• 0 Posts
  • 212 Comments
Joined 3 years ago
cake
Cake day: June 13th, 2023

help-circle






  • Ah yes the lie being fed to me, aka having seen a lot of the exploits, as well as their RCAs clearly pointing to human written code. Unless you suggest that these AI companies have discovered time travel and are sending back their LLMs in time a la Terminator, but instead of killing John Connor, they’re just… injecting slop before LLMs were a thing. Which is obviously a ridiculous notion.

    Yes, actual slop - code never reviewed by a human, having no actual maintainer, etc. - can have major security issues. Today, considerably less than, say, a year ago. Reality is, most slopware is either abandoned in no time, or, the less likely option, get traction, get more people working on it, and over time, become less sloppy as people take ownership of various parts.

    Meanwhile, an overwhelming part of the IT industry now utilises AI with humans in the loop. We are actually in the phase of the “find out and oh fuck backtrack on it” part of the whole “let’s fire engineers because a manager with AI can do the work of a department” idea backfired spectacularly.




  • Hey now, not all of us are spouting nonsense constantly. I for one tend to research topics - even if in a cursory manner (and no that does not mean I use Cursor or other AI as my main information source, before another anti-AI shitwit accuses me of doing so). And I tend to stick to topics I have at least a cursory understanding of, to begin with.

    Should that not be the case, I’ll try to join the discussion with questions. Problem is, what I consider the basics of a discussion worth having - that is, being informative, with the goal of education, sharing knowledge - seems to be too much effort for most.

    However what I can’t stand is the aforementioned shitwits joining a level headed discussion only to barf in a half-digested word salad based on nothing but their emotions. If I wanted to debate based on emotions, I’d go to a reality show community…






  • There is a difference between an AI doing a security review (which they have become quite accomplished) and generating code that gets committed into the codebase.

    I guess I should’ve quoted the whole part, as my primary point was to show that not only did AI spot niche, obscure bugs… it spotted niche, obscure bugs that HUMANS couldn’t.

    Again, how does one verify that the code it has generated isn’t some verbatim chunk of copyrighted code that it happened to be trained on, and it turned out to be the best fit? There’s no guarantee that a model will not do this, even if instructed.

    And what if someone has a genius idea and comes up with a piece of code, completely on their own, and it turns out to be the exact same, verbatim, character by character matching as a copyrighted piece of code?

    What if AI does this? What if the model wasn’t even trained on that piece of code, but, by sheer coincidence, it puts together the same solution because it’s the most obvious and best option?

    Copyright and licensing in code is already a weird topic because mechanical problems often have the same solution. There’s a finite (and in fact, usually very low) number of ways you can run the same algorithm or represent the same data. Say you have to implement a key-value storage system. No requirements on it needing to support millions of entries, historical caching, snapshotting, anything, expectations are simple: a command to add an entry (and update the value assigned to the key, if the key already exists), a command to delete an entry, and a command to get the number of stored items. Wanna bet that if you give this task to 1000 developers of the same language, a large majority will write nearly the same code? Hell, if you don’t consider inconsequential things like variable/field/property/function naming, there’s good chance 90%+ of them will write the same thing. Woukd that be plagiarism though? Would copyright apply?

    On the other hand if you were to write and release a book that is verbatim the same as another, famous book, with the only difference being the names of characters and places… Well I guess you can see where I’m going with this.

    Also, content generated by AI models has already been deemed uncopyrightable, and this includes code. So are some larrtsmof the Linux kernel now able to be copied freely without GPL restrictions? How can you license code or executables compiled from said code if you do not hold the copyright on it?

    You could already copy small enough parts of the Linux kernel without needing to cover yours in GPL. Trivial things for example. Say you have a driver that talks to sone niche hardware in a specific data packet format. Can you copy/recreate that? Or a trivial solution like the aforementioned cache. GPL doesn’t mean you can’t copy a single line of code without your codebase becoming GPL too.

    Oh btw that copyright claim is much weaker than you’d think. It didn’t specify the level of human involvement for example. Also, given the base code is GPL and human written, and GPL applies to all derivative works, it still applies.






  • As a senior dev… AI actually improved the code we wrote in my last job. Mind you the codebase was in a shite position (tons of technical debt, plague-like avoidance of inline comments because “all of that knowledge is on Jira/Notion” except it wasn’t; lots of legacy code, undocumented weird behaviours, everyone was doing their own coding style without regards to the rest of the codebase and so on).

    With controlled AI contributions, we’ve managed to:

    • refactor large chunks of code where the overall high level logic didn’t need to change, but the underlying tooling did (e.g. lots of UI layers got rewritten from a very early attempt at a standardised MVVM approach to a well defined MVI one, we’ve also managed to eliminate the remaining RxJava/RxKotlin legacy flows to replace them with Coroutines)
    • UI layers got refactored in no time because the AI agent was able to convert them appropriately (and even fixed a handful of UI bugs)
    • a handful of core monoliths (yes I know… I hated working with them as well, but we never had the chance to properly refactor) got split up into more manageable, vertical-specific domain controllers without breaking
    • the elimination of a legacy overarching component that was estimated at 6 months, got reduced to 6 weeks
    • unit test coverage skyrocketed because even if the code was hand-written, an agent would provide coverage, based not just on implementation but on intention (and adoption of TDD/BDD finally started spreading).

    Meanwhile code quality improved because we’ve had well established patterns and styles defined in the agent instructions, and even the anti-documentation “pragmatists” got shut up when they finally understood that the AI works better if there’s fucking comments to explain what’s going on