Seems like he’s been pushed into using LLMs as a way to cope with the deluge of LLM-generated security reports.

  • fodor@lemmy.zip
    cake
    link
    fedilink
    arrow-up
    7
    arrow-down
    5
    ·
    10 hours ago

    If you read through the comments here you’ll see a ton of nuanced comments, I think undercutting your claim. At the same time, this is also an interesting issue because you’re trying to play the centrist role. But on this issue there is no centrist role, and actually you’ve just played the pro AI role while pretending you didn’t do that.

    Because think about what happened. The developer used AI and it introduced bugs and that was bad for people. These are the facts. So the people are saying hey can you stop using AI and the developer is shrugging their shoulders.

    What’s the middle ground that you’re looking for here? Recognizing that it’s possible to use AI harmlessly? But that’s not what happened. If it had been harmless used then no one would have brought up the issues in the first place.

    • Kissaki@programming.dev
      link
      fedilink
      English
      arrow-up
      2
      ·
      5 hours ago

      The developer used AI and it introduced bugs and that was bad for people.

      Was it the AI that introduced bugs, or them, while working with AI there or in other parts?
      Would the bugs not have occurred if they made the changes without AI?
      Would they have made any changes without AI? Would we be better off without changes for security robustness?

      You make it sound like a direct correlation. Having read their response, that seems like an assumption without reasonable foundation.

      Changes always have a risk of introducing bugs.
      I’m no friend of using AI without the necessariy expertise, but from their response, they seem to have taken a very thorough, reasonable approach, and they seem to have the expertise to do so.

    • Lovable Sidekick@lemmy.world
      link
      fedilink
      English
      arrow-up
      2
      ·
      edit-2
      7 hours ago

      When I rant about polarization of AI discussions I’m talking about on social media generally, not this one remarkably civil thread. But even your use of the term “roles” is doing it - you’re assigning black hats and white hats to the participants instead of focusing on what they’re saying.

      Speaking of which, where do you get the idea that the author introduced bugs by using AI? He says that in his work to improve rsync by beefing up test suites, integration testing etc he used AI to do grunt work, and thoroughly reviewed every bit of it. He explains this very clearly, and I don’t see the part where his use of AI created more bugs.

      I am pro-AI - I’m interested in its development and looking forward to it getting better. What we have right now can be very useful, but it’s kind of like 1980s 8-bit graphics video games. It hallucinates too often and is unconscionably resource-heavy. I’m very much against its overdeployment and misuse. Companies are charging into implementing AI like middle school boys who just figured out how to find free porn. They see it as yet another magic wand to reduce headcount - which is their endless quest. But blaming AI itself for this is like blaming a saw for wasting lumber or for not being a better saw. Blame shitty carpenters who use it wrong.

    • I think there is more nuance or spectrum than good or bad. Vibe is one extreme, but along the dial from traditional to pure vibe are degrees of involvement. I’d characterize the degrees something like:

      1. No AI, just elbow grease
      2. AI as just auto complete on steroids
      3. AI generating more complete change sets, but still from focused, more surgical specs, and still a human review on everything
      4. “Spec-driven development” where, as I see it, you’re engineering a multi-agent-role workflow to intersect different contexts and iterating to try to converge on carefully designed specs

      In 3 of those 4, the human is fundamentally the one owning the output, and AI is an accelerator and potentially an influence, kind of like pair programming. And even the SDD workflow can be a human-in-the-loop approach, although the more agents produce autonomously, the harder it might be for a human to be effective at reviewing the output.

      So I’ll agree that “use it or don’t” is a binary, but I’d just add that there’s still a spectrum of how it’s used.