10 ms·

The fate of "small" open source

295 points by todsacerdoti 1y ago

RyanHamilton 1y ago
Less incentive to write small libraries. Less incentive to write small tutorials on your own website. Unless you are a hacker or a spammer where your incentives have probably increased. We are entering the era of cheap spam of everything with little incentive for quality. All this for the best case outcome of most people being made unemployed and rolling the dice on society reorganising to that reality.
- zwnow 1y ago
  But some webdev said they are 10x faster now so it cant be bad for humanity /s
  - _heimdall 1y ago
    They must be slackers, I heard from multiple sources that AI makes you a 100x developer.
    - zwnow 1y ago
      So this is why all the leading AI companies normalize 72 hour weeks.
      - _heimdall 1y ago
        Code reviews when generating 100x lines of code must be tiring.
- phoronixrly 1y ago
  > We are entering the era of cheap spam of everything with little incentive for quality Correction -- sadly, we're already well within this era
- NitpickLawyer 1y ago
  > or a spammer where your incentives have probably increased. Slight pushback on this. The web has been spammed with subpar tutorials for ages now. The kind of medium "articles" that are nothing more than "getting started" steps + slop that got popular circa 2017-2019 is imo worse than the listy-boldy-emojy-filled articles that the LLMs come up with. So nothing gained, nothing lost imo. You still have to learn how to skim and get signals quickly. I'd actually argue that now it's easier to winnow the slop. I can point my cc running in a devcontainer to a "tutorial" or lib / git repo and say something like "implement this as an example covering x and y, success condition is this and that, I want it to work like this, etc.", and come back and see if it works. It's like a litmus test of a tutorial/approach/repo. Can my cc understand it? Then it'll be worth my time looking into it. If it can't, well, find a different one. I think we're seeing the "low hanging fruit" of slop right now, and there's an overcorrection of attitude against "AI". But I also see that I get more and more workflows working for me, more or less tailored, more or less adapted for me and my uses. That's cool. And it's powered by the same underlying tech.
  - NegativeK 1y ago
    The problem isn't that AI slop is doing something new. Phishing, blogspam, time wasting PRs, website scraping, etc have all existed before. The problem is that AI makes all of that far, far easier. Even using tooling to filter articles doesn't scale as slop grows to be a larger and larger percentage of content, and it means I'm going to have to consider prompt injections and running arbitrary code. All of this is a race to the bottom of suck.
    - Pet_Ant 1y ago
      > The problem isn't that AI slop is doing something new. Phishing, blogspam, time wasting PRs, website scraping, etc have all existed before. The problem is that AI makes all of that far, far easier. The term I like is that AI has _industrialised_ those behaviours. While native hunted buffalo, it wasn't destructive until it was industrialised [1] it that it became truly destructive. [1] https://allthatsinteresting.com/buffalo-slaughter https://allthatsinteresting.com/buffalo-slaughter
- weitendorf 1y ago
  [flagged]
  - llbbdd 1y ago
    Upvoting because it's a salient point and downvoters are mad. HN has a complex lately.
    - bakugo 1y ago
      It's not a "salient point", it's a ridiculous strawman that has almost nothing to do with the topic being discussed.
    - imtringued 1y ago
      The context is literally this: >Less incentive to write small libraries. Less incentive to write small tutorials on your own website. What weitendorf posted is definitively not a library, nor is there a small tutorial for the code. >Unless you are a hacker or a spammer where your incentives have probably increased. We are entering the era of cheap spam of everything with little incentive for quality. Considering the low effort to post and high effort to understand what weitendorf wrote, he might be considered a spammer given the context. The code quality is also low since his application can easily be replicated by a bunch of echo calls in a bash script, making me lean towards thinking he is a low quality spammer, given the context. >All this for the best case outcome of most people being made unemployed and rolling the dice on society reorganising to that reality. I'm not sure you can argue that weitendorf sufficiently addressed this. He put too much emphasis on an obvious strawman (real programmer) which is completely out of context. Nobody is questioning here whether someone is a programmer or not. There is no gatekeeping whatsoever. You're free to use LLMs. I'll also complain about your use of "salient" here, which generally has two meanings. The first is that something is "eye catching" (making me think more of spam), the second meaning is "relevancy/importance" to a specific thing and that's where weitendorf falls completely flat. Now you might counter and argue that he packaged all of his salient points inside the statement "want to lay off bread-and-butter red-blooded american programmers", then your position is incredibly weak, because you're deflecting from one strawman to another strawman or alternatively, your counterargument will rely heavily on reinterpretation, which again just means the point wasn't salient.
- justarandomname 1y ago
  I was searching a specific niche on Youtube today, and scrolled endlessly trying to find something that wasn't AI generated. Youtube is being completely spammed.
  - TiredOfLife 1y ago
    That was true even before llms
  - skandinaff 1y ago
    On that - naive proposition; shouldn't we establish say "humanTube" - service which would strictly prohibit AI content? With all this AI slop engulfing our web 2.0 - maybe this is the time and place to establish the new web for "nerds" i.e. people who care for the real thing? Just as our current web once was a place for scientists and engineers mostly, maybe we now need something as this? I feel the flaws in my own point, but maybe it's not all hopeless?
    - danielbln 1y ago
      We'll get content that is indistinguishable from human curated content before long, we might even already have that and it's just toupee fallacy making us only see the slop. I'm making no value statement here, just that any sort of curation attempts are probably futile.
    - johnnyanmac 1y ago
      I think by this point that premium services dedicated to quality is going to be the way to avoid the flood of AI slop that's come to us. Premium services mean QA and accountability should anything try to slip through. Closest thing in the YT space would be Nebula, but Nebula's scope is very narrow (by design).
cynicalsecurity 1y ago
He almost got it right. It's not just the fate of small open source. It's the fate of all programmers now. Why hire a programmer when an LLM costs less, works faster and makes less mistakes (OP compliments better error handling, read the article). Unless you are a product owner, you have paying clients that love you and your product and won't simply ditch it in favour of a new clone, you are really screwed.
- RhythmFox 1y ago
  He also points out a pointless type check in a type checked language... Your name is very accurate I must say.
  - jazzypants 1y ago
    That type check is honestly not pointless at all. You can never be certain of your inputs in a web app. The likelihood of that parameter being something other than an arraybuffer is non-zero, and you generally want to have code coverage for that kind of undefined behavior. TypeScript doesn't complain without a reason.
- vanschelven 1y ago
  "when an LLM costs less, works faster and makes less mistakes"... indeed, but it doesn't follow at all that it's the fate of all programmers _now_... at least in my experience none of these things are true ATM.
  - PunchyHamster 1y ago
    Well, at the very least it costs less than asking intern to look for a lib doing something particular and give some examples... still about as accurate as the intern tho.
    - skydhash 1y ago
      How many time has it happened for a company to actually ask an intern for a library?
deleted 1y ago
[deleted]
CuriouslyC 1y ago
Small open source is still valuable, but the bar is higher. If your project is something that's trivial and nobody just thought to do it before you and bothered to do it after, that's probably not going to survive, but if your project is a small focused tool that handles something difficult really well, it's 100% got a future.
- inferiorhuman 1y ago
  Earlier this year I wrote an interpreter for a niche, proprietary binary format. Someone asked if I could open source it so that they could (more easily) run it on NixOS. I declined as I'm just that strongly opposed to my work being used to train AI models and further entrench the enshittification of the internet.
  - m000 1y ago
    Curious: So you only release your interpreter as a binary? Is there some license that explicitly forbids use for AI training? (Although it would probably be unclear if that is really enforceable until someone challenges it.)
    - inferiorhuman 1y ago
      Yep binary only with an eye towards an AGPL release. No, I don't think verbiage in a license would do much.
mccoyb 1y ago
I don’t think open source is going anywhere. It’s posed to get significantly stronger — as the devs which care about it learn how to leverage AI tools to make things that corporate greasemonkeys never had the inspiration to. Low quality code spammers are just marketing themselves for jobs where they can be themselves: soulless and devoid of creative impulse. That’s the thing: open source is the only place where the true value (or lack of value) of these tools can be established — the only place where one can test mettle against metal in a completely unconstrained way. Did you ever want to build a compiler (or an equally complex artifact) but got stuck on various details? Try now. It’s going to stand up something half-baked, and as you refine it, you will learn those details — but you’ll also learn that you can productively use AI to reach past the limits of your knowledge, to make what’s beyond a little more palatable. All the things people say about AI is true to some degree: my take is that some people are rolling the slots to win a CRUD app, and others are trying to use it to do things that they could only imagine before —- and open source tends to be the home of the latter group.
- nowittyusername 1y ago
  True innovation will come from open source for sure. As the developers don't have the same economic incentives to be "safe", "ethical" "profitable" or whatever. large corporations know this and fear this development. That's why i expect a significant lobbying to take hold in USA that will try and make local AI systems illegal. And I think they will be very convincing to the government. Because the government also fears the "peasants" and giving them any true semblance of real AGI like systems. I bet very soon we will start seeing various classifications that will define what is legal and what is not for a citizen to possess or use.
  - pessimizer 1y ago
    > That's why i expect a significant lobbying to take hold in USA that will try and make local AI systems illegal. I think they're going to be using porn and terrorism (as usual) to do that, but also child suicide. I also think they're going to leverage this rhetoric to lock down OSes in general, by making them uninstallable on legally-available hardware unless approved, because approved OSes will only be able to run approved LLMs. Meaning that I think LLMs/generative AI will be the lever to eliminate general-purpose computing. As mobile went, so will desktop. I think this is inevitable. The real question for me is whether China will partner with the west on this, or whether we will be trading Chinese CPUs with each other like contraband in order to run what we want. > any true semblance of real AGI like systems. This is the only part I don't agree with. This isn't going to happen, but I'm not even sure it would be more useful than what we have. We have billions of full AGI machines walking around, and most of them aren't great. I'm talking about restrictions on something technically barely better than what we have now; maybe only a significant bit more compute-efficient. Training techniques will probably be where we get the most improvements.
zkmon 1y ago
Open source exists because coding was a significant effort and code was a thing of high value. Unsurprisingly companies hesitated to make the code public and free. All of this is changing now as coding has suddenly become trivial. So, yes, the mission of open source, in general, will be challenged.
levkk 1y ago
Several issues: 1. Reducing dependencies is a wrong success metric. You just end up doing more work yourself, except you can't be an expert in everything, so your code is often strictly worse. 2. Regenerating the same solutions with a probabilistic machine will produce bugs a certain percentage of the time. Dependencies are always the same code (when versioned). 3. Cognitive overhead for human review is higher with LLM-generated libs, for no additional benefit.
- jcelerier 1y ago
  > Reducing dependencies is a wrong success metric. You just end up doing more work yourself Except it's just not true in many cases because of social systems we've built. If I want to ship software to Debian I have to make sure that every single of my 3rdparty dependencies is registered and packaged as a proper debian package - a lot of time it will take much less work to rewrite some code than to get 25 100-lines-of-code micro-libraries accepted into debian.
cactusfrog 1y ago
This author assumes that open sourcing a package only delivers value if is added as a dependency. Publicly sharing code with a permissive license is still useful and a radical idea.
- lanstin 1y ago
  Yeah if I find some (small) unmaintained code I need, I will just copy it (then add in my metrics and logging standards :) It shouldn't be a radical idea, it is how science overall works. Also, as per the educational side, I find in modern software ecosystem, I don't want to learn everything. Excellent new things or dominantly popular new things, sure, but there are a lot of branching paths of what to learn next, and having Claude code whip up a good enough solution is fine and lets me focus on less, more deeply. (Note: I tried leaving this comment on the blog but my phone keyboard never opened despite a lot of clicking, and on mastodon but hit the length limit).
- positron26 1y ago
  Yep. Even just sharing code with any license is valuable. Much I have learned from reading an implementation of code I have never run even once. Solutions to tough problems are an under-recognized form of generosity. This is a point where the lack of alignment between the free beer crowd and those they depend on is all too clear. The free beer enthusiast cannot imagine benefiting from anything other than a finished work. They are concerned about the efficient use of scarce development bandwidth without consciousness of why it is scarce or that it is not theirs to direct. They view solutions without a hot package cache as a form of waste, oblivious to how such solutions expedite the development of all other tools they depend on, commercial or free.
- shevy-java 1y ago
  I do agree with this, but there are some caveats. At the end of the day it is time people invest into a project. And that is often unpaid time. Now, that does not mean it has no value, but it is a trade-off. After about 14 years, for instance, I retired permanently from rubygems.org in 2024 due to the 100k download limit (and now I wouldn't use it after the shameful moves RubyCentral did, as well as the new shiny corporate rules with which I couldn't operate within anyway; it is now a private structure owned by Shopify. Good luck finding people who want to invest their own unpaid spare time into anything tainted by corporations here).
Aperocky 1y ago
> the era of small, low-value libraries like blob-util is over. Thankfully (not against blob-util specifically because I've never intentionally used it), I wouldn't completely blame llms either since languages like Go never had this dependency hell. npm is a security nightmare not just because of npm the package manager, because the culture of the language rewards behavior such as "left-pad". Instead of writing endless utilities for other project to re-use, write actual working things instead - that's where the value/fun is.
- ncruces 1y ago
  But as Go puts it: “A little copying is better than a little dependency.” https://go-proverbs.github.io/ https://go-proverbs.github.io/
  - skydhash 1y ago
    Yep something like blob util could be a blog post or a gist (or several stack overflow answers). And a lot of NPM library falls under that. They always have the anemic standard library of JavaScript forgetting that the C library is even smaller.
  - threatofrain 1y ago
    Copying is just as much dependency, you just have to do maintenance through manual find-and-replace now.
    - msla 1y ago
      If I vendor a dependency that currently works for what my program does, I only have to care about it again if a security hole is discovered in it or if my program changes and the dependency is insufficient in some way. I don't have to worry about the person I'm importing code from going weird or introducing a bug that affects me.
    - jamietanna 1y ago
      Yeah it's the main thing I really dislike about this - how do you make sure you know where it's from? (ie licensing) What if there are updates you need? Are you going to maintain it forever? For some definition of "small piece of code" that may be ok, but also sometimes this is more than folks consider
hnlmorg 1y ago
More likely, what we will see is the decline of low effort projects. The JavaScript/ Typescript ecosystem has been plagued with such packages. But that’s more anomalous to the JS community than it is a systemic problem with open source in general. So if fewer people are including silly dependencies like isEven or leftPad, then I see that as a positive outcome.
BrenBarn 1y ago
> Sure, you could use blob-util, but then you’d be taking on an extra dependency, with unknown performance, maintenance, and supply-chain risks. Use of an AI to write your code is also a form of dependency. When the LLM spits out code and you just dump it in your project with limited vetting, that's not really that different from vendoring a dependency. It has a different set of risks, but it still has risks.
- ronbenton 1y ago
  > and you just dump it in your project with limited vetting Well yes there’s your problem. But people have been doing this with random snippets found on the internet for a while now. The truth is that irresponsibles developers will produce irresponsible code, with or without LLMs
  - fullofideas 1y ago
    > The truth is that irresponsibles developers will produce irresponsible code, with or without LLMs True. But the difference is the scale and ease of doing with code generators. With a few clicks you can add hundreds of lines of code which supposedly does the right thing. While in the past, you would get code snippets for a particular aspect of the problem that you are trying to solve. You still had to figure out how to add it to your code base and somehow make it “work”
    - ninalanyon 1y ago
      Surely in any responsible development environment those hundreds of lines of code still have to be reviewed. Or don't people do code review any more? I suppose one could outsource the code review to an AI, preferably not the one that wrote it though. But if you do that surely you will end up building systems that no one understands at all.
      - fullofideas 1y ago
        Agree. Any reasonable team should have code reviews in place, but an irresponsible coder would push the responsibility of code quality and correctness to code reviewers. They were doing it earlier too, but the scale and scope was much smaller.
smcameron 1y ago
In the U.S., anything machine generated is uncopyrightable. Why would you put uncopyrightable code into your codebase?
- gpm 1y ago
  Why wouldn't you? Your codebase (if you're a business) exists to make you money, people being able to copy some unknown portions of it without further license if they somehow legally get their hands on a copy of it seems entirely irrelevant. PS. I think this is much less clear and much less settled law than you are suggesting.
- siliconpotato 1y ago
  Even worse...unmaintained code. Only the human-written one has a maintainer. The other one plagiariased by AI is instant legacy code
  - exasperaited 1y ago
    > The other one plagiariased by AI is instant legacy code I have used this "instant legacy code" concept before. It's absolutely true, IMO. But people really, really, really hate hearing it.
- ebiester 1y ago
  It's more nuanced. If I even have a few lines I can prove are mine, those parts are copywritable in the same way Pride and Prejudice is public domain but pride and prejudice and zombies is copyrighted.
- hdgvhicv 1y ago
  Autocomplete has been around for decades
- ranger_danger 1y ago
  I think if you dig a little deeper you will find that the answer is not so black and white.
shevy-java 1y ago
> Claude’s version is pretty close to the blob-util version (unsurprising, since it was probably trained on it!). AI are thieves! > I don’t know which direction we’re going in with AI (well, ~80% of us; to the remaining holdouts, I salute you and wish you godspeed!), but I do think it’s a future where we prize instant answers over teaching and understanding. Google ruined its search engine years ago before AI already. The big problem I see is that we have become WAY too dependent on these mega-corporations. Which browser are people using? Typically chrome. An evil company writes the code. And soon it will fire the remaining devs and replace them with AI. Which is kind of fitting. > Even now there’s a movement toward putting documentation in an llms.txt file, so you can just point an agent at it and save your brain cells the effort of deciphering English prose. (Is this even documentation anymore? What is documentation?) Documentation in general sucks. But documentation is also a hard problem. I love examples. Small snippets. FAQs. Well, many projects barely have these. Look at ruby webassembly/wasm or ruby opal. Their documentation is about 99% useless. Or, even worse - rack in ruby. And I did not notice this in the past, in part because e. g. StackOverflow still worked, there were many blogs which helped fill up missing information too. Well all of that is largely gone now or has been slurped up by AI spam. > the era of small, low-value libraries like blob-util is over. They were already on their way out thanks to Node.js and the browser taking on more and more of their functionality (see node:glob, structuredClone, etc.), but LLMs are the final nail in the coffin. I still think they have value, but looking at organisations such as rubygems.org disrupt the ecosystem and bleeding it dry by kicking out small hobbyists, I think there is indeed a trend towards eliminating the silly solo devs who think their unpaid spare time is not worthy of anything at all, yet the big organisations eagerly throw down more and more restrictions onto them (my favourite example is the arbitrary 100k download limit for gems hosted at rubygems.org, but look at the new shiny corporate rules on rubygems.org - this is when corporations take over the infrastructure and control it. Ironically this also happened to pypi and they admit this indirectly: https://blog.pypi.org/posts/2023-05-25-securing-pypi-with-2fa/#isnt-supply-chain-security-a-corporate-concern https://blog.pypi.org/posts/2023-05-25-securing-pypi-with-2f... - of course they deny that corporations control pypi now, but by claiming otherwise they admit it, because this is how hobbyists get eliminated. Just throw more and more restrictions at them without paying them. Sooner or later they decide to do something better with their time.)
w10-1 1y ago
TLDR: [AI promises] a future where we prize instant answers over teaching and understanding But what this article and the comments don't say: open-source is mainly a quality metric. I re-use code from popular open-source repo's in part because others have used it without complaints (or document the bugs), in part because people are embarrassed to write poor-quality open-source so it's above-par code, and in part because if there are issues in this corner of the world, this dependency will solve them over time (and I can watch and wait when I don't have time to fix and contribute). The quality aspect drives me to prefer dependencies over AI when I don't want full ownership, so I'll often ask AI to show open-source projects that do something well. (As an aside, this article is about AI, but AI is so pervasive now as an issue that it doesn't even need saying in the title.)
deleted 1y ago
[deleted]
deleted 1y ago
[deleted]
Levitating 1y ago
I am sure I am not the only one who thinks these micro-dependencies are worthless anyway. You'd be better off just listing the functions in a markdown file for people to copy over than ship an entire package for it. This isn't "small" open source, "small" would be something you put together in a week or weekend. These are like "micro" projects, where more work goes into actually publishing and maintaining the repository than actually writing the library. I like the approach C sometimes takes, with the "tiny header file" type of libraries. Though I guess that also stems from the lack of a central build system.
- eviks 1y ago
  What's your copy& paste solution to security updates?
  - 1718627440 1y ago
    The security maintenance of the ten lines of code I have read and copied into my code is the same as the ten lines of code next to it, that I have written myself.
    - eviks 1y ago
      It can't be the same. The package is public, so you get some benefit of other people reviewing and your tools notifying you of issues. Or do you really mean you ignore all that info?
  - immibis 1y ago
    Does left-pad have security updates? You may as well ask what's the security update solution for Stack Overflow answers.
    - eviks 1y ago
      Does every single small package have a guaranteed security profile of left-pad?
- 1y ago
noosphr 1y ago
I see this as an absolute win. The state of micro dependencies of js was a nightmare that only happened because a lot of undereducated developers flooded the market to get that sweet faang money. Now that both have dried up I hope we can close the vault door on js and have people learn how to code again.
- danelski 1y ago
  I don't quite understand your argument. Wasn't the post about how users might replace transparent dependencies with transparent LLM drop-ins? I don't see how having an LLM to do the same job would enable someone to learn more. They're probably the kind of person who will ask the LLM to perform a refactor when problems arise, so they won't learn that much through osmosis.
- SchemaLoad 1y ago
  The best outcome was things like jquery and then lodash where a whole collection of small util functions get rolled in to one package.
  - josephg 1y ago
    Oh god, without tree shaking, lodash is such a blight. I've seen so many tiny packages pull in lodash for some little utility method so many times. 400 bytes of source code becomes 70kb in an instant, all because someone doesn't know how to filter items in an array. And I've also seen plenty of projects which somehow include multiple copies of lodash in their dependency tree. Its such a common junior move. Ugh. Experienced engineers know how to pull in just what they need from lodash. But ... most experienced engineers I know & work with don't bother with it. Javascript includes almost everything you need these days anyway. And when it doesn't, the kind of helper functions lodash provides are usually about 4 lines of code to write yourself. Much better to do that manually rather than pull in some 70kb dependency.
    - SchemaLoad 1y ago
      I agree the JS standard library includes most of the stuff you need these days, rendering jquery and half of lodash irrelevant now. But there's still a lot of useful utilities in lodash, and potentially a new project could curate a collection of new, still relevant utilities.
anonzzzies 1y ago
I would have and did write this instead of including it anyway. These small npms you would spend more time to look up than write are a pest.
ef2k 1y ago
> I’m still trying to figure out what kinds of open source are worth writing in this new era Is there any upside to opensourcing anything anymore? Anything published today becomes training data for the next model, with no attribution to the original work. If the goal is to experiment, share ideas, or let others learn from the work, maybe the better default now is "source available", instead of FOSS in the classic sense. It gives people visibility while setting clearer boundaries on how the work can be used. I learned most of what I know thanks to FOSS projects so I'm still on the fence on this.
- xgulfie 1y ago
  Sorry but source-available is probably going to get slurped up for training data as well Microsoft already did this for all code in every public repo.
  - pabs3 1y ago
    When are they going to start doing it for private repos too...
    - johnnyanmac 1y ago
      I wuldn't discount it already happening. They do own the most popular code hosing repository, after all.
- justarandomname 1y ago
  This is kinda how I've felt for months. I don't have any interest in continuing existing open source projects and don't want to create any new ones. What's the point? All of my personal projects for the past few months have been entirely private, I don't even host them on Github anymore, I have a private Forgejo instance I use instead. I also don't trust any new open source project I stumble upon anymore unless I know it was started at least a year ago.
- 1gn15 1y ago
  Staying true to free software principles. It's unethical to publish nonfree code or binaries.
matheusmoreira 1y ago
> I don’t know which direction we’re going in with AI Maybe programming languages will be designed for AIs in the future. Maybe they'll have features that make grafting unknown generated code easier.
- AlexandrB 1y ago
  Will we ever even get a widespread new programming language? AIs work great for coding because they have massive codebases in C/C++/Python/JS/etc. to train on. If I create a language called "foo" tomorrow, no such codebase will exist for it and the lack of AI support for the language will be a huge barrier for adoption so it's going to be much less likely to catch on like Python did back in the day.
  - matheusmoreira 1y ago
    I'm working on my own lisp. I've used ChatGPT to generate some cases for my test suite. Somehow it can generate decent code if I instruct it thoroughly enough and provide samples. Maybe the fact all lisps have similar syntax helps?
rglover 1y ago
> Even now there’s a movement toward putting documentation in an llms.txt file, so you can just point an agent at it and save your brain cells the effort of deciphering English prose. (Is this even documentation anymore? What is documentation?) I look at it as why not have the best of both worlds? The docs for my JS framework all have the option of being returned as LLM-friendly text [1]. When I utilize this myself, it's to get help fleshing out skeleton code inside of an app built w/ my framework (e.g, Claude Sonnet w/ these docs in context build a nearly ~90-100% accurate implementation for most stuff I throw at it—anything from little lib stuff up to full-blown API endpoint design and even framework-level implementations of small stuff like helping to refactor the built-in middleware loading). It's not for a lack of desire to read, but rather a lack of desire to build every little thing from scratch when I know an LLM is perfectly capable (and much faster than me). [1] https://docs.cheatcode.co/joystick/ui/component/dynamic-pages?llm=true https://docs.cheatcode.co/joystick/ui/component/dynamic-page...
meken 1y ago
> ….but I do think it’s a future where we prize instant answers over teaching and understanding It depends. For stuff I don’t care about I’m happy to treat it as a black box. Conversely, AI now allows me to do deep dive on essentially anything I’m interested in, which has been a massive boon to my learning ability.
meken 1y ago
It would be a cool feature of AI to include only the subset of the library you use and nothing else.
marcus_holmes 1y ago
I don't buy the education angle. If you're not learning to code, then you want efficient code, so the comments are wasted bytes (ok, not a huge expense, but still). If you are learning to code, or just want to understand how this code works, then asking an LLM is going to get a lot better result. LLMs are fantastic tutors. Endlessly patient, go down any rabbit hole with you, will continue explaining a concept until you get it, etc. I think they're going to revolutionise education, especially for practical subjects like coding. Respect to the author for trying to educate, though.
- joeblubaugh 1y ago
  > so the comments are wasted bytes Is there any modern compiler where the output code has anything to do with the comments in the source?
- deleted 1y ago
  [deleted]
tanin 1y ago
Right now I tend to not use an external library unless the code would be large e.g. http server and/or the library is extremely popular. Otherwise, writing it myself is much better. It's more customizable and often much smaller in size. This is because the library has to generalize, and it comes with bloats. Using AI to help write is great because I should understand that anyway whether AI writes it or not or whether it's in an external library. One example recently is that I built a virtual list myself. The code is much smaller and simpler compared to other popular libraries. But of course it's not as generalizable.
eviks 1y ago
I suppose some people would see this as progress: fewer dependencies, more robust code (even if it’s a bit more verbose), quicker turnaround time than the old “search npm, find a package, read the docs, install it” approach. Why would randomized code be more robust? Also, how is searching/reading the docs slower than checking the correctness of a randomized function?
Waterluvian 1y ago
AI offering the solution for a small problem that probably doesn’t deserve yet another dependency suggests to me that there’s a middle ground that we’ve failed to sufficiently cover: how to socialize code snippets that you’re meant to just inline into your project. Stack Overflow is probably the closest we’ve gotten to a generalized solution and it doesn’t exactly feel like a good one. I came across this once before in the form of a react hooks library that had no dependency to install. It was just a website and when you found the hook you wanted you were meant to paste it into your project.
- jcgl 1y ago
  GitHub gists are probably the best technical option. They come with versioning (I think), and have comment threads.
  - Waterluvian 1y ago
    And a decent API as well. I think what’s missing is some amount of organization to make them more discoverable.
honestabraham 1y ago
I think this applies to more than just small open source projects.
strogonoff 1y ago
Chances are, even if you deliberately and strategically pick to work on an OSS project that you are positively sure an LLM can’t just spit out on command, it will be capable of doing so by the time you are close to completion. In that sense, one has to either be not inclined to question “what’s the point” or have a bit of gambling mentality in order to work on anything substantial. That’s not automatically a problem, however. The problem is that even if you do come up with a really cool idea that LLM is not capable of autocompleting, and you release it under a copyleft license (to ensure the project survives and volunteer contributor’s work is not adopted and extinguished by some commercial interest), it will get incorporated into its dataset regardless of the licensing, and thereafter the LLM will be capable of spitting it out and its large corporate operator will be able to monetise your code (allowing anyone with money wishing to build a commercial product based on it).
hamdouni 1y ago
The main point isn't about dependencies but loosing the mindset to learn from small domain problem
willtemperley 1y ago
LLMs give us the opportunity to work on more complex projects and gain fuller understanding of the problem space and concepts. Or create tons of slop. Take your pick.
p0w3n3d 1y ago
Given that some 80% of developers are now using AI in their regular work, blob-util is almost certainly the kind of thing that most developers would just happily have an LLM generate for them. Sure, you could use blob-util, but then you’d be taking on an extra dependency, with unknown performance, maintenance, and supply-chain risks. Letting LLM write utility code is a sword that cuts both ways. You often create a throw-away code that is unproven and requires maintenance. It's not a guarantee that the blobutil or toString or whatever created by AI won't fail at some edge cases. That's why e.g. in Java there is Apache commons which is perceived as an industry standard nowadays.
- jaapz 1y ago
  Exactly. When you assume blob-util to be a utility library that has been in use for quite a while by many people in many different contexts, hasn't seen much changes and just "works", IMHO the risk of weird bugs is a lot larger with LLM-generated code. Code generated by LLM's often have the problem that the code seems logical, but then contain weird bugs that aren't immediately obvious.
  - p0w3n3d 1y ago
    Agreed. The code available in e.g. Apache commons is not perfect, but it's seasoned and has the edge cases documented
- Menschlio 1y ago
  The proper way to do it, would be to have an industry standard on the default things people blindly but massivly pull through dependencies. I also don't get how code can be so massivly inefficient. left-pad needs 9kb to download and the code is a handful of lines: https://www.npmjs.com/package/left-pad?activeTab=code https://www.npmjs.com/package/left-pad?activeTab=code If my unit tests run through, i don't have 'unproven' code. I have well working code which doesn't need to go through a dependency hell upgrade cycle just because one function in that lib, i don't use, has some CVE too high to be ignored.
- safety1st 1y ago
  This mostly sounds like a good thing to me from a utilitarian standpoint. Getting all your utility classes from somewhere like npm and creating dependencies on 20 different people and organizations who may or may not maintain their software has been a security nightmare with many highly public examples. If a LLM writes a utility class for me then my supply chain is smaller, meaning less surface area to attack plus I probably benefit from some form of security through obscurity for whatever non-trivial amount that's worth. "Downside" is I don't have some rando, probably unpaid labor out there updating a piece of my app for me...
kunley 1y ago
The level of apologetism with regard to ai is depressing in this article.
stevage 1y ago
>Many software developers will argue that asking a candidate to reverse a binary tree is pointless Is "reversing a binary tree" actually a thing, or is this a cute kind of "rocket surgery" phrase intentionally mixing reversing a linked list and searching a binary tree?
- stingraycharles 1y ago
  It’s probably a mistake on the author’s end, but the problem comes across anyway. I can only imagine reversing a binary tree would imply changing the “<“ comparison in nodes to “>” which would be a useless exercise
- nitnelave 1y ago
  I think it's a reference to the Google interview problem that the author of Homebrew (IIRC) failed. They were quite upset about it since they have proved their worth through their famous open-source contributions, but got rejected in a LeetCode-like interview.
Sarah6666 1y ago
[dead]
jasonjmcghee 1y ago
> it’s a future where we prize instant answers over teaching and understanding It doesn't have to be this way- coupled with verification (to mitigate hallucination), llms can help so much with personal education. It's a purely judgement free environment and for a lot of people that's incredibly meaningful.
dominicrose 1y ago
Node.js's core library is purposefully minimal. Purposefully or not, it's still an issue. Wether you add many small things to your project using an LLM or NPM, it still requires work and the annoying thing is that you'll have to do it for every new Node.js project. Node.js is very good for IO and it has decent performance even for CPU-intensive work considering it's a dynamic language, but it would sure be nice to have a rich core library like Ruby or Clojure has. The fact that ClojureScript can do it proves that it's doable even for front-end javascript (using advanced optimisations).
NoSalt 1y ago
Bleak
layer8 1y ago
This seems to be specific to the JavaScript ecosystem, and to some extent orthogonal to AI coding. Micro-libraries with trivial-ish functionality are generally more difficult to justify to add as a dependency. I’m sure AI coding agents will eventually learn as well that there’s a balance to strike between implementing stuff yourself and the use of libraries. I’m also sure that people who are interested in actual coding will continue to open-source what they find useful, and other people like them will read their code.
mb2100 1y ago
I totally agree that the goal should be teaching. But I do wonder which code someone is more likely to actually read and understand: the LLM-generated one in their own codebase, or the one hidden in some npm package they installed to just ship things. I honestly don’t know. Careless devs probably won’t read either as long as it seems to work I’ve been trying to encourage forking my libraries, or have people just copy them into their codebase and adapt them, e.g. https://github.com/mastrojs/mastro/ https://github.com/mastrojs/mastro/ (especially the “extension” libs.) But it’s an uphill battle against the culture of convenience over understanding.
lsferreira42 1y ago
Now way more than before, i value my feed collection because i know all these blogs are human written, some of them got a post every year, but it is always good quality and human written.

295 points by todsacerdoti 1y ago

Less incentive to write small libraries. Less incentive to write small tutorials on your own website. Unless you are a hacker or a spammer where your incentives have probably increased. We are entering the era of cheap spam of everything with little incentive for quality. All this for the best case outcome of most people being made unemployed and rolling the dice on society reorganising to that reality.

zwnow 1y ago
But some webdev said they are 10x faster now so it cant be bad for humanity /s
- _heimdall 1y ago
  They must be slackers, I heard from multiple sources that AI makes you a 100x developer.
  - zwnow 1y ago
    So this is why all the leading AI companies normalize 72 hour weeks.
    - _heimdall 1y ago
      Code reviews when generating 100x lines of code must be tiring.
phoronixrly 1y ago
> We are entering the era of cheap spam of everything with little incentive for quality Correction -- sadly, we're already well within this era
NitpickLawyer 1y ago
> or a spammer where your incentives have probably increased. Slight pushback on this. The web has been spammed with subpar tutorials for ages now. The kind of medium "articles" that are nothing more than "getting started" steps + slop that got popular circa 2017-2019 is imo worse than the listy-boldy-emojy-filled articles that the LLMs come up with. So nothing gained, nothing lost imo. You still have to learn how to skim and get signals quickly. I'd actually argue that now it's easier to winnow the slop. I can point my cc running in a devcontainer to a "tutorial" or lib / git repo and say something like "implement this as an example covering x and y, success condition is this and that, I want it to work like this, etc.", and come back and see if it works. It's like a litmus test of a tutorial/approach/repo. Can my cc understand it? Then it'll be worth my time looking into it. If it can't, well, find a different one. I think we're seeing the "low hanging fruit" of slop right now, and there's an overcorrection of attitude against "AI". But I also see that I get more and more workflows working for me, more or less tailored, more or less adapted for me and my uses. That's cool. And it's powered by the same underlying tech.
- NegativeK 1y ago
  The problem isn't that AI slop is doing something new. Phishing, blogspam, time wasting PRs, website scraping, etc have all existed before. The problem is that AI makes all of that far, far easier. Even using tooling to filter articles doesn't scale as slop grows to be a larger and larger percentage of content, and it means I'm going to have to consider prompt injections and running arbitrary code. All of this is a race to the bottom of suck.
  - Pet_Ant 1y ago
    > The problem isn't that AI slop is doing something new. Phishing, blogspam, time wasting PRs, website scraping, etc have all existed before. The problem is that AI makes all of that far, far easier. The term I like is that AI has _industrialised_ those behaviours. While native hunted buffalo, it wasn't destructive until it was industrialised [1] it that it became truly destructive. [1] https://allthatsinteresting.com/buffalo-slaughter https://allthatsinteresting.com/buffalo-slaughter
weitendorf 1y ago
[flagged]
- llbbdd 1y ago
  Upvoting because it's a salient point and downvoters are mad. HN has a complex lately.
  - bakugo 1y ago
    It's not a "salient point", it's a ridiculous strawman that has almost nothing to do with the topic being discussed.
  - imtringued 1y ago
    The context is literally this: >Less incentive to write small libraries. Less incentive to write small tutorials on your own website. What weitendorf posted is definitively not a library, nor is there a small tutorial for the code. >Unless you are a hacker or a spammer where your incentives have probably increased. We are entering the era of cheap spam of everything with little incentive for quality. Considering the low effort to post and high effort to understand what weitendorf wrote, he might be considered a spammer given the context. The code quality is also low since his application can easily be replicated by a bunch of echo calls in a bash script, making me lean towards thinking he is a low quality spammer, given the context. >All this for the best case outcome of most people being made unemployed and rolling the dice on society reorganising to that reality. I'm not sure you can argue that weitendorf sufficiently addressed this. He put too much emphasis on an obvious strawman (real programmer) which is completely out of context. Nobody is questioning here whether someone is a programmer or not. There is no gatekeeping whatsoever. You're free to use LLMs. I'll also complain about your use of "salient" here, which generally has two meanings. The first is that something is "eye catching" (making me think more of spam), the second meaning is "relevancy/importance" to a specific thing and that's where weitendorf falls completely flat. Now you might counter and argue that he packaged all of his salient points inside the statement "want to lay off bread-and-butter red-blooded american programmers", then your position is incredibly weak, because you're deflecting from one strawman to another strawman or alternatively, your counterargument will rely heavily on reinterpretation, which again just means the point wasn't salient.
justarandomname 1y ago
I was searching a specific niche on Youtube today, and scrolled endlessly trying to find something that wasn't AI generated. Youtube is being completely spammed.
- TiredOfLife 1y ago
  That was true even before llms
- skandinaff 1y ago
  On that - naive proposition; shouldn't we establish say "humanTube" - service which would strictly prohibit AI content? With all this AI slop engulfing our web 2.0 - maybe this is the time and place to establish the new web for "nerds" i.e. people who care for the real thing? Just as our current web once was a place for scientists and engineers mostly, maybe we now need something as this? I feel the flaws in my own point, but maybe it's not all hopeless?
  - danielbln 1y ago
    We'll get content that is indistinguishable from human curated content before long, we might even already have that and it's just toupee fallacy making us only see the slop. I'm making no value statement here, just that any sort of curation attempts are probably futile.
  - johnnyanmac 1y ago
    I think by this point that premium services dedicated to quality is going to be the way to avoid the flood of AI slop that's come to us. Premium services mean QA and accountability should anything try to slip through. Closest thing in the YT space would be Nebula, but Nebula's scope is very narrow (by design).

cynicalsecurity 1y ago

He almost got it right. It's not just the fate of small open source. It's the fate of all programmers now. Why hire a programmer when an LLM costs less, works faster and makes less mistakes (OP compliments better error handling, read the article). Unless you are a product owner, you have paying clients that love you and your product and won't simply ditch it in favour of a new clone, you are really screwed.

RhythmFox 1y ago
He also points out a pointless type check in a type checked language... Your name is very accurate I must say.
- jazzypants 1y ago
  That type check is honestly not pointless at all. You can never be certain of your inputs in a web app. The likelihood of that parameter being something other than an arraybuffer is non-zero, and you generally want to have code coverage for that kind of undefined behavior. TypeScript doesn't complain without a reason.
vanschelven 1y ago
"when an LLM costs less, works faster and makes less mistakes"... indeed, but it doesn't follow at all that it's the fate of all programmers _now_... at least in my experience none of these things are true ATM.
- PunchyHamster 1y ago
  Well, at the very least it costs less than asking intern to look for a lib doing something particular and give some examples... still about as accurate as the intern tho.
  - skydhash 1y ago
    How many time has it happened for a company to actually ask an intern for a library?

deleted 1y ago

[deleted]

CuriouslyC 1y ago

Small open source is still valuable, but the bar is higher. If your project is something that's trivial and nobody just thought to do it before you and bothered to do it after, that's probably not going to survive, but if your project is a small focused tool that handles something difficult really well, it's 100% got a future.

inferiorhuman 1y ago
Earlier this year I wrote an interpreter for a niche, proprietary binary format. Someone asked if I could open source it so that they could (more easily) run it on NixOS. I declined as I'm just that strongly opposed to my work being used to train AI models and further entrench the enshittification of the internet.
- m000 1y ago
  Curious: So you only release your interpreter as a binary? Is there some license that explicitly forbids use for AI training? (Although it would probably be unclear if that is really enforceable until someone challenges it.)
  - inferiorhuman 1y ago
    Yep binary only with an eye towards an AGPL release. No, I don't think verbiage in a license would do much.

mccoyb 1y ago

I don’t think open source is going anywhere. It’s posed to get significantly stronger — as the devs which care about it learn how to leverage AI tools to make things that corporate greasemonkeys never had the inspiration to. Low quality code spammers are just marketing themselves for jobs where they can be themselves: soulless and devoid of creative impulse. That’s the thing: open source is the only place where the true value (or lack of value) of these tools can be established — the only place where one can test mettle against metal in a completely unconstrained way. Did you ever want to build a compiler (or an equally complex artifact) but got stuck on various details? Try now. It’s going to stand up something half-baked, and as you refine it, you will learn those details — but you’ll also learn that you can productively use AI to reach past the limits of your knowledge, to make what’s beyond a little more palatable. All the things people say about AI is true to some degree: my take is that some people are rolling the slots to win a CRUD app, and others are trying to use it to do things that they could only imagine before —- and open source tends to be the home of the latter group.

nowittyusername 1y ago
True innovation will come from open source for sure. As the developers don't have the same economic incentives to be "safe", "ethical" "profitable" or whatever. large corporations know this and fear this development. That's why i expect a significant lobbying to take hold in USA that will try and make local AI systems illegal. And I think they will be very convincing to the government. Because the government also fears the "peasants" and giving them any true semblance of real AGI like systems. I bet very soon we will start seeing various classifications that will define what is legal and what is not for a citizen to possess or use.
- pessimizer 1y ago
  > That's why i expect a significant lobbying to take hold in USA that will try and make local AI systems illegal. I think they're going to be using porn and terrorism (as usual) to do that, but also child suicide. I also think they're going to leverage this rhetoric to lock down OSes in general, by making them uninstallable on legally-available hardware unless approved, because approved OSes will only be able to run approved LLMs. Meaning that I think LLMs/generative AI will be the lever to eliminate general-purpose computing. As mobile went, so will desktop. I think this is inevitable. The real question for me is whether China will partner with the west on this, or whether we will be trading Chinese CPUs with each other like contraband in order to run what we want. > any true semblance of real AGI like systems. This is the only part I don't agree with. This isn't going to happen, but I'm not even sure it would be more useful than what we have. We have billions of full AGI machines walking around, and most of them aren't great. I'm talking about restrictions on something technically barely better than what we have now; maybe only a significant bit more compute-efficient. Training techniques will probably be where we get the most improvements.

zkmon 1y ago

Open source exists because coding was a significant effort and code was a thing of high value. Unsurprisingly companies hesitated to make the code public and free. All of this is changing now as coding has suddenly become trivial. So, yes, the mission of open source, in general, will be challenged.

levkk 1y ago

Several issues: 1. Reducing dependencies is a wrong success metric. You just end up doing more work yourself, except you can't be an expert in everything, so your code is often strictly worse. 2. Regenerating the same solutions with a probabilistic machine will produce bugs a certain percentage of the time. Dependencies are always the same code (when versioned). 3. Cognitive overhead for human review is higher with LLM-generated libs, for no additional benefit.

jcelerier 1y ago
> Reducing dependencies is a wrong success metric. You just end up doing more work yourself Except it's just not true in many cases because of social systems we've built. If I want to ship software to Debian I have to make sure that every single of my 3rdparty dependencies is registered and packaged as a proper debian package - a lot of time it will take much less work to rewrite some code than to get 25 100-lines-of-code micro-libraries accepted into debian.

cactusfrog 1y ago

This author assumes that open sourcing a package only delivers value if is added as a dependency. Publicly sharing code with a permissive license is still useful and a radical idea.

lanstin 1y ago
Yeah if I find some (small) unmaintained code I need, I will just copy it (then add in my metrics and logging standards :) It shouldn't be a radical idea, it is how science overall works. Also, as per the educational side, I find in modern software ecosystem, I don't want to learn everything. Excellent new things or dominantly popular new things, sure, but there are a lot of branching paths of what to learn next, and having Claude code whip up a good enough solution is fine and lets me focus on less, more deeply. (Note: I tried leaving this comment on the blog but my phone keyboard never opened despite a lot of clicking, and on mastodon but hit the length limit).
positron26 1y ago
Yep. Even just sharing code with any license is valuable. Much I have learned from reading an implementation of code I have never run even once. Solutions to tough problems are an under-recognized form of generosity. This is a point where the lack of alignment between the free beer crowd and those they depend on is all too clear. The free beer enthusiast cannot imagine benefiting from anything other than a finished work. They are concerned about the efficient use of scarce development bandwidth without consciousness of why it is scarce or that it is not theirs to direct. They view solutions without a hot package cache as a form of waste, oblivious to how such solutions expedite the development of all other tools they depend on, commercial or free.
shevy-java 1y ago
I do agree with this, but there are some caveats. At the end of the day it is time people invest into a project. And that is often unpaid time. Now, that does not mean it has no value, but it is a trade-off. After about 14 years, for instance, I retired permanently from rubygems.org in 2024 due to the 100k download limit (and now I wouldn't use it after the shameful moves RubyCentral did, as well as the new shiny corporate rules with which I couldn't operate within anyway; it is now a private structure owned by Shopify. Good luck finding people who want to invest their own unpaid spare time into anything tainted by corporations here).

Aperocky 1y ago

> the era of small, low-value libraries like blob-util is over. Thankfully (not against blob-util specifically because I've never intentionally used it), I wouldn't completely blame llms either since languages like Go never had this dependency hell. npm is a security nightmare not just because of npm the package manager, because the culture of the language rewards behavior such as "left-pad". Instead of writing endless utilities for other project to re-use, write actual working things instead - that's where the value/fun is.

ncruces 1y ago
But as Go puts it: “A little copying is better than a little dependency.” https://go-proverbs.github.io/ https://go-proverbs.github.io/
- skydhash 1y ago
  Yep something like blob util could be a blog post or a gist (or several stack overflow answers). And a lot of NPM library falls under that. They always have the anemic standard library of JavaScript forgetting that the C library is even smaller.
- threatofrain 1y ago
  Copying is just as much dependency, you just have to do maintenance through manual find-and-replace now.
  - msla 1y ago
    If I vendor a dependency that currently works for what my program does, I only have to care about it again if a security hole is discovered in it or if my program changes and the dependency is insufficient in some way. I don't have to worry about the person I'm importing code from going weird or introducing a bug that affects me.
  - jamietanna 1y ago
    Yeah it's the main thing I really dislike about this - how do you make sure you know where it's from? (ie licensing) What if there are updates you need? Are you going to maintain it forever? For some definition of "small piece of code" that may be ok, but also sometimes this is more than folks consider

hnlmorg 1y ago

More likely, what we will see is the decline of low effort projects. The JavaScript/ Typescript ecosystem has been plagued with such packages. But that’s more anomalous to the JS community than it is a systemic problem with open source in general. So if fewer people are including silly dependencies like isEven or leftPad, then I see that as a positive outcome.

BrenBarn 1y ago

> Sure, you could use blob-util, but then you’d be taking on an extra dependency, with unknown performance, maintenance, and supply-chain risks. Use of an AI to write your code is also a form of dependency. When the LLM spits out code and you just dump it in your project with limited vetting, that's not really that different from vendoring a dependency. It has a different set of risks, but it still has risks.

ronbenton 1y ago
> and you just dump it in your project with limited vetting Well yes there’s your problem. But people have been doing this with random snippets found on the internet for a while now. The truth is that irresponsibles developers will produce irresponsible code, with or without LLMs
- fullofideas 1y ago
  > The truth is that irresponsibles developers will produce irresponsible code, with or without LLMs True. But the difference is the scale and ease of doing with code generators. With a few clicks you can add hundreds of lines of code which supposedly does the right thing. While in the past, you would get code snippets for a particular aspect of the problem that you are trying to solve. You still had to figure out how to add it to your code base and somehow make it “work”
  - ninalanyon 1y ago
    Surely in any responsible development environment those hundreds of lines of code still have to be reviewed. Or don't people do code review any more? I suppose one could outsource the code review to an AI, preferably not the one that wrote it though. But if you do that surely you will end up building systems that no one understands at all.
    - fullofideas 1y ago
      Agree. Any reasonable team should have code reviews in place, but an irresponsible coder would push the responsibility of code quality and correctness to code reviewers. They were doing it earlier too, but the scale and scope was much smaller.

smcameron 1y ago

In the U.S., anything machine generated is uncopyrightable. Why would you put uncopyrightable code into your codebase?

gpm 1y ago
Why wouldn't you? Your codebase (if you're a business) exists to make you money, people being able to copy some unknown portions of it without further license if they somehow legally get their hands on a copy of it seems entirely irrelevant. PS. I think this is much less clear and much less settled law than you are suggesting.
siliconpotato 1y ago
Even worse...unmaintained code. Only the human-written one has a maintainer. The other one plagiariased by AI is instant legacy code
- exasperaited 1y ago
  > The other one plagiariased by AI is instant legacy code I have used this "instant legacy code" concept before. It's absolutely true, IMO. But people really, really, really hate hearing it.
ebiester 1y ago
It's more nuanced. If I even have a few lines I can prove are mine, those parts are copywritable in the same way Pride and Prejudice is public domain but pride and prejudice and zombies is copyrighted.
hdgvhicv 1y ago
Autocomplete has been around for decades
ranger_danger 1y ago
I think if you dig a little deeper you will find that the answer is not so black and white.

shevy-java 1y ago

> Claude’s version is pretty close to the blob-util version (unsurprising, since it was probably trained on it!). AI are thieves! > I don’t know which direction we’re going in with AI (well, ~80% of us; to the remaining holdouts, I salute you and wish you godspeed!), but I do think it’s a future where we prize instant answers over teaching and understanding. Google ruined its search engine years ago before AI already. The big problem I see is that we have become WAY too dependent on these mega-corporations. Which browser are people using? Typically chrome. An evil company writes the code. And soon it will fire the remaining devs and replace them with AI. Which is kind of fitting. > Even now there’s a movement toward putting documentation in an llms.txt file, so you can just point an agent at it and save your brain cells the effort of deciphering English prose. (Is this even documentation anymore? What is documentation?) Documentation in general sucks. But documentation is also a hard problem. I love examples. Small snippets. FAQs. Well, many projects barely have these. Look at ruby webassembly/wasm or ruby opal. Their documentation is about 99% useless. Or, even worse - rack in ruby. And I did not notice this in the past, in part because e. g. StackOverflow still worked, there were many blogs which helped fill up missing information too. Well all of that is largely gone now or has been slurped up by AI spam. > the era of small, low-value libraries like blob-util is over. They were already on their way out thanks to Node.js and the browser taking on more and more of their functionality (see node:glob, structuredClone, etc.), but LLMs are the final nail in the coffin. I still think they have value, but looking at organisations such as rubygems.org disrupt the ecosystem and bleeding it dry by kicking out small hobbyists, I think there is indeed a trend towards eliminating the silly solo devs who think their unpaid spare time is not worthy of anything at all, yet the big organisations eagerly throw down more and more restrictions onto them (my favourite example is the arbitrary 100k download limit for gems hosted at rubygems.org, but look at the new shiny corporate rules on rubygems.org - this is when corporations take over the infrastructure and control it. Ironically this also happened to pypi and they admit this indirectly: https://blog.pypi.org/posts/2023-05-25-securing-pypi-with-2fa/#isnt-supply-chain-security-a-corporate-concern https://blog.pypi.org/posts/2023-05-25-securing-pypi-with-2f... - of course they deny that corporations control pypi now, but by claiming otherwise they admit it, because this is how hobbyists get eliminated. Just throw more and more restrictions at them without paying them. Sooner or later they decide to do something better with their time.)

w10-1 1y ago

TLDR: [AI promises] a future where we prize instant answers over teaching and understanding But what this article and the comments don't say: open-source is mainly a quality metric. I re-use code from popular open-source repo's in part because others have used it without complaints (or document the bugs), in part because people are embarrassed to write poor-quality open-source so it's above-par code, and in part because if there are issues in this corner of the world, this dependency will solve them over time (and I can watch and wait when I don't have time to fix and contribute). The quality aspect drives me to prefer dependencies over AI when I don't want full ownership, so I'll often ask AI to show open-source projects that do something well. (As an aside, this article is about AI, but AI is so pervasive now as an issue that it doesn't even need saying in the title.)

deleted 1y ago

[deleted]

deleted 1y ago

[deleted]

Levitating 1y ago

I am sure I am not the only one who thinks these micro-dependencies are worthless anyway. You'd be better off just listing the functions in a markdown file for people to copy over than ship an entire package for it. This isn't "small" open source, "small" would be something you put together in a week or weekend. These are like "micro" projects, where more work goes into actually publishing and maintaining the repository than actually writing the library. I like the approach C sometimes takes, with the "tiny header file" type of libraries. Though I guess that also stems from the lack of a central build system.

eviks 1y ago
What's your copy& paste solution to security updates?
- 1718627440 1y ago
  The security maintenance of the ten lines of code I have read and copied into my code is the same as the ten lines of code next to it, that I have written myself.
  - eviks 1y ago
    It can't be the same. The package is public, so you get some benefit of other people reviewing and your tools notifying you of issues. Or do you really mean you ignore all that info?
- immibis 1y ago
  Does left-pad have security updates? You may as well ask what's the security update solution for Stack Overflow answers.
  - eviks 1y ago
    Does every single small package have a guaranteed security profile of left-pad?
1y ago

noosphr 1y ago

I see this as an absolute win. The state of micro dependencies of js was a nightmare that only happened because a lot of undereducated developers flooded the market to get that sweet faang money. Now that both have dried up I hope we can close the vault door on js and have people learn how to code again.

danelski 1y ago
I don't quite understand your argument. Wasn't the post about how users might replace transparent dependencies with transparent LLM drop-ins? I don't see how having an LLM to do the same job would enable someone to learn more. They're probably the kind of person who will ask the LLM to perform a refactor when problems arise, so they won't learn that much through osmosis.
SchemaLoad 1y ago
The best outcome was things like jquery and then lodash where a whole collection of small util functions get rolled in to one package.
- josephg 1y ago
  Oh god, without tree shaking, lodash is such a blight. I've seen so many tiny packages pull in lodash for some little utility method so many times. 400 bytes of source code becomes 70kb in an instant, all because someone doesn't know how to filter items in an array. And I've also seen plenty of projects which somehow include multiple copies of lodash in their dependency tree. Its such a common junior move. Ugh. Experienced engineers know how to pull in just what they need from lodash. But ... most experienced engineers I know & work with don't bother with it. Javascript includes almost everything you need these days anyway. And when it doesn't, the kind of helper functions lodash provides are usually about 4 lines of code to write yourself. Much better to do that manually rather than pull in some 70kb dependency.
  - SchemaLoad 1y ago
    I agree the JS standard library includes most of the stuff you need these days, rendering jquery and half of lodash irrelevant now. But there's still a lot of useful utilities in lodash, and potentially a new project could curate a collection of new, still relevant utilities.

anonzzzies 1y ago

I would have and did write this instead of including it anyway. These small npms you would spend more time to look up than write are a pest.

ef2k 1y ago

> I’m still trying to figure out what kinds of open source are worth writing in this new era Is there any upside to opensourcing anything anymore? Anything published today becomes training data for the next model, with no attribution to the original work. If the goal is to experiment, share ideas, or let others learn from the work, maybe the better default now is "source available", instead of FOSS in the classic sense. It gives people visibility while setting clearer boundaries on how the work can be used. I learned most of what I know thanks to FOSS projects so I'm still on the fence on this.

xgulfie 1y ago
Sorry but source-available is probably going to get slurped up for training data as well Microsoft already did this for all code in every public repo.
- pabs3 1y ago
  When are they going to start doing it for private repos too...
  - johnnyanmac 1y ago
    I wuldn't discount it already happening. They do own the most popular code hosing repository, after all.
justarandomname 1y ago
This is kinda how I've felt for months. I don't have any interest in continuing existing open source projects and don't want to create any new ones. What's the point? All of my personal projects for the past few months have been entirely private, I don't even host them on Github anymore, I have a private Forgejo instance I use instead. I also don't trust any new open source project I stumble upon anymore unless I know it was started at least a year ago.
1gn15 1y ago
Staying true to free software principles. It's unethical to publish nonfree code or binaries.

matheusmoreira 1y ago

> I don’t know which direction we’re going in with AI Maybe programming languages will be designed for AIs in the future. Maybe they'll have features that make grafting unknown generated code easier.

AlexandrB 1y ago
Will we ever even get a widespread new programming language? AIs work great for coding because they have massive codebases in C/C++/Python/JS/etc. to train on. If I create a language called "foo" tomorrow, no such codebase will exist for it and the lack of AI support for the language will be a huge barrier for adoption so it's going to be much less likely to catch on like Python did back in the day.
- matheusmoreira 1y ago
  I'm working on my own lisp. I've used ChatGPT to generate some cases for my test suite. Somehow it can generate decent code if I instruct it thoroughly enough and provide samples. Maybe the fact all lisps have similar syntax helps?

rglover 1y ago

> Even now there’s a movement toward putting documentation in an llms.txt file, so you can just point an agent at it and save your brain cells the effort of deciphering English prose. (Is this even documentation anymore? What is documentation?) I look at it as why not have the best of both worlds? The docs for my JS framework all have the option of being returned as LLM-friendly text [1]. When I utilize this myself, it's to get help fleshing out skeleton code inside of an app built w/ my framework (e.g, Claude Sonnet w/ these docs in context build a nearly ~90-100% accurate implementation for most stuff I throw at it—anything from little lib stuff up to full-blown API endpoint design and even framework-level implementations of small stuff like helping to refactor the built-in middleware loading). It's not for a lack of desire to read, but rather a lack of desire to build every little thing from scratch when I know an LLM is perfectly capable (and much faster than me). [1] https://docs.cheatcode.co/joystick/ui/component/dynamic-pages?llm=true https://docs.cheatcode.co/joystick/ui/component/dynamic-page...

meken 1y ago

> ….but I do think it’s a future where we prize instant answers over teaching and understanding It depends. For stuff I don’t care about I’m happy to treat it as a black box. Conversely, AI now allows me to do deep dive on essentially anything I’m interested in, which has been a massive boon to my learning ability.

meken 1y ago

It would be a cool feature of AI to include only the subset of the library you use and nothing else.

marcus_holmes 1y ago

I don't buy the education angle. If you're not learning to code, then you want efficient code, so the comments are wasted bytes (ok, not a huge expense, but still). If you are learning to code, or just want to understand how this code works, then asking an LLM is going to get a lot better result. LLMs are fantastic tutors. Endlessly patient, go down any rabbit hole with you, will continue explaining a concept until you get it, etc. I think they're going to revolutionise education, especially for practical subjects like coding. Respect to the author for trying to educate, though.

joeblubaugh 1y ago
> so the comments are wasted bytes Is there any modern compiler where the output code has anything to do with the comments in the source?
deleted 1y ago
[deleted]

tanin 1y ago

Right now I tend to not use an external library unless the code would be large e.g. http server and/or the library is extremely popular. Otherwise, writing it myself is much better. It's more customizable and often much smaller in size. This is because the library has to generalize, and it comes with bloats. Using AI to help write is great because I should understand that anyway whether AI writes it or not or whether it's in an external library. One example recently is that I built a virtual list myself. The code is much smaller and simpler compared to other popular libraries. But of course it's not as generalizable.

eviks 1y ago

I suppose some people would see this as progress: fewer dependencies, more robust code (even if it’s a bit more verbose), quicker turnaround time than the old “search npm, find a package, read the docs, install it” approach. Why would randomized code be more robust? Also, how is searching/reading the docs slower than checking the correctness of a randomized function?

Waterluvian 1y ago

AI offering the solution for a small problem that probably doesn’t deserve yet another dependency suggests to me that there’s a middle ground that we’ve failed to sufficiently cover: how to socialize code snippets that you’re meant to just inline into your project. Stack Overflow is probably the closest we’ve gotten to a generalized solution and it doesn’t exactly feel like a good one. I came across this once before in the form of a react hooks library that had no dependency to install. It was just a website and when you found the hook you wanted you were meant to paste it into your project.

jcgl 1y ago
GitHub gists are probably the best technical option. They come with versioning (I think), and have comment threads.
- Waterluvian 1y ago
  And a decent API as well. I think what’s missing is some amount of organization to make them more discoverable.

honestabraham 1y ago

I think this applies to more than just small open source projects.

strogonoff 1y ago

Chances are, even if you deliberately and strategically pick to work on an OSS project that you are positively sure an LLM can’t just spit out on command, it will be capable of doing so by the time you are close to completion. In that sense, one has to either be not inclined to question “what’s the point” or have a bit of gambling mentality in order to work on anything substantial. That’s not automatically a problem, however. The problem is that even if you do come up with a really cool idea that LLM is not capable of autocompleting, and you release it under a copyleft license (to ensure the project survives and volunteer contributor’s work is not adopted and extinguished by some commercial interest), it will get incorporated into its dataset regardless of the licensing, and thereafter the LLM will be capable of spitting it out and its large corporate operator will be able to monetise your code (allowing anyone with money wishing to build a commercial product based on it).

hamdouni 1y ago

The main point isn't about dependencies but loosing the mindset to learn from small domain problem

willtemperley 1y ago

LLMs give us the opportunity to work on more complex projects and gain fuller understanding of the problem space and concepts. Or create tons of slop. Take your pick.

p0w3n3d 1y ago

Given that some 80% of developers are now using AI in their regular work, blob-util is almost certainly the kind of thing that most developers would just happily have an LLM generate for them. Sure, you could use blob-util, but then you’d be taking on an extra dependency, with unknown performance, maintenance, and supply-chain risks. Letting LLM write utility code is a sword that cuts both ways. You often create a throw-away code that is unproven and requires maintenance. It's not a guarantee that the blobutil or toString or whatever created by AI won't fail at some edge cases. That's why e.g. in Java there is Apache commons which is perceived as an industry standard nowadays.

jaapz 1y ago
Exactly. When you assume blob-util to be a utility library that has been in use for quite a while by many people in many different contexts, hasn't seen much changes and just "works", IMHO the risk of weird bugs is a lot larger with LLM-generated code. Code generated by LLM's often have the problem that the code seems logical, but then contain weird bugs that aren't immediately obvious.
- p0w3n3d 1y ago
  Agreed. The code available in e.g. Apache commons is not perfect, but it's seasoned and has the edge cases documented
Menschlio 1y ago
The proper way to do it, would be to have an industry standard on the default things people blindly but massivly pull through dependencies. I also don't get how code can be so massivly inefficient. left-pad needs 9kb to download and the code is a handful of lines: https://www.npmjs.com/package/left-pad?activeTab=code https://www.npmjs.com/package/left-pad?activeTab=code If my unit tests run through, i don't have 'unproven' code. I have well working code which doesn't need to go through a dependency hell upgrade cycle just because one function in that lib, i don't use, has some CVE too high to be ignored.
safety1st 1y ago
This mostly sounds like a good thing to me from a utilitarian standpoint. Getting all your utility classes from somewhere like npm and creating dependencies on 20 different people and organizations who may or may not maintain their software has been a security nightmare with many highly public examples. If a LLM writes a utility class for me then my supply chain is smaller, meaning less surface area to attack plus I probably benefit from some form of security through obscurity for whatever non-trivial amount that's worth. "Downside" is I don't have some rando, probably unpaid labor out there updating a piece of my app for me...

kunley 1y ago

The level of apologetism with regard to ai is depressing in this article.

stevage 1y ago

>Many software developers will argue that asking a candidate to reverse a binary tree is pointless Is "reversing a binary tree" actually a thing, or is this a cute kind of "rocket surgery" phrase intentionally mixing reversing a linked list and searching a binary tree?

stingraycharles 1y ago
It’s probably a mistake on the author’s end, but the problem comes across anyway. I can only imagine reversing a binary tree would imply changing the “<“ comparison in nodes to “>” which would be a useless exercise
nitnelave 1y ago
I think it's a reference to the Google interview problem that the author of Homebrew (IIRC) failed. They were quite upset about it since they have proved their worth through their famous open-source contributions, but got rejected in a LeetCode-like interview.

Sarah6666 1y ago

[dead]

jasonjmcghee 1y ago

> it’s a future where we prize instant answers over teaching and understanding It doesn't have to be this way- coupled with verification (to mitigate hallucination), llms can help so much with personal education. It's a purely judgement free environment and for a lot of people that's incredibly meaningful.

dominicrose 1y ago

Node.js's core library is purposefully minimal. Purposefully or not, it's still an issue. Wether you add many small things to your project using an LLM or NPM, it still requires work and the annoying thing is that you'll have to do it for every new Node.js project. Node.js is very good for IO and it has decent performance even for CPU-intensive work considering it's a dynamic language, but it would sure be nice to have a rich core library like Ruby or Clojure has. The fact that ClojureScript can do it proves that it's doable even for front-end javascript (using advanced optimisations).

NoSalt 1y ago

Bleak

layer8 1y ago

This seems to be specific to the JavaScript ecosystem, and to some extent orthogonal to AI coding. Micro-libraries with trivial-ish functionality are generally more difficult to justify to add as a dependency. I’m sure AI coding agents will eventually learn as well that there’s a balance to strike between implementing stuff yourself and the use of libraries. I’m also sure that people who are interested in actual coding will continue to open-source what they find useful, and other people like them will read their code.

mb2100 1y ago

I totally agree that the goal should be teaching. But I do wonder which code someone is more likely to actually read and understand: the LLM-generated one in their own codebase, or the one hidden in some npm package they installed to just ship things. I honestly don’t know. Careless devs probably won’t read either as long as it seems to work I’ve been trying to encourage forking my libraries, or have people just copy them into their codebase and adapt them, e.g. https://github.com/mastrojs/mastro/ https://github.com/mastrojs/mastro/ (especially the “extension” libs.) But it’s an uphill battle against the culture of convenience over understanding.

lsferreira42 1y ago

Now way more than before, i value my feed collection because i know all these blogs are human written, some of them got a post every year, but it is always good quality and human written.