Thread

Pop!_OS bans AI-generated code from much of its codebase

116 points · 167 comments · bundie

Loading the complete thread in the background. This saved snapshot is available now. Refresh

zzzeek · 1791054135 · focus · HN ↗
banning AI from PRs because you're swamped with too many low quality PRs, definitely. We pretty much are doing this with SQLAlchemy. If I'm going to have a small fix or improvement coded by an LLM (which I do all the time), I want to prompt the LLM directly, rather than having someone trying to pad their resume forward my communications onto their LLM via PRs. What's the point of that?
1. nonethewiser · 1791054331 · focus · HN ↗
  > If I'm going to have a small fix or improvement coded by an LLM (which I do all the time), I want to prompt the LLM directly, rather than having someone trying to pad their resume forward my communications onto their LLM via PRs. What's the point of that?
  Which is why LLM PRs should just be issues (if there isn’t one already). Make the issue author a co-author on the PR. But let the maintainer actually oversee the LLM generated solution.
2. api · 1791054788 · focus · HN ↗
  Maybe the policy should be: no AI PRs except from established contributors who have been vetted?
  So basically you're saying you reject drive-by PRs.
  1. whateveracct · 1791055772 · focus · HN ↗
    drive-by PRs that are handwritten are presumably okay
3. nicoburns · 1791057120 · focus · HN ↗
  Reasonable, although I've taken a different approach. Either closing such PRs, or treating them as very detailed issues and having my own LLM build the actual fix.
  My repos probably don't see as much traffic as SQLAlchemy though.
4. baq · 1791057685 · focus · HN ↗
  rejecting low quality ones should be the norm regardless of whether an AI or a human wrote them. the question is what would happen if you were swamped with high quality PRs? what will happen once you are? (that's probably a 2027 question!)
  1. grumbel · 1791062065 · focus · HN ↗
    I'd still reject them. It's the bug reports and feature requests that are valuable. When you have an AI yourself, there is little point in having somebody else let their AI implement them, that just creates a lot of risks and unknowns for no benefit.
  2. zzzeek · 1791069073 · focus · HN ↗
    yeah a lot of LLM PRs are pretty good, but still need changes, and still didnt come from my own prompting which would have got them more exactly where I want them, so it's again, I have to put messages on a PR and wait for someone somewhere to see them and act on them. That friction is a huge waste of time if they're just prompting their own robot. I have the same robot right here and I usually use opus 5.x which is usually better than what they're using.
    baq · 1791116600 · focus · HN ↗
    I think it’s perfectly ok to just tell your robot how to get a pr to a state you like and merge it then. You should of course let folks know that this is the policy, but ultimately if it solves their problem the way you like it and you didn’t have to spend your tokens on it everybody wins…?
    zzzeek · 1791121526 · focus · HN ↗
    i use claude max and ive yet to get even 30% into my quota for it. so as long as that kind of deal lasts i dont think much about tokens.
    if i did have to think about tokens I use something like together.ai with an open weight model like glm 5.3 (which ill sometimes use to review a claude change for something intricate). glm 5.x is just very chatty though
ItsMattyG · 1791054287 · focus · HN ↗
I don't see how this will survive the attacker/defender gap as ls get increasingly good at cyber security and finding 0 days... but maybe it's an obscure enough is it doesn't matter?
1. barbazoo · 1791054396 · focus · HN ↗
  I'm assuming they still use AI to find vulnerabilities, just not fix them?
2. PorciiVorbesc · 1791054482 · focus · HN ↗
  Probably because pop_os and Cosmic are so niche and their market share so insignificant, that they're irrelevant to attackers and bad actors, when those now have much bigger fish to fry to make their time and effort worth it. See the Arch AUR attacks, for perspective.
  I think even amongst the HN and Linux userbase, pop_os is still niche, let alone amongst normies who never heard about Linux. So they can afford take the high road and treat it like their personal sandbox, accepting only human written code.
  But larger and more important projects like Fedora and Debian are more pragmatic with the fact that they'll have to accept AI written(but human reviewed) code, if they wish to keep up with the real world development and threats, as expressed by Linus Torvalds himself.
  The thing is, the cat's out of the bag on this one now, especially in the field of pen-testing and reverse-engineering. AI can brute-force its way into projects in ways that beat experienced researchers, so your only choice to keep up is to accept the use of AI generated fixes as a counter defense.
  1. DelightOne · 1791055578 · focus · HN ↗
    It also means security is not held as high and vulnerabilities not as much found. A simple 0-day may survive for years. Not much effort needed to have permanent access.
    PorciiVorbesc · 1791055789 · focus · HN ↗
    Sorry, I don't understand what you mean by this, can you elaborate pls?
    DelightOne · 1791058635 · focus · HN ↗
    Its easier for an LLM to find vulnerabilities in a project with less usage, and those vulnerabilities will stay open longer, making them much cheaper to attack to keep the door open.
    PorciiVorbesc · 1791059697 · focus · HN ↗
    What's the point of attacking things that almost nobody uses?
    Do you think Netanyahu, Trump or Xi-Jinping are somehow secretly using Cosmic DE at home, to be worthy targets?
    Bad actors have limited time, lives of their own and mouths to feed as well, so they concentrate their efforts where "the fish are" if they want to PWN someone for profit.
    DelightOne · 1791060542 · focus · HN ↗
    If it costs you as good as nothing, you might as well do it.
    Previously, time was the most precious resource. Now its tokens, and more cheaply at at.
    PorciiVorbesc · 1791061145 · focus · HN ↗
    Tokens and peoples' time are a finite resource too.
    If you assume Mossad and NSA are Tokenmaxxing every FOSS project out there to cash as large as possible fishnet as possible, then maybe using MacOS get you hacked too, maybe even visiting HN and commenting gets you hacked. Where does your argument end?
  2. badc0ffee · 1791056116 · focus · HN ↗
    It does show up on top 5 lists for Linux desktop distros quite a lot, and COSMIC is quite unique, so I suspect a lot of people are at least trying it.
    (I wasn't able to make it work on a scrap Dell I tried it on because the GPU was too old)
    PorciiVorbesc · 1791056340 · focus · HN ↗
    >It does show up on top 5 lists for Linux desktop distros quite a lot
    1) Firstly, surce? My research according to Google Gemini 3.8 Pro shows top 5 DEs are as follows:
    +---+---------------+------------+-------------------------------------+ | # | Environment | Est. Share | Primary Ecosystem / Defaults | +---+---------------+------------+-------------------------------------+ | 1 | GNOME | 45% - 50% | Ubuntu, Fedora, Debian, RHEL | | 2 | KDE Plasma | 25% - 30% | SteamOS, openSUSE, Kubuntu, Manjaro | | 3 | Cinnamon | 8% - 12% | Linux Mint flagship | | 4 | Xfce | 6% - 9% | MX Linux, Xubuntu, low-spec PCs | | 5 | MATE | 2% - 4% | Ubuntu MATE, Mint MATE (GNOME 2) | | - | Others / WMs | 3% - 5% | Hyprland, i3, Sway, LXQt, Budgie | +---+---------------+------------+-------------------------------------+
    2) Secondly, keep in mind that distrowatch is not representative of linux userbase. MX-Linux kept showing up at the top spot for many years despite being niche.
    3) And thirdly, TOP 5 DE isn't really an achievement when Linux DE market share is overwhelmingly dominated by KDE Plasma and Gnome as the majority shareholders, with XFCE and Cinnamon trailing. So Cosmic DE if it somehow made the no. 5 spot, would still be ignorable sub <1% market share, as I initially claimed, basically invisible to bad actors.
    yugoslavia4ever · 1791057817 · focus · HN ↗
    You're being way too defensive. GP replying to you was clearly trying to have a conversation, not attack your knowledge. Chill.
    PorciiVorbesc · 1791058583 · focus · HN ↗
    >You're being way too defensive.
    "Way too defensive" how? By asking and bringing data for my PoV?
    >GP replying to you was clearly trying to have a conversation
    As am I, except I ask for, and also bring data to back up my PoV, instead of vague opinions.
    >Chill.
    Where am I not being chill?
    kyubey · 1791062166 · focus · HN ↗
    To reflect some sentiment from another comment you posted - we're not your unpaid tone auditors. Learn to have normal discussions.
    For funsies, I threw two different DE-by-marketshare inquiries at Gemini 3.8 Pro in separate sessions and it ranked Cosmic 12th in the first and 7th in the second. Very trustworthy stuff.
    PorciiVorbesc · 1791062577 · focus · HN ↗
    >Learn to have normal discussions.
    What part of what I said was not a "normal discussions"?
    cindyllm · 1791064354 · focus · HN ↗
    [dead]
    satvikpendem · 1791058142 · focus · HN ↗
    Don't post AI generated content, if needed post the actual source.
    PorciiVorbesc · 1791058473 · focus · HN ↗
    >Don't post AI generated content
    Do you have a better source than GP?
    >if needed post the actual source
    Define "actual source"? In good faith, I mean.
    Where else do you get this information that's, quote, "actual source"?
    satvikpendem · 1791058661 · focus · HN ↗
    As in the study or survey or analytics segment where the data was collected to produce the report.
    PorciiVorbesc · 1791059369 · focus · HN ↗
    The analytics is the publicly available training dataset of the LLMs that share the same opinion. What do you expect? You want me to manually go through terabytes of information for your convenience? I'm not your servant. If you want to disprove me, then you do the manual work and show us that LLMs are wrong.
    satvikpendem · 1791060719 · focus · HN ↗
    Point at the public dataset then if it's so public. You really have no idea how the LLM is parsing the data and could easily be hallucinating. That you find being called out on this as some sort of insult is quite telling and frankly funny, what a strong reaction to someone asking for a basic source when the burden of proof is on you to prove these stats are right, not on anyone else to disprove AI bullshit.
    PorciiVorbesc · 1791062000 · focus · HN ↗
    Sorry, it's not my job to prove for you the things that you demand from me at your whims, because the original comment I replied to with LLM data also did not bring peer-reviewable information as proof that COSMIC is a TOP 5 DE, and yet you did not demand proof from them in that case. Why is that?
    Did you just blindly trust the opinions of others on this topic, and yet I'm the one who has to provide peer-reviewable data for you? Sorry, I'm not your unpaid lackey. Try to formulate a better (counter)argument for why they're right but I'm wrong.
    satvikpendem · 1791065123 · focus · HN ↗
    I will ask them for the same source, your comment wasn't special.
    PorciiVorbesc · 1791066531 · focus · HN ↗
    >I ask them for the same source (and looks like they provided it)
    I also saw it now. That's not an objective and representative ground truth, just another opinion, which I can respect as an opinion, but not as a statistic. I hope you can understand my PoV.
    satvikpendem · 1791068136 · focus · HN ↗
    In theory if you brought a better source than that person then I'd agree with you, but,
    > you'll need to bring something more than "that's wrong because LLMs sometimes hallucinate" as proof that Gemini's data is wrong in this case.
    actually I can say it's wrong or likely to be wrong especially if it doesn't cite the sources it uses. And if it does, then just paste the sources here instead of the LLM output. It is also unknown where it got the info and as someone else said, you ask it two different times and it gave two different answers, thus it is unreliable.
    badc0ffee · 1791058758 · focus · HN ↗
    Sorry for being unclear. I meant it shows up as a top 5 distro recommended by reviewers. This kind of thing: <a href="https://linuxblog.io/best-linux-distro/" rel="nofollow">https://linuxblog.io/best-linux-distro/
    PorciiVorbesc · 1791058890 · focus · HN ↗
    OK, but what's the sample size of that and who's measuring it? I never heard of that blog or took part in that poll. So how is that blog link the yardstick but mine is not?
    nvme0n1p1 · 1791064680 · focus · HN ↗
    Because that blog actually talked to real people and did real work, and yours is just a hallucinated list from one of the me-too LLM vendors
    PorciiVorbesc · 1791065297 · focus · HN ↗
    >Because that blog actually talked to real people and did real wor
    How did you verify that those people from the blog are actually "real"?
    I also talked to real people for my own opinion, case in point, I asked my family members which linux DE is most used, and the results came out different. Which "real people" are the ones representative here?
    > and yours is just a hallucinated list from one of the me-too LLM vendors
    How do you know it's hallucinated? Ask the LLM the population of your country? Is the answer mostly accurate or is it completely hallucinated?
    Aren't LLMs just outputting the highest statistical probability answer from the aggregate of their scraped data, which in this case would be including opinions on Reddit, and every website and blog on the entire internet (including that random one posted by badc0ffee), on the Linux DE uusage topic, making it a more accurate real-world prediction than just a single random Joe's blog?
    You can call it "hallucinated" if you want, but that doesn't mean it's not accurate.
    satvikpendem · 1791065139 · focus · HN ↗
    Source on this?
  3. iugtmkbdfil834 · 1791056958 · focus · HN ↗
    << Probably because pop_os and Cosmic are so niche and their market share so low, that they're irrelevant to attackers and bad actors, when those now have much bigger fish to fry.
    That is such a weird statement that I am not entirely certain where to begin. PopOS is hardly niche. Its base are all fairly common components by linux standards. And, more importantly, attackers and bad actors may other considerations in mind than sheer population size -- just to point out the glaringly obvious.
    << I think even amongst the HN and Linux userbase, pop_os is still niche
    I think rather than trying to disprove it, I think I should ask why you think that? If anything, PopOS annoys me because it is just a step before ubuntu ( and ubuntu is just windows at this point ). Maybe I am defensive, because my first real distribution ( that did not share disk with windows was popos )?
    PorciiVorbesc · 1791057142 · focus · HN ↗
    [dead]
  4. satvikpendem · 1791058103 · focus · HN ↗
    You only need one bad actor. For example, someone reading this thread could easily decide to start attacking it just because someone else said it wasn't worth it, as a personal challenge.
    PorciiVorbesc · 1791058764 · focus · HN ↗
    >You only need one bad actor.
    If that's your threat model then you shouldn't use any SW in exitance, FOSS or otherwise. In fact you shouldn't even go online, or even outside you own house, since one single bad actors exist everywhere. You can walk down the street and suddenly someone in a car runs you over(witnessed myself). And yet live goes on.
    satvikpendem · 1791058996 · focus · HN ↗
    Of course. I never said life doesn't go on or it's a worthwhile risk to care about, not sure how you got that from my comment.
    PorciiVorbesc · 1791059168 · focus · HN ↗
    > not sure how you got that from my comment.
    Because your comment didn't disproive that Cosmic DE is too niche for bad actors to get involved.
    satvikpendem · 1791061234 · focus · HN ↗
    It doesn't have to be niche (or not) to have bad actors. That doesn't make it likely of course but it is possible, and increasingly more so in the age of AI when you can simply point it at multiple projects in parallel.
    PorciiVorbesc · 1791062524 · focus · HN ↗
    >It doesn't have to be niche (or not) to have bad actors.
    Then they shouldn't reject AI aids to help them patch vulsn of bac actors faster, no?
    satvikpendem · 1791066091 · focus · HN ↗
    I never said they should. I think you're reading too much into my comment, the point was something being niche doesn't prevent it from being threatened.
  5. plqbfbv · 1791063149 · focus · HN ↗
    > Probably because pop_os and Cosmic are so niche and their market share so insignificant
    Consider that it's packaged for many well-known distros, so pop_os install base alone doesn't tell the whole story: <a href="https://system76.com/cosmic/download" rel="nofollow">https://system76.com/cosmic/download
3. vorticalbox · 1791054619 · focus · HN ↗
  The issue is “ai generated code” using ai to find bugs/0 day and manually writing a fix would (I assume) be allowed under the new rules.
4. altcognito · 1791054671 · focus · HN ↗
  Irony is that they will get the benefits from upstream projects (like the Linux kernel) that does accept AI inputs.
5. VCFundedGenYer · 1791055303 · focus · HN ↗
  AI finds a lot of "vulnerabilities" but most are fake, untested, or not actually vulnerabilities.
  Reminder that AI is quite stupid.
  1. dumberquestions · 1791056082 · focus · HN ↗
    I think this is just plain denial, AI has found many high severity vulnerabilities.
    zdragnar · 1791057259 · focus · HN ↗
    There's plenty more false positives than actual finds. There are still actual finds, but that doesn't change all the false positives.
    DaSHacka · 1791058222 · focus · HN ↗
    This is why you run a second agent to verify any assertions.
    zdragnar · 1791080226 · focus · HN ↗
    It'd be great if people did that. They don't. Open source projects with limited budgets shouldn't have to spend money from those limited budgets (or personal funds!) filtering through what amounts to spam. That's why there was a slew of open source projects that turned off issues on github and stopped taking outside contributions- they literally couldn't afford to keep up with the nonsense lazy bums were sending their way.
  2. novafunc · 1791060955 · focus · HN ↗
    It may have a high false positive rate, but at the speed AIs can review code, there's still plenty, of real vulnerabilites mixed in with the garbage.
    I'll trust the words of groups like curl (<a href="https://daniel.haxx.se/blog/2026/06/10/a-human-in-control/" rel="nofollow">https://daniel.haxx.se/blog/2026/06/10/a-human-in-control/), Linux, and even the infamously anti-AI Gnome (<a href="https://blogs.gnome.org/mcatanzaro/2026/10/02/the-era-of-software-quality-or-the-era-of-ostriches/" rel="nofollow">https://blogs.gnome.org/mcatanzaro/2026/10/02/the-era-of-sof...) that AI is finding real vulnerabilities and you're your project a disservice by ignoring them.
6. layer8 · 1791056024 · focus · HN ↗
  Using AI to find vulnerabilities doesn’t mean that you need to use AI to generate the code that fixes them. And you can still ask AI whether it thinks the fix is okay, as a second opinion.
7. fwlr · 1791058340 · focus · HN ↗
  So you took every single line of open source code you could possibly get your hands on (using scrapers so violently dumb that they amount to a permanent low-grade DDoS) and spent billions of dollars to tune trillions of parameters, and the value you can offer is… “let us inundate you with bad code or else we’ll generate exploits for your software”.
lkramer · 1791054466 · focus · HN ↗
I had a PR in flight that got closed because of this. I had an issue with passwords in the network applet for the VPN and had used Claude to help me identify and then come up with a fix. I did spend a lot time handcrafting and making sure the quality was good, but I respect their decision and no hard feelings, but as someone who have struggled to find time and opportunity to contribute to open source it was a small set back.
1. sedan_baklazhan · 1791055796 · focus · HN ↗
  What is actually the meaning of “handcrafting” here?
  1. throwaway74628 · 1791057019 · focus · HN ↗
    My guess: taking personal responsibility for the functionality, readability, and sanity of the change proposed, both atomically and in the context of the wider code base (adhering to existing conventions and patterns), to the best of the author’s ability.
    thereisno · 1791061939 · focus · HN ↗
    "taking responsibility" doesn't actually mean anything, it's just empty words
    simonra · 1791065718 · focus · HN ↗
    Putting any specific string in an "author(s)" or "committer" field is likewise a token gesture that doesn't affect or alter the content. The impact, just like promises of responsibility, would still solely be in biasing the reader, clouding the evaluation.
    Unless you believe there is substance in social interactions over time, like trust. But then it would be a socially weird move to dismiss promises of responsibility out of hand instead of picking up the invitation to build trust if that's what's perceived to be lacking.
    throwaway74628 · 1791092883 · focus · HN ↗
    We are not the same.
  2. lkramer · 1791068202 · focus · HN ↗
    What I meant by it was that I read every line of code generated, made sure I understood its purpose and either manually rewrote it if I felt there was a better way or asked Claude to do it. E.g. there was a bug where the password could end up in a configuration labelled as a username. Claude's initial fix was to simply exclude 'username' in a for loop, but I asked it to find examples in similar code in other codebases to see what the best practice was and ended up basing to fix on what is done in Gnome.
    sedan_baklazhan · 1791094930 · focus · HN ↗
    Can you show the PR?
2. Cyan488 · 1791056774 · focus · HN ↗
  I found your commit and your usage of AI seemed reasonable. It seems to me like your PR itself and the subsequent comments and correspondence was also human written.
  I think a PR "in flight" shouldn't have been closed like that.
  All this will do is push out developers like you that honestly disclose, and instead people will now just lie.
brink · 1791054618 · focus · HN ↗
I also have found that AI has not lived up to many of its promises and have dialed back what AI gets control of. My projects were turning into unmaintainable messes. The people who say coding is solved aren't paying attention.
1. lucianmarin · 1791055784 · focus · HN ↗
  Yes. I started two projects with AI from scratch. Both abandoned, complete mess. Projects without AI are so easy to manage, maintain, add/remove features, etc. I use AI as a search engine on my projects instead of Google. I ask what's wrong with my code and change or improve it myself based on my experience.
  1. dnautics · 1791057252 · focus · HN ↗
    I have the opposite experience. I don't have the patience sometimes to clean up my code and stick to coherent conventions and organization even though the will is there. With my AI projects I watch it and if the AI starts drifting I ask it to go through and look for convention/directory structure violations and it happily cleans everything up in about 10 or so minutes.
    Are you in Python by chance? Python has a lot of crazy hidden/inexplicit/spooky action at a distance stuff (especially in the frameworks) that can make LLMs gunk up code by defensively programming or just burn context chasing data provenance
  2. fasterik · 1791057584 · focus · HN ↗
    I've been a vibe-coding skeptic for years, but I decided to experiment with the latest models on some test projects. They're a lot more capable than I thought they would be. I agree that it's easy to create a mess, especially when you're one-shotting a lot of features without detailed instructions. But I find that as long as I'm strict about the API boundaries and force the agent to work in single files at a time, it's pretty effective.
    globular-toast · 1791059921 · focus · HN ↗
    You could have also copied an SVG renderer that implements the whole spec from whatever open source project the model copied it from.
    fasterik · 1791063651 · focus · HN ↗
    It didn't copy any source code from any external projects. I had it write a stratified sampling renderer for ground truth, then had it implement feature by feature by matching the pixels. Unless you mean it "copied" it in the sense of third-party code being part of the training data. I don't think that definition of "copy" makes any sense given how these models represent embeddings. It would also imply that humans are "copying" the things they've learned from.
    sashank_1509 · 1791093096 · focus · HN ↗
    I don’t think we should hold humans and models to the same standards. Humans have a very small working memory. Most humans cannot reproduce code they wrote even a year back exactly.
    A model can reproduce large swaths of its training data exactly. It’s a different algorithm that powers its learning process (it’s why it needs trillions of tokens to even learn basics of language).
    If there was a spectrum from copying on one end to creative production inspired from something else on the other end, the human generally lies heavily on the right end, while the model is much more on the left, that gap is large enough, that yes the model is in some sense “copying”.
    XajniN · 1791099673 · focus · HN ↗
    [dead]
    fasterik · 1791139346 · focus · HN ↗
    Humans are are also capable of memorizing long texts and sequences of numbers. It's more a question of scale than a fundamental difference. The point is that LLMs are like humans brains in the sense that they're not databases that store text, even though they can and do memorize things.
    Just because a model can reproduce parts of its training set doesn't mean that's what it's doing when it solves a programming problem. It can also reason about the problem, draw on its knowledge of algorithms and data structures, write throwaway tests, generate synthetic data and run experiments, etc. etc. Also, the claim that it can reproduce large swaths of its training data verbatim is an empirical one. I would be surprised if it could even reproduce 0.1% of the books it's ingested, for example.
    Saying that AI can't do anything but copy or steal from humans seems to be a rhetorical technique used by people who are still unaware or in denial about the capabilities of the agentic systems released in the past few months. They can now one-shot theorems and programming problems in a few minutes that would be difficult and time-intensive for even the 99.9th percentile human expert.
    sashank_1509 · 1791142569 · focus · HN ↗
    Empirically I just asked Astra without using the internet to exactly reproduce the first paragraph from Hamlet, Othello, Pride and Prejudice, Sartor Resartus by Thomas Carlyle), Sybil by Benjamin Disraeli (1845). GPT-6 got everything correct: <a href="https://chatgpt.com/share/6ac2a72c-e8bc-83e8-8f42-da8c7542decc?ogimg=plain" rel="nofollow">https://chatgpt.com/share/6ac2a72c-e8bc-83e8-8f42-da8c7542de...
    No human on earth can copy at this scale. Yes AI is beyond a database lookup, it does have reasoning on top of this knowledge, but my original claim that if there is a spectrum between copying with minimal changes and creative inspiration with minimal copying, AI is one the copying end while humans are on the creative end. Humans are very bad at reproducing anything verbatim, even if they wrote it like a week ago.
    fasterik · 1791144848 · focus · HN ↗
    Obviously, the scale of retrieval from memory is different, I'm not disputing that. The question is what percent of its training data the model is capable of reproducing. "Large swaths" could still mean less than 1 in a million, for example.
    I'm skeptical that there is a single spectrum like you're describing. It's not well defined.
    bitexploder · 1791061298 · focus · HN ↗
    It is also easier than ever to build specs and have nice easy to maintain projects. It just doesn't happen magically via few shot prompts :)
  3. fignews · 1791057618 · focus · HN ↗
    Have you considered that maybe this is a reflection of your skills rather than that of the LLM?
    runarberg · 1791057813 · focus · HN ↗
    Meaning OP is a better programmer then a statistical model which produces the most probable results?
    fignews · 1791059104 · focus · HN ↗
    Meaning a bad workman blames his tools.
    nvme0n1p1 · 1791064201 · focus · HN ↗
    A bad workman blames his tools.
    A good workman shuts up and finds better tools without complaining.
    runarberg · 1791078174 · focus · HN ↗
    An expert workman knows which tools to avoid, and explains it to their peers why to avoid said tools.
    sirsinsalot · 1791058188 · focus · HN ↗
    Have you considered it isn't?
    Save your "you're holding it wrong" if you're not going to suggest how to hold it.
    Cult speak escape hatches are intellectually lazy.
    williamcotton · 1791058610 · focus · HN ↗
    I’ve had the best luck by spending quite a bit of time going over the big picture architecture up front and then diving into the modules to further refine the details, making sure to generate step-by-step chunks of work in Markdown format for implementation. I’ll spend literally a couple of days doing this before starting any coding.
    What was your process?
    hirvi74 · 1791071705 · focus · HN ↗
    Do you mind sharing any code from what you have produced? People talk about LLM successes and failures, but what's there to really talk about when the code can speak for itself?
    In case it is unclear, I am genuinely curious. I have great success with chatbots, but vibing coding has never gotten me further than a proof-of-concept.
    williamcotton · 1791074859 · focus · HN ↗
    Here’s an example:
    <a href="https://williamcotton.github.io/datafarm-studio" rel="nofollow">https://williamcotton.github.io/datafarm-studio
    williamcotton · 1791075014 · focus · HN ↗
    Here’s an example:
    <a href="https://williamcotton.github.io/datafarm-studio" rel="nofollow">https://williamcotton.github.io/datafarm-studio
    Some demos of the above charting language:
    <a href="https://williamcotton.github.io/algraf/demos" rel="nofollow">https://williamcotton.github.io/algraf/demos
    WASM, in browser editor, LSP, and more.
    fignews · 1791058956 · focus · HN ↗
    Sure, happy to provide you with an example of how to hold it (turns out Steve was right) =D
    <a href="https://github.com/NousResearch/hermes-agent" rel="nofollow">https://github.com/NousResearch/hermes-agent is 99% (just a guess) LLM generated. 1140 closed pull requests this week. 1.5k closed issues. The github insights page for commits doesn't load for me presumably because it can't handle this scale of commits. But I estimate ~1K commits per day on average.
    There's a blog entry <a href="https://nousresearch.com/refactoring-hermes-with-1393-agents" rel="nofollow">https://nousresearch.com/refactoring-hermes-with-1393-agents that details some work that was done by LLMs to refactor and improve the code.
    I guess they know how to hold it?
    chmod775 · 1791060958 · focus · HN ↗
    You're using quantity metrics to answer a quality question.
    I had a look at the kind of issues that are reported at that project (there's 15k of them, so I can at best assess a couple). It looks like a complete mess: A lot of concurrency and resource mismanagement issues and edge cases that in a better-managed project would have been avoided by construction. They will now will likely be solved by more defensive programming, driving overall complexity ever upwards.
    If you really want to check some quantity metrics to try to reason about code quality, look at whether "fix" PRs are overall LOC neutral or negative (not counting tests). In this project, almost every "fix" is an addition. Worse, almost every fix is more branching.
    If almost every PR is some sort of fix, and most of them add branching, and there's thousands of them weekly... That leads to only one place and I want to be nowhere near it.
    nvme0n1p1 · 1791064113 · focus · HN ↗
    Agreed. As they say, quantity has a quality all of its own.
    Show me an AI that adds features by deleting code (<a href="https://www.folklore.org/Negative_2000_Lines_Of_Code.html" rel="nofollow">https://www.folklore.org/Negative_2000_Lines_Of_Code.html) and I'll pay attention.
    northstar702 · 1791071173 · focus · HN ↗
    [dead]
    diek · 1791072956 · focus · HN ↗
    I find it funny that the original complaint was: "AI made a mess of the codebase".
    Your response was: "Well you're not doing it right, but these hermes devs know what they're doing".
    But the blog post you linked to shows their prompt, which is:
    > I want god files broken up. I want simplification across the board. I want unification of helpers and methods that can be reused. I want less if-if-if-if-if-if-else routing. I want code legibility up. I want interpretability of the codebase and how things connect to each other up.
    So it sounds like AI made their code a mess too. They then tried to make the point of how much money they saved cleaning up the code with AI, that AI made a mess of to begin with.
    And if you look at the merged PRs on that project, a ton of them are bug fixes... to the code the AI wrote. And that's been my personal experience too: AI creates a huge amount of churn in a codebase. Just vast amounts of PRs fixing code that the AI itself wrote.
    catlifeonmars · 1791058882 · focus · HN ↗
    [delayed]
  4. satvikpendem · 1791058013 · focus · HN ↗
    When and what model?
  5. Keyframe · 1791058428 · focus · HN ↗
    I'm reading y'all comments and it seems we're still finding our footing, and will for some time. I have the luck that I have access to pretty much all frontier and other models alike. I've been extremely negatively biased towards any LLM use in the start. Then the influx from juniors came, then the revolt of doing PRs on such slop came, then some structured methods how to do LLM work came, then vibe projects came, etc, etc. I literally have all the described experiences you've guys mentioned. From good, to bad, to ugly. It's like there's no one particular way about doing this, and no two projects share the same approach - just like ye olde times.
  6. rickydroll · 1791092022 · focus · HN ↗
    I've had a different experience. My code is better. The ease of refactoring and practicing very defensive programming without getting burned out from the repetitive boilerplate. It all comes together better than it did when I was programming professionally too many moons ago. IFF I don't let the LLM toddler run amok. :-)
    Seriously, I find I need to slow down the rate of change. I don't move forward until I understand the change proposed and have updated the docs. At the same time, I find that keeping up with the LLM/agent is exhausting. 3 hours with an LLM leaves me as tired as 6 hours with a keyboard had previously. I find that coding when tired or fuzzy yields code that shouldn't have been written in the first place. Sadly, once it's been written and debugged, the temporary fix becomes permanent.
  7. cyanydeez · 1791118666 · focus · HN ↗
    I've adopted open source projects and have been working exclusively in languages I have very little experience with: typescript and go.
    I'm using local models, and they go slow enough that I have no trouble following along with what they're doing; but visually, both go and typescript, along with react native, make me puke. So I wouldn't be able to do this without AI.
    I describe how to do it in my comment history, but it's basically a Super-TDD along with some custom engineering harness.
    I don't want to say skill issue, but the same way you can give a chain saw to a teenager and one to a skill craftsman, well, AI can obviously create whatever you want it to do.
    I think some of the variety is simply how fast SOTA models pump out garbage that you simply have to close your eyes because it's not sensible to just watch characters flow across the screen.
    Almost all the coding I'm doing via AI is just faster than readable. But I can see the thinking traces and I stop to model when it's obvious it doesn't understand my intent, etc.
    So I'm not doubting you created garbage. I'm just doubting that it's a product of soley AI use.
2. bitfilped · 1791056769 · focus · HN ↗
  The people saying programming is solved couldn't program in the first place is what I've noticed. So to them it really does feel solved, things "work" and they don't have to learn what they don't know about programming.
  1. orangecat · 1791057564 · focus · HN ↗
    I've been programming professionally for decades. LLMs are extremely useful. At this point if you haven't figured out how to get value out of them, you're either holding them very wrong or you're being willfully ignorant.
    mod50ack · 1791057769 · focus · HN ↗
    I think it depends which LLM tool you're using. If you're using an older, worse model (the kind that you can use for free), the experience is significantly more frustrating. On the other hand, I'd say that the current best models are very useful with a skilled operator.
    drewstiff · 1791063781 · focus · HN ↗
    I would argue that using an older model and assuming that it is the cutting edge is basically equivalent to holding it wrong
    Keyframe · 1791058506 · focus · HN ↗
    You both can be right at the same time.
  2. bigstrat2003 · 1791059030 · focus · HN ↗
    There are a couple of notable counterexamples here (nobody sane thinks Carmack doesn't know how to program, for example), but by and large I agree with your observation. The people excited about programming with LLMs are, on average, people who weren't good at programming to begin with. Still, given that these counterexamples do exist I try to avoid painting with an overly broad brush for the sake of nuance.
3. nicoburns · 1791056967 · focus · HN ↗
  Were you reviewing the changes? I've seen lots of projects with this problem. But if AI PRs have to pass the same review bar as any other PR then it shouldn't be an issue in theory (if you can actually maintain the discipline).
  1. thesdev · 1791057371 · focus · HN ↗
    Isn't it tiring to keep up with considering the speed of the generated code? And if you want to be careful with the review you lose a significant part of the speed advantage.
    satvikpendem · 1791057878 · focus · HN ↗
    It's the same as any other PR. Keep the changes small and contained to that feature. AI can do this if you instruct it to, there is no need to vibe code some 40k line monstrosity.
    classified · 1791058033 · focus · HN ↗
    Having unmaintainable code faster is only an advantage if it's a one-shot throwaway artifact.
    drewstiff · 1791063680 · focus · HN ↗
    Assuming we are measuring time and
    `total = dev + review`
    If dev approaches zero, but you review at the same pace as you always have, are you in a better position? Yes.
    Will you potentially have a backlog of code waiting for review? Also yes.
    Would you prefer to be waiting for the dev team for all of the time instead, then still have the same amount of reviewing to do at the end of it? Absolutely not.
    nicoburns · 1791071042 · focus · HN ↗
    Yes, but it's the only option if you want to retain a maintainable code base. And you can always slow down. You'll probably still be a bit faster than you were before.
4. analog_daddy · 1791057274 · focus · HN ↗
  Oh my god. I am sad to have to acknowledge this even if the models have “theoretically” gotten better. I am not a programmer but I am super opinionated with the design and structure of the code and need to make sure whatever I write/ask to generate and use for my own tasks is understood by me at least once. I wasn’t this way in 2023. I am constantly reading/trying for an agent to help me write simple code without spending too much time. But so far nothing has worked. I wish someone figures it out otherwise, I personally would not be able to realize the AI agent productivity benefits that others are supposedly seeing.
  1. zanderwohl · 1791059512 · focus · HN ↗
    If you specify a structure, pattern, or design, it will stick to that design after a code review phase. Just tell it what standards you have, and after two rounds, it will have written what you described.
5. satvikpendem · 1791057983 · focus · HN ↗
  As usual, when people post comments like this they never specify what model and when they used it. There is a huge difference between GPT 3 and 6 for example.
  Late 2025 also had a step change when agents could largely code autonomously without handholding like previously, and to be honest it's not worth hearing opinions about AI from before that time, that's how significant the change was.
6. mulemisterX · 1791058411 · focus · HN ↗
  I've had the opposite experience. Spec driven development really makes things much easier to maintain. If you're just yolo'ing it and throwing prompts around things will fall apart fast.
7. Dfiesl · 1791058597 · focus · HN ↗
  Were you reading through the code it was generating to make sure the flow was intuitive and comprehensible for each PR? Projects only turn in to maintainable messes if you blindly merge in unmaintainable messy code.
8. joshheitzman · 1791059520 · focus · HN ↗
  People, especially those who don't do software development, often conflate coding and software development.
  The models aren't good at architecture and design. But they take direction on architecture and design and design well and can refactor code quite effectively. AI agents can absolutely be used to clean up vibe coded code bases once you figure out if the investment is worth it. The mess can be avoided if you give them sufficient guidance on architecture and design upfront.
  That said, doing so purely in text form doesn't feel great right now. I've been thinking about UML lately. The problem with that was the roundtrip after the code was generated and then the implenetation happened. I don't necessarily think UML is the solution, but neither is walls of dense text.
  1. PorciiVorbesc · 1791060192 · focus · HN ↗
    >The models aren't good at architecture and design.
    Can you elaborate to back up this claim? WHat exactly is your yardstick for "being good at SW design and architecture"?
    Because I found the current SOTA AI models being great at that, much better than most devs. Is your yardstick just the John Carmack's of the world by any chance? Because most devs are not John Carmack.
    joshheitzman · 1791067203 · focus · HN ↗
    My yardstick is me: <a href="https://www.linkedin.com/in/joshheitzman" rel="nofollow">https://www.linkedin.com/in/joshheitzman
    PorciiVorbesc · 1791067438 · focus · HN ↗
    Cool. Can you elaborate at which types of task you are better than SOTA LLMs in context of "being good at SW design and architecture"? Got any examples? Is it at the interview questions? Or real world problems? If so what is the scale of the real world SW design and architecture problems you're better than the SOTA LLMs? Is it FAANG scale or mom and pop shop scale?
    And do you consider yourself to be representative of the average developer, above them, or below them?
    LLMs don't even need to be better than the average dev, let alone the top performing ones, like you. If they can just be better than the bottom 20% of devs and white collar workers in general(easily achievable when you've been around the block and saw how many useless people just keep warm chairs for high wages in large companies), that's already a huge win for those products.
    joshheitzman · 1791073187 · focus · HN ↗
    I'm currently driving my AI coding agent harness through the process of refactoring itself. This is the last big refactor I need done before I can polish and release it as OSS later this month. So its not a large scale project I'm working on at present. The general problem is that mostly add new code and try to minimize editing existing code, which effectively means the code base is grown organically rather than being intentionally architected and designed. A few of specifics:
    1) duplication - LLMs are great at generating lots of text, so its faster and easier for them to generate entirely new facilities that overlap heavily with existing ones then it is for them find existing facilities that should be expanded and refactored (note I just said 'find'; actually editing raises the time and difficulty even more). This is fine for a while as the duplicate facilities usually work just fine, up until something needs to be changed across all of them and they miss changing one or more of them, things break, and a bunch of tokens have to be burned tracking down the issue.
    2) ever increasing surface area - even when making changes that do expand a facility without much duplication they frequently only add without removing much of anything or changing the overall design of the facility to reduce the amount of state its tracking and the number of branches it has based on that state. I've never seen one decide to split up something large or with too many responsibilities on their own. They will happily create a god class or function and just keep making it bigger.
9. xenadu02 · 1791060385 · focus · HN ↗
  AI is a useful tool but it absolutely needs a lot of human guidance.
  Unlike a compiler it won't give up at the first sign of trouble but that just means it left alone it will dig bigger and bigger holes.
  Treat prompt engineering as a discipline and refine your technique. When it produces garbage throw out the work and start over until you figure it out.
10. vjvjvjvjghv · 1791060749 · focus · HN ↗
  I treat AI like an intern or junior team member. With enough guidance, they can contribute a lot but you can't let them loose without supervision or they usually will produce a big mess. As of now, you are still responsible for overall architecture. One strong indicator that something is going wrong are big pull requests where the AI has rewritten large sections of the code.
11. cortesoft · 1791061483 · focus · HN ↗
  I am not saying you are right or wrong, but I don’t think you can make such a broad conclusion simply because of your own experience.
  You say you used AI and your projects turned into unmaintainable messes, so your conclusion is that it means AI is not living up to its promises.
  I guess if the argument is “AI makes it so you always get a great result no matter how you use it”, then your argument is sound. Your projects not working out proves that AI doesn’t always work no matter what.
  However, that doesn’t mean you can’t use AI to create sustainable and well organized code. Failing to do something doesn’t mean it’s impossible and anyone who thinks they can is not paying attention.
  I can’t run a marathon. If I went out and tried to run one, I would get a few miles and collapse, failing completely.
  I don’t think it would be reasonable, though, at that point to say “running a marathon is impossible, anyone who says they can do it clearly lying. I tried and didn’t even make it 5 miles!”
  I wish people would stop assuming their experience with something is the only possible truth.
  1. threethirtytwo · 1791062327 · focus · HN ↗
    Stop being overly polite to these people. It is seriously coming down to the point of utter delusion.
    As ai becomes better these people will begin changing their story because it’s utterly obvious what’s happening.
12. TuxSH · 1791062315 · focus · HN ↗
  Vibe coding has always had and always will have one fundamental flaw: you didn't write the code it produced, therefore you don't have a good understanding/mental model of it.
  On the other hand asking these clankers "review the feature branch I wrote" and "review my entire codebase for bugs" or "help me debug this" has saved me months of prospective work.
  And more recently most major models have been getting _really_ good at RE, for example you can have OAI models (and maybe A/'s if they don't refuse) use idalib MCP and reverse-engineer stuff from start to finish, then follow up with GLM 5.3 for vuln assessment and exploit PoC.
  Stuff that used to take weeks or months now just takes a few hours, or less.
13. kees99 · 1791105587 · focus · HN ↗
  "Coding is solved" is a very high bar, and current-gen AI/LLM is very far from that.
  Where AI did make a lot of impact is triage. I can throw a messy bug report of an intermittent issue at claude, and tell I need issue reproduced and fix developed, and there is a well above 50% chance it'll deliver. Never commit that fix to the codebase as-is, of course.
holoduke · 1791054646 · focus · HN ↗
Doing that will put you put of the market. I am certain of that.
1. lumpysnake · 1791057238 · focus · HN ↗
  There are a whole lot of people (in tech) who truly hate AI and want nothing to do with it. Those people will flock to projects who take a stand against it.
  1. baq · 1791057544 · focus · HN ↗
    it doesn't matter. it's delusional to think you can outcompete a thing for which solving a Millenium problem is just Tuesday. it's the anger phase of grief, nothing more.
    bakugo · 1791060731 · focus · HN ↗
    This is straight up cult behavior. "You WILL assimilate or we WILL kill your project"
    PopOS is not a product being sold by techbros trying to pump their stock like AI is, it's free open source software, it doesn't need to "outcompete" anything. If you don't like it, don't use it.
    baq · 1791061625 · focus · HN ↗
    it isn't even me not liking it (I don't think about it at all frankly, I have nothing to like or dislike) - I think it's irresponsible policy. I won't be using something that doesn't accept automated security patches from defender AIs.
    bakugo · 1791064472 · focus · HN ↗
    [delayed]
    baq · 1791067326 · focus · HN ↗
    I won't and I recommend anyone currently using it to reconsider due to the security posture the project necessarily and unfortunately has as a direct consequence of its policies.
VCFundedGenYer · 1791055258 · focus · HN ↗
Thank god. Tired of these orgs blindly and stupidly allowing them (Debian, cough).
sdcfgy · 1791055517 · focus · HN ↗
Same trouble we have. Some clever person says to use AI agents for code review. 100kloc commit got flagged through on Friday. Taking this week off. Not my circus.
1. driverdan · 1791059120 · focus · HN ↗
  A 100kloc PR is unacceptable regardless of the source. That needs to be broken down into reviewable chunks.
iluvcommunism · 1791055934 · focus · HN ↗
[dead]
CurbStomper4 · 1791056483 · focus · HN ↗
[dead]
mahboi · 1791057101 · focus · HN ↗
I still wanna see what Slop OS looks like. Go full AI spam making a Linux distro from the kernel up.
1. slig · 1791058473 · focus · HN ↗
  It might get millions in founding.
2. heliomattress · 1791067307 · focus · HN ↗
  soon <a href="https://desu-usergeneratedcontent.xyz/g/image/1760/38/1760385530492.gif" rel="nofollow">https://desu-usergeneratedcontent.xyz/g/image/1760/38/176038...
3. throw16180339 · 1791134736 · focus · HN ↗
  Omarchy is heavily vibecoded and may qualify
sippingabonedry · 1791057494 · focus · HN ↗
Completely performative.
You build your OS atop thousands of open source packages, many of which contain AI generated code. Are you going to audit them one by one and remove offending packages? What about the ones you won't remove because the OS would be irreparably broken?
1. HexDecOctBin · 1791058017 · focus · HN ↗
  This is a good idea, we should start a blacklist of open-source projects that are known to have used LLMs. There should be two universes of code, one for hand-typed code used by people who care about quality and one for slop used by those making trash.
  1. Fr0styMatt88 · 1791058407 · focus · HN ↗
    Yeah but that's just bad code in general, no? You can make good code with LLMs, you just have to actually engineer it and give up some of the velocity; which is just a bigger version of the same problem we've always had (yes, I get that code review can't scale).
    This is just really silly.
    The more I think about this the more I think it's like self-driving cars. We have this expectation that self-driving cars MUST be 101% safe and never get into any accidents, ever, before the technology is worth adopting. LLMs are the same -- it's like we think if you can't one-shot a prompt and get perfect software out of it, it's failed. You can choose to spend time getting the LLM to refine the code it's written, review the architecture, come up with an actual engineering process around the LLM. Yes that means you'll be producing less code per time spent -- which is a good thing.
  2. brokencode · 1791058577 · focus · HN ↗
    There was plenty of bad code long before LLMs came around. Let’s be real.
    Being hand written is no guarantee of high quality, just like using LLMs is no guarantee of low quality.
    bigstrat2003 · 1791058780 · focus · HN ↗
    Using LLMs is not a guarantee of low quality, but it does make low quality vastly more likely.
    brokencode · 1791064798 · focus · HN ↗
    Eh, not really. It just lowers the barrier for lazy people who never would have tried contributing before.
    I’ve read a lot of code hand-written by programmers. By smart and hard working people. And I know from experience that the code the average programmer writes is not great either.
2. _heimdall · 1791058071 · focus · HN ↗
  It also doesn't answer the question of how they might even recognize LLM generated code in contributions to PopOS directly.
  I have yet to understand how maintainers can't distinguish beyond (1) PRs that literally include Claude co-author notes or (2) low quality code contribution regardless of the creator.
3. driverdan · 1791058746 · focus · HN ↗
  It's not. Read the article, they have a good reason for banning it and it's not because they hate LLMs.
4. 999900000999 · 1791059574 · focus · HN ↗
  I agree.
  PopOS is Ubuntu with extra problems. Ubuntu itself is fine, but then PopOS adds weirdness.
  Cosmic has been in beta for how long ?
  1. duped · 1791059948 · focus · HN ↗
    It's been out of alpha/beta for almost a year
  2. plqbfbv · 1791062838 · focus · HN ↗
    [delayed]
  3. wookmaster · 1791079300 · focus · HN ↗
    Huh? Cosmic is out, there's some bugs still but its pretty nice.
5. novafunc · 1791060549 · focus · HN ↗
  I don't think it's performative.
  They aren't saying that AI produces bad code or is terrible for the world in some way.
  It's mainly just resulting in a lot of PRs that they don't have enough time to review or features they don't plan to add.
6. schipperai · 1791065208 · focus · HN ↗
  It sounds like what they are primarly aiming for is introducing backpressure in their own review pipelines.
7. weare138 · 1791146432 · focus · HN ↗
  Unless you have some examples this is a straw man argument.
winrid · 1791057550 · focus · HN ↗
I wonder if the issue is mostly the code or the AI written PRs and people using AI to talk to the maintainers. I personally just ban anyone doing the latter, I don't want to talk to opus more than I already do lol
1. fullstackwife · 1791062320 · focus · HN ↗
  Issue is entrenchment in the old SWE world that ceased to exist somewhere in August this year, and using AI to mechanize the traditional workflows. Also people with "I need to eyeball each char in PR diff" attitude, which is fucking unproductive at this point.
  1. winrid · 1791170477 · focus · HN ↗
    Some projects exist just for our enjoyment of coding, so yeah I read the code on those.
whatsThisBtn4 · 1791057958 · focus · HN ↗
Well this project is dead then.
I have a hard time knowing if anti AI is a mental illness or propaganda coming out of China.
Unironically.
Separately, why would anyone use a Debian based desktop OS? Your $11 Amazon mouse won't work. An Nvidia card won't work. Just use Fedora.
onesandofgrain · 1791058460 · focus · HN ↗
As they should. If you can tell it's AI, it shouldnt be part of any codebase.
teekert · 1791060687 · focus · HN ↗
"So the team wants to "prioritize working on contributions from our own team and regular contributors.""
Sounds reasonable, even to avid LLM users, I suppose. You have to draw a line. This line is too simplistic, but it'll work, for now.
yegle · 1791060735 · focus · HN ↗
This would just push people to maintain their own fork. If I already have an agent to investigate and fix a bug and able to send a PR, the added cost of maintaining a local fork is minimum.
In fact I've start doing that myself. Sending PR and convincing the maintainer why the fix is necessary is just too much effort.
brutal_chaos_ · 1791062353 · focus · HN ↗
slight tangent: AI coders are the new junior devs
YuechenLi · 1791063642 · focus · HN ↗
Ok, this may be controversial, but LLM code tokens aren't free, and I run out of my weekly allowance pretty regularly just from doing some fairly heavy projects, so I don't understand why somebody would ever want to spend their own money to make bad PRs on purpose, and I like to assume good intentions from people unless proven otherwise, which means a near blanket ban for LLM authored code for these big open source projects just seemed a bit extreme to me, when the core issue seemed to be that review process/policy should change with the times.
For example, I was helping work on an open-source game engine earlier this year with a longstanding text rendering bug dating back to around 2021 that prevents the engine from being production ready, which the community and myself have developed extensive workaround for. So, one day I've finally said enough and got Claude to debug it. It took Claude 10 minutes to find the bug, it was 3 lines of code change in the renderer (yes, three).
So, I wrote up the regression tests, documented the bug and opened up a PR for the fix, thinking it'll get merged in like less than a week and then we can all move on. The maintainers received it fairly well on the PR, but the PR sat there for nearly 6 months, unmerged, until it finally closed from a bad squash upstream. I'm pretty sure the bug is still there too.
And as a side note, I would be ecstatic if someone wants to contribute to my Github projects with their AI.
1. northstar702 · 1791072644 · focus · HN ↗
  Feels like AI on autopilot running OSS projects is the dream everyone is trying to get to. Tokens will never be free. Anthropic needs to go IPO. You make an interesting point about personal spend, but bad PRs are unlikely to be on purpose. But the discipline to review/clean up the slop might not be there?
  1. YuechenLi · 1791078822 · focus · HN ↗
    True. I personally use LLMs much more ambitiously to help with my own coding projects, but I've always been very disciplined about planning ahead and task breakdown so that the LLMs can get it right the first time so there won't be any need to fix the code afterwards.
    Other people's open-sourced project is different though, so I tend to check/test the code myself much more rigorously when contributing to other people's repos than if it is my own projects.
northstar702 · 1791070623 · focus · HN ↗
there is an ongoing thread here on a similar topic from an AWS expert -- <a href="https://www.linkedin.com/feed/update/urn:li:activity:7510679597013856256?updateEntityUrn=urn%3Ali%3Afs_updateV2%3A%28urn%3Ali%3Aactivity%3A7510679597013856256%2CFEED_DETAIL%2CEMPTY%2CDEFAULT%2Cfalse%29" rel="nofollow">https://www.linkedin.com/feed/update/urn:li:activity:7510679...
"Apparently, AI doesn't lead to positive results in all software development teams. Customers are asking me whether they should slow down the adoption of AI in their teams.
How do you respond to that? Yes? No? "
Feels like part of it is a learning habit, getting proficient in use of the tools (AI agents) themselves, and better workflow around it, but it remains AI is not perfect yet?
cagey · 1791081503 · focus · HN ↗
I had a PR closed because of this, one that fixes something that, had it not been fixed (by Claude, based on me noticing and clarifying the failure mode and verifying the fix), would have led me to abandon at least COSMIC, if not the distro. But this has me wondering how COSMIC, which had reached 1.x before I started using it, can mature, and whether I'll remain. I started on Pop!_OS with its COSMIC-less 22.04 version; I chose it as a fairly popular distro having Ubuntu stability while offering a leading-edge kernel. Point being, COSMIC was never the draw for me, and I held off upgrading to 24.04 for a LONG time out of concerns about bugs & stability; eventually 22.04 started experiencing ibus-related problems that forced my hand. Since I am (a) not knowledgeable in Rust, nor (b) conversant in the protocol at the core of this bug, I would never have had the gumption or time to understand and fix the bug. And since the PR is closed, it seems unlikely to even serve as a bug report.
In the meantime, others have experienced this bug and are waiting for the maintainers to notice and fix it. I'll just continue to run my fork (so far it has been no burden at all) while I (slowly) decide what direction to take.
1. mkj · 1791118173 · focus · HN ↗
  Maybe you could report it as a normal bug report, by hand?
aronaxe · 1791085207 · focus · HN ↗
[dead]
snvzz · 1791102413 · focus · HN ↗
Very quickly they'll find themselves with most packages frozen to old versions, including the kernel itself.
Shipping them full of bugs which LLMs already fixed upstream.
Fortunately, as it is an open source project, if anyone actually cares about the distribution, they'll fork it and continue advancing it using modern tools.
i_love_retros · 1791129084 · focus · HN ↗
Good! Anything that isn't a not very important crud web app should not allow AI generated code anywhere near it!

Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.