3 ms·

> You must ask "Do I trust where this came from?" And to answer that, you need to know where it come from. No you don’t. You can’t outsource trust determinatio

by koolba 1y ago

> You must ask "Do I trust where this came from?" And to answer that, you need to know where it come from. No you don’t. You can’t outsource trust determinations. Especially to the people you claim not to trust! You make the judgement call by looking at the code and your known history of the contributor. Nobody cares if contributors use an LLM or a magnetic needle to generate code. They care if bad code gets introduced or bad patches waste reviewers’ time.

falcor84 1y ago
Trust is absolutely a thing. Maintaining an open source project is an unreasonably demanding and thankless job, and it would be even more so if you had to treat every single PR as if it's a high likelihood supply-chain attack.
- fnimick 1y ago
  While true, we really should be treating every single piece of external code as though it's malicious.
  - tsimionescu 1y ago
    No, we shouldn't. We live in a society, and that level of distrust is not just unrealistic, it's disastrous. This doesn't mean you should share your house keys with every drive by PR contributor, but neither should you treat every PR as if it's coming from Jia Tan.
geraneum 1y ago
> Nobody cares if contributors use an LLM or a magnetic needle to generate code. That’s exactly opposite of what the author is saying. He mentions that [if the code is not good, or you are a beginner] he will help you get to finish line, but if it’s LLM code, he shouldn’t be putting effort because there’s no human on the other side. It makes sense to me.
- blurbleblurble 1y ago
  "but if it’s LLM code, he shouldn’t be putting effort because there’s no human on the other side" That's the false equivalence right there
  - tsimionescu 1y ago
    It's not a false equivalence. You can teach a beginner to become an intermediate (and later a master, if they stick to it). You can't teach an LLM to be better. Every piece of feedback you give to an LLM is like screaming into the void - it wastes your time, and doesn't change the LLM one iota.
    - blurbleblurble 1y ago
      "Every piece of feedback you give to an LLM is like screaming into the void - it wastes your time, and doesn't change the LLM one iota." I think you just haven't gotten the hang of it yet, which is fine... the tooling is very immature and hard to get consistent results with. But this isn't a given. Some people do get good, steerable LLM coding setups.
      - sho_hn 1y ago
        Steering via prompting isn't the same as fundamentally changing the LLM by teaching, as you can do with humans. I think OP understands this better than you.
        blurbleblurble 1y ago
        Can't tell if you're responding in earnest or not here? LLMs are trained to be steerable at inference time via context/prompting. Fine tuning is also possible and often used. Both count as "feedback" in my book, and my point is that both can be effective at "changing the LLM" in terms of its behavior at inference time.
        1y ago
eschaton 1y ago
You’re completely incorrect. People care a lot about where code came from. They need to be able to trust that code you’re contributing was not copied from a project under AGPLv3, if the project you’re contributing to is under a different license. Stop trying to equate LLM-generated code with indexing-based autocomplete. They’re not the same thing at all: LLM-generated code is equivalent to code copied off Stack Overflow, which is also something you’d better not be attempting to fraudulently pass off as your own work.
- koolba 1y ago
  I’m not equating any type of code generation. I’m saying that as a maintainer you have to evaluate any submission on the merits, not on a series of yes/no questions provided by the submitter. And your own judgement is influenced by what you know about the submitter.
  - eschaton 1y ago
    And I’m saying, as a maintainer, you have to and are doing both, even if you don’t think you are. For example, you either make your contributors attest that their changes are original or that they have the right to contribute their changes—or you assume this of them and consider it implicit in their submission. What you (probably) don’t do is welcome contributions that the contributors do not have the right to make.
- fluidcruft 1y ago
  How does an "I didn't use AI" pledge provide any assurance/provenance that submitted code wasn't copied from an AGPLv3 reference?
  - eschaton 1y ago
    It doesn’t, it provides an assurance (but not provenance) you didn’t use AI. Assuring you didn’t include any AGPLv3 code in your contribution is exactly the same kind of assurance. It also doesn’t provide any provenance. Conflating assurance with provenance is bogus because the former is about making a representation that, if false, exposes the person making it to liability. For most situations that’s sufficient that provenance isn’t needed.

by koolba 1y ago

falcor84 1y ago

Trust is absolutely a thing. Maintaining an open source project is an unreasonably demanding and thankless job, and it would be even more so if you had to treat every single PR as if it's a high likelihood supply-chain attack.

fnimick 1y ago
While true, we really should be treating every single piece of external code as though it's malicious.
- tsimionescu 1y ago
  No, we shouldn't. We live in a society, and that level of distrust is not just unrealistic, it's disastrous. This doesn't mean you should share your house keys with every drive by PR contributor, but neither should you treat every PR as if it's coming from Jia Tan.

geraneum 1y ago

> Nobody cares if contributors use an LLM or a magnetic needle to generate code. That’s exactly opposite of what the author is saying. He mentions that [if the code is not good, or you are a beginner] he will help you get to finish line, but if it’s LLM code, he shouldn’t be putting effort because there’s no human on the other side. It makes sense to me.

blurbleblurble 1y ago
"but if it’s LLM code, he shouldn’t be putting effort because there’s no human on the other side" That's the false equivalence right there
- tsimionescu 1y ago
  It's not a false equivalence. You can teach a beginner to become an intermediate (and later a master, if they stick to it). You can't teach an LLM to be better. Every piece of feedback you give to an LLM is like screaming into the void - it wastes your time, and doesn't change the LLM one iota.
  - blurbleblurble 1y ago
    "Every piece of feedback you give to an LLM is like screaming into the void - it wastes your time, and doesn't change the LLM one iota." I think you just haven't gotten the hang of it yet, which is fine... the tooling is very immature and hard to get consistent results with. But this isn't a given. Some people do get good, steerable LLM coding setups.
    - sho_hn 1y ago
      Steering via prompting isn't the same as fundamentally changing the LLM by teaching, as you can do with humans. I think OP understands this better than you.
      - blurbleblurble 1y ago
        Can't tell if you're responding in earnest or not here? LLMs are trained to be steerable at inference time via context/prompting. Fine tuning is also possible and often used. Both count as "feedback" in my book, and my point is that both can be effective at "changing the LLM" in terms of its behavior at inference time.
        1y ago

eschaton 1y ago

You’re completely incorrect. People care a lot about where code came from. They need to be able to trust that code you’re contributing was not copied from a project under AGPLv3, if the project you’re contributing to is under a different license. Stop trying to equate LLM-generated code with indexing-based autocomplete. They’re not the same thing at all: LLM-generated code is equivalent to code copied off Stack Overflow, which is also something you’d better not be attempting to fraudulently pass off as your own work.

koolba 1y ago
I’m not equating any type of code generation. I’m saying that as a maintainer you have to evaluate any submission on the merits, not on a series of yes/no questions provided by the submitter. And your own judgement is influenced by what you know about the submitter.
- eschaton 1y ago
  And I’m saying, as a maintainer, you have to and are doing both, even if you don’t think you are. For example, you either make your contributors attest that their changes are original or that they have the right to contribute their changes—or you assume this of them and consider it implicit in their submission. What you (probably) don’t do is welcome contributions that the contributors do not have the right to make.
fluidcruft 1y ago
How does an "I didn't use AI" pledge provide any assurance/provenance that submitted code wasn't copied from an AGPLv3 reference?
- eschaton 1y ago
  It doesn’t, it provides an assurance (but not provenance) you didn’t use AI. Assuring you didn’t include any AGPLv3 code in your contribution is exactly the same kind of assurance. It also doesn’t provide any provenance. Conflating assurance with provenance is bogus because the former is about making a representation that, if false, exposes the person making it to liability. For most situations that’s sufficient that provenance isn’t needed.