’re mixing up two things here. There’s valid criticism. And there’s the people who want to unleash some social-media style shitstorm. The latter show up in large groups and add some unsubstantiated comments, lots of emojis and drown any kind of conversation. But that doesn’t really take away from the valid criticism. For example a maintainer shouldn’t tag a version and release it, when it’s not ready to be released. That’s the 101 of software development. You can expect as much. Because the “bleeding” thing isn’t really how it works. Once there’s a new minor release tagged by the devs, it’s supposed to be picked up by the distro maintainers and get into any distro’s repositories. Doesn’t matter if it’s Arch unstable or Debian stable. They don’t want bugs and security vulnerabilities in their distro, either. Especially not when it’s 6(!) CVEs! And the Debian dev’s in fact reacted to this. And they even backported stuff to oldstable so the people who run the rock-stable stuff from 3 years ago get the patches! So it really doesn’t matter… Run a bleeding edge distro, or a stable one and don’t update it for 2 years, you’ll be affected by this both ways.

      • prole@lemmy.blahaj.zone
        link
        fedilink
        arrow-up
        2
        arrow-down
        1
        ·
        1 day ago

        Yeah, everyone with a local LLM running on their PC who suddenly thinks they’re an expert in software development: time to bombard the creator of Rsync with AI bullshit that he will need to wade through.

      • slacktoid@lemmy.ml
        link
        fedilink
        English
        arrow-up
        11
        arrow-down
        7
        ·
        edit-2
        2 days ago

        I’ve had conversations with people when you say that, like they don’t want to get involved, don’t want to code, and they want the dev done their way. Like ok. WTF? Entitled much?

        And this is for established devs and their codebases, not some vibe kiddy

      • wewbull@feddit.uk
        link
        fedilink
        English
        arrow-up
        1
        arrow-down
        1
        ·
        1 day ago

        Contributions are not enough. It needs people to maintain it. That means dedicating time long term. It’s not a small undertaking.

        Contributions can be a step on the road though.

    • Bababasti@feddit.org
      link
      fedilink
      arrow-up
      9
      arrow-down
      6
      ·
      2 days ago

      Yea, I find all these knee jerk reactions directly asking for rsync alternatives once AI has been mentioned a bit annoying. Like, we wouldn’t be in this place if a project of this importance wouldn’t have been maintained only by a single dude for years…

      • slacktoid@lemmy.ml
        link
        fedilink
        English
        arrow-up
        6
        arrow-down
        13
        ·
        2 days ago

        Completely, some people are just entitled especially in the FOSS and fuck AI crowd. Like I get it but FOSS is literally where it’s gonna be a net good.

          • slacktoid@lemmy.ml
            link
            fedilink
            English
            arrow-up
            2
            ·
            2 days ago

            No net good would be if everyone chirping about AI use in coding picked up a book, Intro to C, Rust, hell even Java. Till then this is all we got. What’s your solution to the problem of developer burnout in FOSS projects?

              • slacktoid@lemmy.ml
                link
                fedilink
                English
                arrow-up
                2
                ·
                8 hours ago

                And who has the time or money for that whenever you want or can? Especially when you’re asked to come out of retirement. Stop being an entitled brat

                • petrol_sniff_king@lemmy.blahaj.zone
                  link
                  fedilink
                  arrow-up
                  1
                  arrow-down
                  1
                  ·
                  8 hours ago

                  This is volunteer work! He can stop doing it at literally any time! No one is forcing him to do this!

                  The more you people go on about how much he has to work, the more I’m thinking that this whole open source thing is a huge human rights violation.

                  • slacktoid@lemmy.ml
                    link
                    fedilink
                    English
                    arrow-up
                    2
                    ·
                    7 hours ago

                    He was literally asked to come out of retirement dude, cause the people with the actual fucking expertise with these tools are a handful. So in some ways, you are benefiting from the expertise of a handful of people and don’t even realize it.

                    Like have you even looked at the rsync code?

                • petrol_sniff_king@lemmy.blahaj.zone
                  link
                  fedilink
                  arrow-up
                  1
                  arrow-down
                  2
                  ·
                  8 hours ago

                  Money doesn’t reduce stress, it makes people more willing to put up with it.

                  You people are acting like this man has to finish this mukbang 5-foot-long sandwich, and somehow I’m the asshole who wants him to get heartburn because there isn’t a second guy there to help him eat the sandwich.

                  • onlinepersona@programming.dev
                    link
                    fedilink
                    English
                    arrow-up
                    1
                    ·
                    7 hours ago

                    I brought it up because if you can’t contribute technically, you can contribute monetarily. Money can reduce stress. I bet you if FLOSS maintainers didn’t have to worry about money, they’d be making very different choices in life.

                    Imagine if rsync were a fully funded project and the maintainer could employ devs and more maintainers to help out. Do you think they’d be happy to use AI? This dude is retired, gives his time to the project and is trying to make things better, but instead of helping, people are berating him for his approach without contributing a damn thing.

                    We aren’t acting like anything. He wants to work on his passion project and people who have done absolutely nothing for the project are giving their unsolicited opinion on how he should work on his own goddamn project. They can all fuck off. It’s his project. FLOSS maintainers don’t owe us anything. Absolutely, nothing.

    • bignose@programming.dev
      link
      fedilink
      English
      arrow-up
      8
      arrow-down
      15
      ·
      edit-2
      2 days ago

      No. If an established dev leans on LLMs for coding and shovels it into the main branch, they have abdicated their responsibility and trashed their reputation. We get to point that out

      without any obligation to do their work for them.

      • onlinepersona@programming.dev
        link
        fedilink
        arrow-up
        3
        ·
        9 hours ago

        It’s his project. He can do whatever he wants to with it. He doesn’t have a “responsibility” to you or anybody else. Stop being so entitled.

      • slacktoid@lemmy.ml
        link
        fedilink
        English
        arrow-up
        8
        ·
        2 days ago

        Point it out, doesn’t change the fact that you’re not addressing the core problem, which is developer burnout in these FOSS projects.

        Also no its not their work, its literally a voluntary job so stop dictating how people spend their free time.

        But that’s just me, you do you.

      • Kissaki@programming.dev
        link
        fedilink
        English
        arrow-up
        3
        ·
        1 day ago

        This reasoning assumes any LLM-assisted change is faulty, right?

        The linked article doesn’t make me concerned. They seem to have the expertise, seem to apply due diligence and good practice around (selectively) using LLM.

        Can people not directly involved in and working on the project assess the risks well? Do we not have to depend on author and project leadership expertise just like we had to before with any parts of development, management, and tool and infrastructure use?

        I haven’t looked up the original communication or drama, but I assume communication could have been much better. Maybe the commits didn’t say much about the reasoning and due diligence that they describe in this article? Other than that, how can you make a better judgment about the changes than them without taking a thorough look and assessment?