An interesting question from mcc:

I wonder if at this exact moment one could succeed in filing a issue against an open source project for an entirely ficticious vulnerability, get it assigned a CVE and a github score, and then get the upstream project to accept your patch for the vulnerability, with all these things presented as the issue, the CVE, and the PR being written by generative AI, but in fact you wrote them substantially by hand and the patch for your nonexistent vuln is actually a backdoor

Very probably the more your submission appeared to be written by generative AI, the more likely it would be to be accepted. If some person came in with an ungainly, unreadable patch and was aggressively pushing a project to accept it you’d get suspicious and wonder why but if an AI did that you’d be oh well AIs are just like that and AI written code is just like that

Likely Pivot candidate just dropped:

VRChat refused to add an AI label despite 95% of respondents on their own survey supporting it.

Fresh and high-grade sneer just crossed my eyes: AI is Fake People

Same issue as before - ctrl+K clipped the https:// prefix. Fixed it now.

Starting this Stubsack off: a pentester talks about testing an AI chatbot and its associated API, finding vulnerabilities they hadn’t seen in a decade.

We talking about Allen Wittman’s joke product, or Apple’s joke of a UI design?

(Its obviously the latter - Apple’s Temu frutiger aero is a fucking insult to my eyes)

To wow people who need a computer to think for them?

Quick follow-up, for the sake of furthering my argument:

Baldur, whilst talking about the aforementioned loss of FOSS surplus, laid out a worst-case scenario, where a vicious cycle collapses the FOSS ecosystem:

1. Declining surplus and burnout leads to maintainers increasingly stepping back from their projects.

2. Many of these projects either bitrot serious bugs or get taken over by malicious actors who are highly motivated because they can’t relay^[sic] on pervasive memory bugs anymore for exploits.

3. OSS increasingly gets a reputation (deserved or not) for being unsafe and unreliable. [This drives away users as a result.]

4. That decline in users leads to even more maintainers stepping back. [return to step 1]

As a consequence of the slop-nami, I’d argue the perfect conditions for this vicious cycle have already emerged:

1. The slopnami has done plenty to exacerbate existing burnout in current maintainers - slop bug reports, scrapers and AI bros DDoSing services, AI bros in general and the myriad other negative externalities of this bubble have been utterly draining to deal with.

2. As (indirectly) mentioned before, the slopnami has given a variety of serious bugs and security issues - rsync’s broken backups, the rise of slopsquatting and prompt injection attacks, Linux’s recent race condition mishap, the list goes on.

There’s also a part in the denouement where he says a possible solution to improving slop code quality and safety standards is uploading the code to public repositories so similarly inclined people can engage with it

Which assumes people actually want to deal with slop code. An assumption that can be proven wrong by simply looking at the slopnami’s effect on the open source ecosystem. Speaking of which:

which, I don’t know, seems kind of familiar if you’ve been a programming adjacent for two seconds. But then you’d also be aware what the slopnami is already doing to the open source ecosystem.

Honestly, I’d be willing to bet good money on the ecosystem’s collapse at this point - the slopnami has tanked software quality across the board, the plague of scraping has made sharing source code deeply unattractive, the flood of LLM bug reports has crippled FOSS’s ability to find and fix bugs/vulnerabilities (which combos nicely with LLMs increasing bugcounts), and, as Baldur’s noted, the labour surplus FOSS relied upon has gone down the shitter.

On top of that, senior devs are burning out and deciding to GTFO en masse, and junior devs are getting deskilled, burnt out and/or laid off, crippling FOSS’s ability to replace any maintainers they lose.

The purpose of LLMs is theft, part infinity: AI game clones are making indie developers afraid to show their work

Glyph recently convinced a project to stop doing updates altogether by accident, and has had some thoughts about it.

For the second time I think I have accidentally convinced a project to just … stop doing security updates on a critical dependency forever, because they’d assumed the LLM usage problem wasn’t as bad as it is.

Both of these are offline things that are not at all security-sensitive, but I am starting to worry that in the “dark matter” of the broader developer community there is a meaningful plurality of people who are just going to stop updating e.g. the Linux kernel because of broken trust

(Recommend checking the full thread)

This can either be read as San Francisco or Science Fiction, and both readings work perfectly

Jonny took a look at Meta’s “Wonder” model they just released. Here’s how the thread starts:

The hourly history backup just failed in a way you should hear about plainly: the backup worker accidentally deleted the backup repo itself mid-run. The repo’s entire git history and all the DB sidecar files up to watermark 330145 are gone — that deletion was the worker’s own mistake, not a platform event.

Binged the entirety of Joe vs. Elan School over the course of a few days. Goddamn gripping from start to finish.

New article from Axos: Publishers facing existential threat from AI, Cloudflare CEO says

Baldur Bjarnason has given his commentary:

Honestly, if search engine traffic is over, it might be time for blogs and blog software to begin to deny all robots by default

Anyways, personal sidenote/prediction: I suspect the Internet Archive’s gonna have a much harder time archiving blogs/websites going forward.

Up until this point, the Archive enjoyed easy access to large swathes of the 'Net - site owners had no real incentive to block new crawlers by default, but the prospect of getting onto search results gave them a strong incentive to actively welcome search engine robots, safe in the knowledge that they’d respect robots.txt and keep their server load to a minimum.

Thanks to the AI bubble and the AI crawlers its unleashed upon the 'Net, that has changed significantly.

Now, allowing crawlers by default risks AI scraper bots descending upon your website and stealing everything that isn’t nailed down, overloading your servers and attacking FOSS work in the process. And you can forget about reigning them in with robots.txt - they’ll just ignore it and steal anyways, they’ll lie about who they are, they’ll spam new scrapers when you block the old ones, they’ll threaten to exclude you from search results, they’ll try every dirty trick they can because these fucks feel entitled to steal your work and fundamentally do not respect you as a person.

Add in the fact that the main upside of allowing crawlers (turning up in search results) has been completely undermined by those very same AI corps, as “AI summaries” (like Google’s) steal your traffic through stealing your work, and blocking all robots by default becomes the rational decision to make.

This all kinda goes without saying, but this change in Internet culture all-but guarantees the Archive gets caught in the crossfire, crippling its efforts to preserve the web as site owners and bloggers alike treat any and all scrapers as guilty (of AI fuckery) until proven innocent, and the web becomes less open as a whole as people protect themselves from the AI robber barons.

On a wider front, I expect this will cripple any future attempts at making new search engines, too. In addition to AI making it piss-easy to spam search systems with SEO slop, any new start-ups in web search will struggle with quality websites blocking their crawlers by default, whilst slop and garbage will actively welcome their crawlers, leading to your search results inevitably being dogshit and nobody wanting to use your search engine.