Piero Bosio Social Web Site Personale

@mkljczk Eventually, I'd expect we should be able to build a complete computer's repository of software written only by people who have verified they haven't used LLM "code assistants". Since companies are unlikely to provide such verification, we should get as close as we should possibly get.

But since you asked, yes, I think any software or OSS code contributions from a corporation should be treated with concern right now, since many have adopted mandatory LLM policies.

@gabrielesvelto @luana @nina_kali_nina @Timshel I am not qualified to speak on this but I've seen others look into it and seen that claud's bot submits many of these trivial/cleanup PRs, and some of them introduce security flaws, because the bot has no way of knowing if a change is good or bad. You shouldn't be trusting a bot which knows nothing but statistics to make minor random changes. Keep allowing that and eventually it will slip something awful past you.

@CodingPhysicist Note vaultwarden is a separate project and has no specific signs of LLM use as far as I'm aware. I don't know what to do with this information though since surely vaultwarden is usually used with a bitwarden client?

@AerynOS @tris meaning what?

Are you saying you have a software repository free of software containing LLM contributions?

It's very easy to say your distribution's unique software follows some principle or other because most Linux distributions write little software, instead mostly packaging other people's software.

@yukijoou @mary what I am trying to describe is reducing iteration cycles, which is a non-necessary, but very useful thing. Regardless, sometimes I encounter software (for example the bluesky social app) where the build instructions run through expo and no others are given.

@futurebird maybe it's for the ice cream shops birthday not yours

@argv_minus_one @elfin I do not use keepassxc

EDIT: checking google there *is* a "Keepass2Android", one assumes forked from the original keepass

@csolisr i'm told elsewhere in thread that vaultwarden has not accepted AI code, but vaultwarden replaces the *server*, not the client, right?

@draNgNon @itamarst

"I thought KeePassXC required human reviews / unit tests in order to mitigate any llm harms. Did that change?"

I literally don't give a shit. If you think it's OK to generate computer source code from a neural network, I don't trust yr judgement enough to trust your code reviews.

"More broadly, I don't really see how you can prove no LLMs were involved in code contributions if they are actually contributed by a human."

Same way you enforce any policy against stolen code

@argv_minus_one @elfin that's great, but can it interop with a phone?

@redfire Which version is that, by the way?

@whitequark That's an option…

I guess part of the problem is that in Qt, all the *consumers* of my strings can accept QString, whereas I am uncertain the various things I feed strings to will be able to accept it without cloning. We got used to String and copy.

sometimes wish rust had reference-counted copy-on-write strings like qt

"you could implement that yourself" yeah i guess but the friction's a bit high

@LovesTha Thanks.

Looking it up, there is no Linux GUI client for Dashlane. So maybe I won't go for it.

@haqistan

Here's the text I'm currently copypasting into my own open source projects: https://codeberg.org/mcc/nameless-experimental-lisp/#contributor-agreement

I've seen other people with standard text, but nothing designed to be copypasted.

Incidentally, I am considering upgrading to something a little stronger, like this; what do you think about it? https://mastodon.social/@mcc/115872922320160715

@johnlehet Yes; I am attempting to describe the product sold as "AI code assistants" without using the word "AI". It did not occur to me that "code" was ambiguous/a pun when I made the post.

@ariadne okay. when i said "linux distribution" i was thinking "a collection of all the software you need to run a computer system" as that's what a distribution traditionally meant. (the existence of flathub somewhat complicates what i want, but like I said, I was being vague and flippant)

@LovesTha if i can export between password managers, but both password managers are infected with the same problem, does this help? what's dashlane? is it good?

@johnlehet Software is a chaotic system. A small change in one part of a program can have unpredictable effects on other parts of the program. "Large language models" are statistical systems which create asemic strings designed to fool a human into believing they're looking at real text.

In other words a mistake introduced by an LLM may be significant, a human may not catch the error, and security flaws could result. This is BEFORE getting into the ethical issues with running the system at all

@mary yeah, but if a build and deploy means making and deploying an apk then there's some question why you're using react native at all.

i think it ought to be possible to do all this by just forking expo/expoapp and removing the arbitrary dependency on the web service.