Fuck AI

Nice!

https://github.com/kristapsdz/openrsync

This is an implementation of rsync with a BSD (ISC) license. It's compatible with a modern rsync (3.1.3 is used for testing, but any supporting protocol 27 will do), but accepts only a subset of rsync's command-line arguments.

But also:

The actual work of porting is matching the security features provided by OpenBSD's pledge(2) and unveil(2). These are critical elements to the functionality of the system. Without them, your system accepts arbitrary data from the public network.

rsync has specific running modes for the super-user. It also pumps arbitrary data from the network onto your file-system. openrsync is about 10 000 lines of C code: do you trust me not to make mistakes?

lol - I don't use any AI code in projects I'm paid for at all, but I experiment in my free time. One of the few advantages is that I can keep going when I'm completely braindead, like before first coffee or when I should have gone to bed 3 hours ago. So I prompt things like "run those test thingies" when I can't even remember the gradle/maven task that I use 50 times per week.

So yes, for me, strangely relatable :-)

This is what AI does...it "removes the friction" of doing large scale find and replace operations consistently so your whole repository becomes terrible, repetitive patterns because it made it much easier to do the wrong thing.

My question is if that number is set/used separately in all those places why isn't it defined somewhere more centrally. It's silly that you need to update so many files for such a simple change.

They're not asking.

There are reported bugs https://mastodon.gamedev.place/@JeremiahFieldhaven/116654345332213390
The thing is, LLM can theoretically used be responsibly, just like heroin can be used in a way that doesn't cause crippling addiction. But nobody does that, and that's kind of the problem.

Yeah the role of the maintainer is to gatekeep the quality of the finished product. As long as they do that it's fine. The contributor could be a clanker or a junior trying to get their first PR, I don't care cause the person I trust is the maintainer.

Rsync's creator has been maintaining load bearing infra since before I learned to code, if you can't trust them who can you trust?

Fuck all clankers.

There was also a little debacle a while ago that VS Code was misattributing everything committed in git by users with its default CoPilot extension as being co-written by CoPilot.

Something like that could also be happening here.

Whether the maintainer reviews the output of LLMs rigorously like any random pull request or not, is not verifiable, thus it's not worth discussing.

No. It's worth discussing, it is destroying confidence in the product.

Edit: wheezy@lemmy.ml was more eloquent.

Whether the maintainer reviews the output of LLMs rigorously like any random pull request or not, is not verifiable, thus it should be assumed they did not.

FTFY.

I'm sympathetic to this.

To summarize what's going on: This is a tool used everywhere in the world, and yet the developer is one single guy who is unpaid for its maintenance. He's saying no one else volunteers. I wouldn't be surprised if that's not literally true but it's probably true after reasonable vetting, he can't just accept any guy named Jia Tan who asks to contribute.

Something AI actually has been demonstrably useful for is finding security holes in software. With the advent of AI, tons of FOSS software is flooded with vulnerability reports, they won't all be accurate but some will and need to be addressed, especially for critical software like rsync that basically everyone uses. I know the kernel maintainers have been completely overwhelmed by the number of fixes needed, and obviously they're a bigger project but they are also compensated for their work. This is a ton of extra work to add onto one single guy whose paying job is not working on rsync.

I don't think it's reasonable to be upset with this guy. We should be more upset about the countless number of organizations that can easily afford to pay a couple developers to put time into a tool they use on a regular basis, but instead choose to say that funding development is someone else's problem.

Just as a personal opinion, I think a developer with decades of experience on a critical tool probably deserves the benefit of the doubt with intuiting the pitfalls and what to be careful of with AI use in coding. I think the lack of time is more problematic for code quality than AI use in this specific instance. I'm more opposed because I think someone who is still gaining experience being allowed to rely on it will be disastrous, and any allowed usage normalizes it. (Although I'm also opposed because of a disdain for generative AI as a whole.)

https://github.com/void-linux/void-packages/issues/60825

It'd already causing breaking changes:

https://github.com/RsyncProject/rsync/issues/915

lot of eyes on it I think the quality will remain high

This was bullshit when Raymond argued it in the 90s and it's even more bullshit now.