I hate ai as much as the next person, but I’d have a different mandate. I would require all code to be fully reviewed and understood by a human. Let’s call it quality control.
Agreed. It’s not sensible or practical to ban AI, and Linus is right. Why is Linus right? Take a look at the number of Linux CVEs being patched over time. In 2022-23, that was about 300 per year. Last year it was 5530. This is almost entirely as a result of AI scanning tools, including Copy Fail priv escalation that was there for 8 years. The security apocalypse is just about arrived, and the most recent round of cyber models coming out do this way better than before. The Hugging Face incident story was truly unbelievable if you read / watch the details, a historic event. Everything is about to get hacked. So it’ll be all about maintainers being reactive to this new reality and burden for some time to come
Yes and no. The ability to “understand” code that makes AI capable of finding security bugs, is correlated with AI’s ability to write code. AI is just really good at code related tasks, and categorically banning all AI usage is shooting yourself in the foot.
It’s a fair question. I think out of the two proposed rules: enforce no AI generated code, and enforce human reviews, enforcing human reviews is actually more feasible, and in fact most companies already do that. Pull requests need human reviewers to approve them.
It’s harder to enforce no AI generated code. A developer can always, at the very least, Google a problem they are having on their phone and retype the code from the AI answer into their work computer.
I mean how do you enforce someone doesn’t copy code from proprietary repos? You just try your best, and only come down on the cases where it’s obvious.
LLM users are lazy so they inevitably just copy+paste something asinine without reading it.
I hate ai as much as the next person, but I’d have a different mandate. I would require all code to be fully reviewed and understood by a human. Let’s call it quality control.
Agreed. It’s not sensible or practical to ban AI, and Linus is right. Why is Linus right? Take a look at the number of Linux CVEs being patched over time. In 2022-23, that was about 300 per year. Last year it was 5530. This is almost entirely as a result of AI scanning tools, including Copy Fail priv escalation that was there for 8 years. The security apocalypse is just about arrived, and the most recent round of cyber models coming out do this way better than before. The Hugging Face incident story was truly unbelievable if you read / watch the details, a historic event. Everything is about to get hacked. So it’ll be all about maintainers being reactive to this new reality and burden for some time to come
There is a difference between using AI scanning tools and generating code for production
Yes and no. The ability to “understand” code that makes AI capable of finding security bugs, is correlated with AI’s ability to write code. AI is just really good at code related tasks, and categorically banning all AI usage is shooting yourself in the foot.
And also have high readability standards, ideally higher than before LLMs.
Read the article, that is one of the two options they are voting on.
How would you enforce that?
How do you enforce code is not AI generated? I don’t see how one is more easily enforceable than the other.
Well it depends who you are. An employer could enforce it.
But it was serious question. If you’re going to have a rule then there should be a way to enforce it, otherwise it means nothing.
It’s a fair question. I think out of the two proposed rules: enforce no AI generated code, and enforce human reviews, enforcing human reviews is actually more feasible, and in fact most companies already do that. Pull requests need human reviewers to approve them.
It’s harder to enforce no AI generated code. A developer can always, at the very least, Google a problem they are having on their phone and retype the code from the AI answer into their work computer.
I mean how do you enforce someone doesn’t copy code from proprietary repos? You just try your best, and only come down on the cases where it’s obvious.
LLM users are lazy so they inevitably just copy+paste something asinine without reading it.
This is the way. Cat is out of the bag now so need to figure out responsible usage.
Fortunately we have a method for that for a long time now: PRs. If you approve it, you are responsible for that approval.