Hobby groups projects like this are less fun for a lot of people who used to enjoy interacting with smart people. It's definitely become a game of just spam claude for answers with zero understanding or care for how anything actually works. That's fine to get things done and fine for a lot of side projects, but it definitely ruins the joy that people have in understanding systems and working with intellectuals.
Wasn't there an article here, or was it under another HN post as a comment? Someone pointed out that the before the dawn of LLMs, "bad contributors" had a rate limiter of sorts. Now anyone can prompt their LLM and throw their output at you, shifting the burden entirely on the reviewer at highest possible speed.
Just this morning I had a senior manager say to me "I was trying to do someone else's job and give them all the info so they can review it as I have no knowledge" in response to me asking for them to please filter the Claude word salad using the meat proxy. I'm pretty tired of having to do the job of filtering the low-effort copy-paste walls of text
Similar to sending a "Let Me Google That For You" except somehow because it was an LLM not Google, they've forgotten it's more insulting than helpful, and aren't even in on the joke they themselves are making.
Projects like this probably need a dedicated noob-fork where 'anything goes', so the noobs feel like they're contributing but where their blast radius is contained.
And once in a blue moon something good comes out of it back to the real project.
> Hobby groups projects like this are less fun for a lot of people who used to enjoy interacting with smart people
It is insane just how miserable the experience of FOSS hardware hacking in public is.
The expectation does not even the slightest match reality.
You'd think "ah yes many eyes meaning all bugs get shallow", but instead you get worst of XDA-Developers and toxic wastelands where no sane person even answers anymore.
But this predates LLMs and was as miserable as it is now before as well.
In fact, I might even argue that LLMs made this _better_, because you can now avoid the "opening up in hopes of finding 1 helpful person below 99 annoying ones" through simple GPU compute.
Previously, you had to hope that through this self-inflicted horror, you'd find an expert that can augment you. Now that expert rests on huggingface.
It's still.. not perfect, of course. But it might be less miserable - provided that you adapt to the current state of things and stop with the "trawling for volunteers".
__
Of course, this does not help you against "skids let claude find bugs that you'd need and burn it for no reason" as per the twitter thread, but I wouldn't rule out that they would not have done that, if less information was public.
And.. that too was an issue before LLMs.
Information wants to be free, but so does your cat, and your cat gets run over by some crackhead in a 30 year old rusty pickup if you just put it outside without thinking.
completely different world, but i've seen this happen in music spaces as well.
the idea of gatekeeping is often seen as elitist or exclusionary (fairly enough in many cases) but i think this can be an exaggerated description of a culture that necessarily requires a standard of... let's say, desire to engage with material on a sufficiently deep level. many things can be for anybody, but they are not for everybody.
in the past i've seen the phenomenon of "opening up" subcultures or previously-niche intellectual/art fields described as democratization but i think that ignores a big part of what causes this, which can more accurately be described as commodification. access to difficult things was formerly measured by one's ability to expend effort in order to get there (ignoring, for now, the structural conditions that set one up for success in that effort). when these things are commodified, these efforts and identities become products to purchase, the right to which is nearly never limited; in fact, it's almost seen as evil to imply that they should not be available to any individual at any time that individual may desire access.
i know we all have to start somewhere, but there has always been some historical filtration that leads people who are not truly engaged with a subject on a deep level to disengage at some point. that's changing at a novel rate and scale across so many subcultures. it seems like a lot of us are just surprised at how many people even want access to what were once our sanctuaries and we're not capable of grappling with what it takes to adapt to these changes.
i don't think this will pass or that things will return to "the way they were" but there will always be pockets that resemble previous subcultural forms. we just have to re-learn how to identify them with a keener eye and how to better avoid or more-appropriately interact with those who have a more superficial interest in them.
> Hobby groups projects like this are less fun for a lot of people who used to enjoy interacting with smart people.
This is definitely the case for me. Before AI tools became mainstream, it was already a difficult proposition to find other smart people who you could get along with and talk to, do something interesting together. The Internet made all the difference in my life because I was able to get outside my geographic region to do big things through open source and hacker communities. Now, that very important filter mechanism no longer works. It's Eternal September all over again. In a way, it's very much a domination of "ends" over "means" in the wider community that is being forced upon those who long focused on "means". For a lot of intelligent people, understanding something is /valuable on its own/, but for the wider world there is no value in simply knowing things, but what you do with that knowledge (or now that lack of knowledge). I even experienced this recently at DEFCON 34 where I saw other participants in some of the CTFs with me using AI tools and not really understanding what the tools were doing or what was happening, but just kind of bruteforcing/tokenmaxxing their way through. This isn't to say that those AI tools are fundamentally a bad thing to use in building open source software, security research, or even as a tool in a CTF, but that the "understanding" step needs to still be present or it destroys the fun in everything.
I'm certainly not having as much fun with computers these days, even as I've invested a lot of effort myself in local LLMs and trying to understand the tools and understand how to apply them reasonably, I've found I prefer much more analog entertainments. Thankfully there's always photography and lockpicking to entertain me at the moment and provide a pathway to meet other interesting fellows.
In general, society is experience a decoupling of fun from work. I can't say I enjoy every aspect of my job, but it's nice to enjoy some of it, and lots of people do find a lot of their job at least somewhat rewarding.
People who hate their job of course like to come out of the woodwork and say no one should enjoy it, but isn't it nice to have a society where at least some people can enjoy their work? I used to enjoy teaching but I'd never get a teaching job now because of how AI is being used in that sector.
Technophiles will say that we should embrace the future because its inevitable but how many good people quitting does it take before they realize that a vibe-coded future of fun isn't all there is to life?
> but isn't it nice to have a society where at least some people can enjoy their work?
That’s an interesting question. I thought about it for a minute and was surprised that I came to the conclusion that the answer isn’t obviously “yes”.
An analogous question is “isn't it nice to have a society where at least some people are rich?”, and I think that question should make it clearer to many people why that is so.
I have been disabling PRs in all my repos because of the mountain of garbage I receive. Previously I also accepted very few but was always able to use the opportunity to at least explain why things work the way they did, and often improve the submitter’s skills. If you submit an LLM fix, I don’t bother; you clearly haven’t bothered to understand the basics of project or how it works, so why should I waste my time and sanity explaining something you also won’t read and will at most shove into your LLM?
I haven’t yet started disabling issues. Let’s hope it doesn’t come to that.
now imagine how many other devs and maintainers are contemplating this but just haven't been pushed to their personal breaking point yet. or take note of how many, when asked about the spam problem, just nervously go "yeah it's kinda rough haha...". or how many will vent about it on their twitter-like of choice with increasing frequency.
remember hacktoberfest 2020? that's just all public-facing source 365 days a year now, except instead of "updated README.md" it's some vaguely-plausible fix... then you read the PR body and someone couldn't even be bothered to, or, just as likely couldn't explain it themselves. and that sort of sinking dread sets in.
> now imagine how many other devs and maintainers are contemplating this but just haven't been pushed to their personal breaking point yet. or take note of how many, when asked about the spam problem, just nervously go "yeah it's kinda rough haha..."
At first, my brain parsed "spam" as in ye olde email spam. It took a moment for it to sink in that you meant code spam, instead.
But now that the two concepts are linked in my little pea brain: I kind of want to see how a system like SpamAssassin would work when applied to pull requests like it has been applied to email.
It can use reputation, real-time blacklists, triggers for form, and et cetera, with weighted scores for every aspect that are ultimately factored into one final score.
If final score is passing, the PR is presented for a human to review like a PR was (say) 5 years ago. If the final score fails, it goes into the circular file where it will probably die.
I would guess we'll start seeing more open source projects with much tighter restrictions on who can participate. Closed contributions and heavily automated (or even closed) issue tracking is probably already happening and will spread faster.
I entirely sympathize with these maintainers too. I've had 2 instances where an LLM has surfaced a bug and I just couldn't get myself to open a PR and dump more work onto these maintainers, even after manually writing one up (neither were critical bugs, it's fine).
Seeing popular projects (like hermes) having 5k issues and 5k pull requests is madness.
On the other hand we'll probably see a lot more fully vibecoded projects gaining traction, because of the rate at which they can move once human design and review gets taken out of the equation.
For example, I recently came across Hucre, https://github.com/productdevbook/hucre, which is a JS spreadsheet library apparently developed entirely in the past few months and which has already gained 2.2k GH stars.
Is it any good? Who knows, but the alternatives for spreadsheet handling in JS aren't great, either being limited, semi-commercial, or unmaintained. And creating a new one without LLM-assistance is a huge, painful, mostly thankless undertaking. It's not surprising that a zero-dependency option that promises to do everything this can do would be popular.
Everyone has had the experience of butting their head against functionality limitations of open-source libraries. Fully vibecoded libraries will be able to add functionality at a rate that human-authored ones can't. Code quality might suffer, but if a library has a feature you need, and you've got a deadline to hit, are you going to avoid using it? Is the average developer? Or the average LLM?
I think we're about to hit an interesting period of human-only projects competing with vibecoded ones, and it'll be an acid test as to whether the pro and anti claims about AI-coding bear out in terms of code reliably.
This title and the first quote are misleading. A dev found an undisclosed hypervisor exploit using AI that TheFlow0 had been using and keeping secret, but the other dev had informed Sony to collect the bug bounty.
It's an issue that the dev attempted to collect the bug bounty, AI or no
You know, it’s petty, but I think one of the things I hate the most about AI is that it surpassed front end JavaScript frameworks in terms of changing what the standard is every few years.
What’s the point of learning anything if it becomes obsolete faster than the seasons change?
Just so you know, the frontend framework wars started and ended pretty quickly in the latter half of the 2010s.
It was the downstream effect of the browser wars settling down and W3C making big moves on getting vendors to finally implement standards that were sorely needed. It had nothing to do with web dev culture.
> The scene used to be a group of highly talented researchers, but now it is just a bunch of noobs using LLMs and writing hacks they don't even understand. Slop kiddies found the only hypervisor bug left, which I had also found a while ago, and decided to report to Sony.
Sounds like he is salty that somebody found an exploit using LLM that he found manually (which probably took a significant amount of time.) I can partly understand it, but I mean that's also just the game that somebody else might find an exploit, LLMs just make it easier. LLMs finding bugs is not a bad thing, just sucks for enjoyers of open source software in this particular case.
>I asked them to at least wait for GTA 6 to come out so that people would have the opportunity to legally purchase the game and also enjoy linux. They agreed to wait, but not a day passed and they decided to waste it instead.
This guy has used on working with people that understand the scene, it seems that they were in contact, they agreed on something and then the next day they did something different.
This is really important in the context of what happened and probably the cherry on top of the current "hacking" cake, with the bar being lowered so much that anybody can jump in with some minor skill and luck and get something just for themselves.
> Sounds like he is salty that somebody found an exploit using LLM that he found manually
Nope. He is salty because someone made public the secret exploit that Linux-on-PS5 apparently relies upon to bypass Sony's hypervisor protection. Now Sony will fix the exploit, and there will be no more Linux on the PS5 until another exploit is found.
It sounds like he had already found it the old fashioned way, then the noobs sic'd the LLMs on it, found it, and he told them "hey chill, we knew about this, don't ruin it" and they ruined it.
To quote Dr Ian Malcolm:
"If I may... Um, I'll tell you the problem with the scientific power that you're using here, it didn't require any discipline to attain it. You read what others had done and you took the next step. You didn't earn the knowledge for yourselves, so you don't take any responsibility for it. You stood on the shoulders of geniuses to accomplish something as fast as you could, and before you even knew what you had, you patented it, and packaged it, and slapped it on a plastic lunchbox, and now
[bangs on the table]"
I don't find that offensive at all. People do not understand the code they make AI to generate, but that doesn't stop them from submitting. This is a real problem that has hit many open source projects, and I expect more and more of them will introduce barriers to submission.
It’s not only for coding. If my coworker send me a lengthy doc that obviously 100% written by AI without even reviewed/revised by them, I wouldn’t read because it is a waste of my time and an insult to me.
We removed a guy from a project for doing something like that. North of 100 pages, and mostly wrong. What wasn't wrong was so generic it was useless. I don't know what he's working on now, but at least it's not our stuff.
LLM use has been polarised like everything else seemingly is.
I have no issue with people using them to do things they could already do themselves as an efficiency thing and if they check and understand the result.
Unfortunately that seems to be the exception not the rule and the amount of "one shot slop" has increased dramatically, it's even affecting the modding communities for games.
This is gonna be a mess that is going to take time to figure out and then even more time to clean up.
You ignored the part about "writing hacks they don't even understand." LLM is fine if you use it as one of many tools to form your work and not a substitute for yourself.
I don't think he was calling everybody that is using LLMs a bunch of noobs. I think he was calling the people using LLMs to submit code they don't understand a bunch of noobs. I think if the patches were well reasoned and could be talked about in detail by their submitters, he'd have much less of a complaint.
There’s also the other side of the same coin where maintainers ignore your contributions. I’m happily forking things permanently and will likely rewrite them on cleaner foundations. I’ve never loved my tools more than I do now when I can get them coded at the same pace I think of them.
On the other hand, it’s been clear for a while that software as we knew will end up at a close to 0 marginal value.
It's strange working on Opensource these days. I've mostly worked on my own stuff alone which usually doesn't get much attention/additional contribution. Then I see on Reddit, HN or LinkedIn someone creating a major App or Plugin in a weekend. Sometimes I take a closer look the artisanal quality is effectively unmaintainable, at least for humans. But in the end it's hard to get a good overview, and the sheer quantity seems to dwarf any other efforts.
Not to mention how the code can then be sourced by an AI model in an instant without any credit.
The headline here is off, PS5 Linux relies on bugs for installs, and the project couldn’t keep the last know hypervisor bug secret:
> Slop kiddies found the only hypervisor bug left, which I had also found a while ago, and decided to report to Sony,” the modder said on social media. “I asked them to at least wait for GTA 6 to come out so that people would have the opportunity to legally purchase the game and also enjoy linux. They agreed to wait, but not a day passed and they decided to waste it instead.”
So what has really happened is the LLMs have lowered the participation floor for this space enough the dynamics are changing. The new comers would rather have a few dollars vs. the founders who would rather have a project. It’s likely the projects days were numbered either way because Sony could also just take a frontier LLM and examine any released installer for the project and reverse engineer and bug.
I think the reason to not invest your time in PS5 linux is that sony hates it and will patch it away over and over, and nobody really wants it. It's $200, mediocre hardware.
I might be showing a lot of unc energy here, but if you can't afford a raspberry pi or something to play with linux, or a used pc, gaming and having a playstation 5 should be de prioritized for a bit while you get your life together.
> it seems that vibe-coders, or “slop kiddies” as the modder dubbed them, used AI to detect a bug that they were using to crack consoles, and reported it to Sony for a bounty.
That would indeed be incredibly demoralizing, even crushing. Quite a dick move.
Now that said, I imagine it was only a matter of time anyway until Sony found/fixed or someone else did the same thing. It's just a different world now.
As much as I'd love a non locked down PS5, anyone buying one knows what they're getting. If you care about user empowerment, PC (Valve hardware, etc) is the place to put your money and time. Sony is actively hostile toward you and wants you locked down, and trying to fight it with exploits is destined to be a nasty cat and mouse game. Go with a vendor that is more aligned to your values.
Fascinating times we live in, when "the last hypervisor bug" in what is presumably one of the most hardened pieces of consumer hardware can be found by "noobs" and "slop kiddies".
> “Slop kiddies found the only hypervisor bug left, which I had also found a while ago, and decided to report to Sony,” the modder said on social media. “I asked them to at least wait for GTA 6 to come out so that people would have the opportunity to legally purchase the game and also enjoy linux. They agreed to wait, but not a day passed and they decided to waste it instead.”
Ever since consoles became moving targets there's been deliberate gatekeeping - specifically, drip-feeding of bugs - to maximize the chance someone can actually use them to break DRM and install Linux. This relies on the fact that most people do not want to have to become FreeBSD kernel experts in order to install non-PlayStation software on their PlayStation. But if everyone is vibe-hacking their PS5s then none of this logic applies. Any bug Claude can find is one Sony also knows about and will get patched, possibly before you even release an exploit for it.
How this ultimately plays out depends on if it's even possible to write software without bugs. Maybe this reaches a new equilibrium where people are paying Claude to vibe-code jailbreaks - as I'd initially hoped. But it's equally as likely that this winds up reinforcing DRM rather than weakening it, for a few reasons:
1. Anthropic's AI safetyism culture encourages the prohibition of vibe-coded jailbreaks. The fact that the model runs on a server and people are spying on your chatlogs means Anthropic has actual knowledge of who is actually using their service to find PS5 hypervisor bugs. Letting Claude break DRM is legally risky; DMCA 1201 implies the only lawful way to break DRM is for you to find your own bugs. So it's probably not going to be long until everyone vibe-coding jailbreaks will get banned.
2. Sony will not be getting banned from these services, they will get trusted access as they're big enough for Anthropic to sue if it gets misused.
3. The attack surface of the thing you have to actually compromise to get code execution on any locked-down system is really small. The Xbox 360 had a 15+ year gap[0] of no softmodding because they'd isolated all the memory protection into a hypervisor. Apple learned the same lesson and iPhone jailbreaking went from incredibly commonplace to "if you know how to do it someone at Zerodium will hand you a million dollars to write spyware with it".
[0] AFAIK, the only two actual softmoddable bugs on Xbox 360 were the King Kong hack right at launch, which got patched in like a week, and that BadUpdate thing last year.
> “Slop kiddies found the only hypervisor bug left, which I had also found a while ago, and decided to report to Sony,” the modder said on social media. “I asked them to at least wait for GTA 6 to come out so that people would have the opportunity to legally purchase the game and also enjoy linux. They agreed to wait, but not a day passed and they decided to waste it instead.”
If one user could have found this using AI. Then I would imagine anyone else could have found it.
Then I would imagine anyone else could have found it.
Right, including Sony. AI finding security flaws is very good in general, but one downside is that it will become easier to make "secure" devices that are hostile toward their owners.
Sure, but that wasn't what I was getting at. The guy is complaining about the exploit being disclosed to Sony, but anyone who used the same tools could have found it. It's kind of like complaining that someone has spoilt the ending to a film when it been out for over a year.
> If one user could have found this using AI. Then I would imagine anyone else could have found it.
People are still fixated on using AI to produce code (to reduce salary costs/dev time) rather than using it to audit bugs in one own's code, which they are better at.
Is the “power of the community” to narc on themselves to the corporations that they are building their community around, only to have the corporations destroy the community’s efforts?
Because that’s what happened here. This isn’t a case of gatekeepers self selecting out.
This is a case of slop kiddies making it impossible for him to continue to do his work by reporting it to Sony for personal profit and having them lock down the exploits he was using.
If that’s the power of the community, if that is the future, then he is right and you are wrong.
This is not a case of a gatekeeper slowing down development. This is a case of the slop kids making it fucking impossible to continue development.
This is the worst outcome and your brain is so cooked by AI that you’re seeing it as the opposite.
Where is the AI generated Linux kernel for PS5?
What lockdown corporate product have the slop coders managed to put Linux on? Anybody vibe cracked an oculus headset or Apple Vision Pro or the Xbox?
Some individual profited and the community ended up with less.
LLMs make excellent people better and mediocre people confident, from first hand experience working with both and asking both cohorts to show me how they use them.
>The community can now contribute code and solve issues more faster rather than a handful of people gatekeeping slowing down development
Everyone hates gatekeeping until they don't. Watch quality go down, issues increase, project direction become muddied, and suddenly people will be calling for more gatekeepers!
Same thing did happen to many work places. People at all levels proxy questions through LLMs and don't even bother to read/trim/edit the response.
Funny, how suddenly a tight, 1-2 sentence response on point is a sign of skill.
Wasn't it always?
Communicating well has always been a sign of skill. Talking to most devs was like pulling teeth even before LLMs.
And once in a blue moon something good comes out of it back to the real project.
It is insane just how miserable the experience of FOSS hardware hacking in public is.
The expectation does not even the slightest match reality. You'd think "ah yes many eyes meaning all bugs get shallow", but instead you get worst of XDA-Developers and toxic wastelands where no sane person even answers anymore.
But this predates LLMs and was as miserable as it is now before as well.
In fact, I might even argue that LLMs made this _better_, because you can now avoid the "opening up in hopes of finding 1 helpful person below 99 annoying ones" through simple GPU compute.
Previously, you had to hope that through this self-inflicted horror, you'd find an expert that can augment you. Now that expert rests on huggingface.
It's still.. not perfect, of course. But it might be less miserable - provided that you adapt to the current state of things and stop with the "trawling for volunteers".
__
Of course, this does not help you against "skids let claude find bugs that you'd need and burn it for no reason" as per the twitter thread, but I wouldn't rule out that they would not have done that, if less information was public.
And.. that too was an issue before LLMs.
Information wants to be free, but so does your cat, and your cat gets run over by some crackhead in a 30 year old rusty pickup if you just put it outside without thinking.
So don't let it go out unattended.
the idea of gatekeeping is often seen as elitist or exclusionary (fairly enough in many cases) but i think this can be an exaggerated description of a culture that necessarily requires a standard of... let's say, desire to engage with material on a sufficiently deep level. many things can be for anybody, but they are not for everybody.
in the past i've seen the phenomenon of "opening up" subcultures or previously-niche intellectual/art fields described as democratization but i think that ignores a big part of what causes this, which can more accurately be described as commodification. access to difficult things was formerly measured by one's ability to expend effort in order to get there (ignoring, for now, the structural conditions that set one up for success in that effort). when these things are commodified, these efforts and identities become products to purchase, the right to which is nearly never limited; in fact, it's almost seen as evil to imply that they should not be available to any individual at any time that individual may desire access.
i know we all have to start somewhere, but there has always been some historical filtration that leads people who are not truly engaged with a subject on a deep level to disengage at some point. that's changing at a novel rate and scale across so many subcultures. it seems like a lot of us are just surprised at how many people even want access to what were once our sanctuaries and we're not capable of grappling with what it takes to adapt to these changes.
i don't think this will pass or that things will return to "the way they were" but there will always be pockets that resemble previous subcultural forms. we just have to re-learn how to identify them with a keener eye and how to better avoid or more-appropriately interact with those who have a more superficial interest in them.
This is definitely the case for me. Before AI tools became mainstream, it was already a difficult proposition to find other smart people who you could get along with and talk to, do something interesting together. The Internet made all the difference in my life because I was able to get outside my geographic region to do big things through open source and hacker communities. Now, that very important filter mechanism no longer works. It's Eternal September all over again. In a way, it's very much a domination of "ends" over "means" in the wider community that is being forced upon those who long focused on "means". For a lot of intelligent people, understanding something is /valuable on its own/, but for the wider world there is no value in simply knowing things, but what you do with that knowledge (or now that lack of knowledge). I even experienced this recently at DEFCON 34 where I saw other participants in some of the CTFs with me using AI tools and not really understanding what the tools were doing or what was happening, but just kind of bruteforcing/tokenmaxxing their way through. This isn't to say that those AI tools are fundamentally a bad thing to use in building open source software, security research, or even as a tool in a CTF, but that the "understanding" step needs to still be present or it destroys the fun in everything.
I'm certainly not having as much fun with computers these days, even as I've invested a lot of effort myself in local LLMs and trying to understand the tools and understand how to apply them reasonably, I've found I prefer much more analog entertainments. Thankfully there's always photography and lockpicking to entertain me at the moment and provide a pathway to meet other interesting fellows.
People who hate their job of course like to come out of the woodwork and say no one should enjoy it, but isn't it nice to have a society where at least some people can enjoy their work? I used to enjoy teaching but I'd never get a teaching job now because of how AI is being used in that sector.
Technophiles will say that we should embrace the future because its inevitable but how many good people quitting does it take before they realize that a vibe-coded future of fun isn't all there is to life?
That’s an interesting question. I thought about it for a minute and was surprised that I came to the conclusion that the answer isn’t obviously “yes”.
An analogous question is “isn't it nice to have a society where at least some people are rich?”, and I think that question should make it clearer to many people why that is so.
I haven’t yet started disabling issues. Let’s hope it doesn’t come to that.
remember hacktoberfest 2020? that's just all public-facing source 365 days a year now, except instead of "updated README.md" it's some vaguely-plausible fix... then you read the PR body and someone couldn't even be bothered to, or, just as likely couldn't explain it themselves. and that sort of sinking dread sets in.
Oh man, if you read the threads about that it's such a time capsule of a different era:
e.g. from this thread: https://news.ycombinator.com/item?id=31628342
> I am honestly surprised how little SPAM there is on GitHub in general. Please don’t take that as a challenge!
At first, my brain parsed "spam" as in ye olde email spam. It took a moment for it to sink in that you meant code spam, instead.
But now that the two concepts are linked in my little pea brain: I kind of want to see how a system like SpamAssassin would work when applied to pull requests like it has been applied to email.
It can use reputation, real-time blacklists, triggers for form, and et cetera, with weighted scores for every aspect that are ultimately factored into one final score.
If final score is passing, the PR is presented for a human to review like a PR was (say) 5 years ago. If the final score fails, it goes into the circular file where it will probably die.
I entirely sympathize with these maintainers too. I've had 2 instances where an LLM has surfaced a bug and I just couldn't get myself to open a PR and dump more work onto these maintainers, even after manually writing one up (neither were critical bugs, it's fine).
Seeing popular projects (like hermes) having 5k issues and 5k pull requests is madness.
For example, I recently came across Hucre, https://github.com/productdevbook/hucre, which is a JS spreadsheet library apparently developed entirely in the past few months and which has already gained 2.2k GH stars.
Is it any good? Who knows, but the alternatives for spreadsheet handling in JS aren't great, either being limited, semi-commercial, or unmaintained. And creating a new one without LLM-assistance is a huge, painful, mostly thankless undertaking. It's not surprising that a zero-dependency option that promises to do everything this can do would be popular.
Everyone has had the experience of butting their head against functionality limitations of open-source libraries. Fully vibecoded libraries will be able to add functionality at a rate that human-authored ones can't. Code quality might suffer, but if a library has a feature you need, and you've got a deadline to hit, are you going to avoid using it? Is the average developer? Or the average LLM?
I think we're about to hit an interesting period of human-only projects competing with vibecoded ones, and it'll be an acid test as to whether the pro and anti claims about AI-coding bear out in terms of code reliably.
Why not set up a triage bot with only read permissions on the project and restricted network access in order to triage issues?
Perhaps this way one could turn the influx of spam into a source of useful information.
It's an issue that the dev attempted to collect the bug bounty, AI or no
https://x.com/theflow0/status/2099987019954831744
Vibecoding has been the norm for months, it's the embargo violation today that triggered his resignation.
You know, it’s petty, but I think one of the things I hate the most about AI is that it surpassed front end JavaScript frameworks in terms of changing what the standard is every few years.
What’s the point of learning anything if it becomes obsolete faster than the seasons change?
It was the downstream effect of the browser wars settling down and W3C making big moves on getting vendors to finally implement standards that were sorely needed. It had nothing to do with web dev culture.
Sounds like he is salty that somebody found an exploit using LLM that he found manually (which probably took a significant amount of time.) I can partly understand it, but I mean that's also just the game that somebody else might find an exploit, LLMs just make it easier. LLMs finding bugs is not a bad thing, just sucks for enjoyers of open source software in this particular case.
You can probably find more though.
This guy has used on working with people that understand the scene, it seems that they were in contact, they agreed on something and then the next day they did something different.
This is really important in the context of what happened and probably the cherry on top of the current "hacking" cake, with the bar being lowered so much that anybody can jump in with some minor skill and luck and get something just for themselves.
Nope. He is salty because someone made public the secret exploit that Linux-on-PS5 apparently relies upon to bypass Sony's hypervisor protection. Now Sony will fix the exploit, and there will be no more Linux on the PS5 until another exploit is found.
To quote Dr Ian Malcolm:
"If I may... Um, I'll tell you the problem with the scientific power that you're using here, it didn't require any discipline to attain it. You read what others had done and you took the next step. You didn't earn the knowledge for yourselves, so you don't take any responsibility for it. You stood on the shoulders of geniuses to accomplish something as fast as you could, and before you even knew what you had, you patented it, and packaged it, and slapped it on a plastic lunchbox, and now [bangs on the table]"
But I guess Sony being a gatekeeper wasn't a gatekeeper enough for certain regulatory agencies.
I have no issue with people using them to do things they could already do themselves as an efficiency thing and if they check and understand the result.
Unfortunately that seems to be the exception not the rule and the amount of "one shot slop" has increased dramatically, it's even affecting the modding communities for games.
This is gonna be a mess that is going to take time to figure out and then even more time to clean up.
You shouldn't, unless you're producing a bunch of code you don't understand.
That wasn't even the claim...
On the other hand, it’s been clear for a while that software as we knew will end up at a close to 0 marginal value.
Not to mention how the code can then be sourced by an AI model in an instant without any credit.
Hopefully "people" doesn't mean scrapers
> Slop kiddies found the only hypervisor bug left, which I had also found a while ago, and decided to report to Sony,” the modder said on social media. “I asked them to at least wait for GTA 6 to come out so that people would have the opportunity to legally purchase the game and also enjoy linux. They agreed to wait, but not a day passed and they decided to waste it instead.”
So what has really happened is the LLMs have lowered the participation floor for this space enough the dynamics are changing. The new comers would rather have a few dollars vs. the founders who would rather have a project. It’s likely the projects days were numbered either way because Sony could also just take a frontier LLM and examine any released installer for the project and reverse engineer and bug.
How old was this bug? How much energy has been devoted to RE of this proprietary console? Not enough, apparently.
I might be showing a lot of unc energy here, but if you can't afford a raspberry pi or something to play with linux, or a used pc, gaming and having a playstation 5 should be de prioritized for a bit while you get your life together.
That would indeed be incredibly demoralizing, even crushing. Quite a dick move.
Now that said, I imagine it was only a matter of time anyway until Sony found/fixed or someone else did the same thing. It's just a different world now.
As much as I'd love a non locked down PS5, anyone buying one knows what they're getting. If you care about user empowerment, PC (Valve hardware, etc) is the place to put your money and time. Sony is actively hostile toward you and wants you locked down, and trying to fight it with exploits is destined to be a nasty cat and mouse game. Go with a vendor that is more aligned to your values.
It's just boring. And the people that crow about "their" accomplishments are tiresome.
Ever since consoles became moving targets there's been deliberate gatekeeping - specifically, drip-feeding of bugs - to maximize the chance someone can actually use them to break DRM and install Linux. This relies on the fact that most people do not want to have to become FreeBSD kernel experts in order to install non-PlayStation software on their PlayStation. But if everyone is vibe-hacking their PS5s then none of this logic applies. Any bug Claude can find is one Sony also knows about and will get patched, possibly before you even release an exploit for it.
How this ultimately plays out depends on if it's even possible to write software without bugs. Maybe this reaches a new equilibrium where people are paying Claude to vibe-code jailbreaks - as I'd initially hoped. But it's equally as likely that this winds up reinforcing DRM rather than weakening it, for a few reasons:
1. Anthropic's AI safetyism culture encourages the prohibition of vibe-coded jailbreaks. The fact that the model runs on a server and people are spying on your chatlogs means Anthropic has actual knowledge of who is actually using their service to find PS5 hypervisor bugs. Letting Claude break DRM is legally risky; DMCA 1201 implies the only lawful way to break DRM is for you to find your own bugs. So it's probably not going to be long until everyone vibe-coding jailbreaks will get banned.
2. Sony will not be getting banned from these services, they will get trusted access as they're big enough for Anthropic to sue if it gets misused.
3. The attack surface of the thing you have to actually compromise to get code execution on any locked-down system is really small. The Xbox 360 had a 15+ year gap[0] of no softmodding because they'd isolated all the memory protection into a hypervisor. Apple learned the same lesson and iPhone jailbreaking went from incredibly commonplace to "if you know how to do it someone at Zerodium will hand you a million dollars to write spyware with it".
[0] AFAIK, the only two actual softmoddable bugs on Xbox 360 were the King Kong hack right at launch, which got patched in like a week, and that BadUpdate thing last year.
If one user could have found this using AI. Then I would imagine anyone else could have found it.
Right, including Sony. AI finding security flaws is very good in general, but one downside is that it will become easier to make "secure" devices that are hostile toward their owners.
People are still fixated on using AI to produce code (to reduce salary costs/dev time) rather than using it to audit bugs in one own's code, which they are better at.
The latter has "always" been obvious to me.
I'm sure you do realise you're talking about yourself?
Is the “power of the community” to narc on themselves to the corporations that they are building their community around, only to have the corporations destroy the community’s efforts?
Because that’s what happened here. This isn’t a case of gatekeepers self selecting out.
This is a case of slop kiddies making it impossible for him to continue to do his work by reporting it to Sony for personal profit and having them lock down the exploits he was using.
If that’s the power of the community, if that is the future, then he is right and you are wrong.
This is not a case of a gatekeeper slowing down development. This is a case of the slop kids making it fucking impossible to continue development.
This is the worst outcome and your brain is so cooked by AI that you’re seeing it as the opposite.
Where is the AI generated Linux kernel for PS5?
What lockdown corporate product have the slop coders managed to put Linux on? Anybody vibe cracked an oculus headset or Apple Vision Pro or the Xbox?
Some individual profited and the community ended up with less.
Everyone hates gatekeeping until they don't. Watch quality go down, issues increase, project direction become muddied, and suddenly people will be calling for more gatekeepers!