Tridge has responded on the rsync vibe disaster

[davidgerard@circumstances.run]

Tridge has responded on the rsync vibe disaster

https://medium.com/@tridge60/rsync-and-outrage-d9849599e5a0

* you're all dumb haters
* AI is a revolution just in the past few months
* yes there were regressions but,
* the new test suite is awesome you haters
* openrsync doesn't pass the new test suite! ha, you fools! well that's cos it targets an older version but,

at least it reads like he wrote it by hand

i can pick the particular mastodon posts he's reacting to here

[dysfun@social.treehouse.systems]

@davidgerard

I’d rather be out sailing than working on rsync security issues, so I have reached for several AI tools to help with what needs to be done. I have absolutely no regrets about doing that

you know tridge, i'd rather you were out sailing too.

[bloognoo@retro.pizza]

@davidgerard
You can hear the wind whistling through the hole in their forehead.

[barubary@infosec.exchange]

@dysfun @davidgerard

I have reached for several AI tools to help with what needs to be done

"We do what we must because we can."

[peter_sc@chaos.social]

@davidgerard "People keep telling me gambling is bad, but what they don't know is this: I have a *system*. These new machines are so much more sophisticated, your ideas about how they work are totally outdated. What do you mean 'am I on cocaine?' Of course I am! It's part of the system, dummy!"

[sharkfie@infosec.exchange]

@davidgerard

I’m here to tell you that you are out of date. The world of software engineering has changed dramatically in the last few months.

They are better (I have to use them for work, not primarily a software dev though) but they do still do fundamentally broken decisions that "compile, run, end up with subtle bugs or silent failures". It was impressive until I began having to fix a lot of those.

I wonder if he hasn't gotten to that part.

[quincy@chaos.social]

@davidgerard

To be fair, what he writes, for the most part, doesn't even sound unreasonable to me, if I try to ignore the parts that are AI-pilled hyperbole.

[robinsyl@meow.social]

@davidgerard can we normalize giving a project to someone else if you don't want to maintain it

[shadowjonathan@tech.lgbt]

@davidgerard also what the fuck are these replies glazing him

can you moderate replies as an author?

[addison@nothing-ever.works]

@davidgerard@circumstances.run Honestly, it's just kind of unpleasant to watch. I understand the pressures at play here, re: security-relevant bugs being reported at a higher rate (including some which actually exist). Also, there was a lot of criticism directed towards him for this, some of which was way too personal or rhetoric-laden. That tends to cause walls between people that stifle actual change. I doubt he will change course following this sequence of events.

On the other hand, the dismissal of legitimate concerns and criticisms is really gross to read; rubs me very wrong. It also irks me that he characterises all of the criticism he got as concerns about correctness, and how he addresses even that. I don't care at all if he thinks it's "right"; he hasn't put in nearly the same time or effort or thought as he would have needed to otherwise, and that's what he has 40 years of experience in. I care that it is well-reasoned, and doesn't rely on something so fundamentally problematic for reasons other than efficacy.

I don't know. This whole movement continues to reveal that a huge chunk of open source does not hold the values I expected.

[robinsyl@meow.social]

@ShadowJonathan @davidgerard I know someone with a Medium account and yes you can hide replies you don't like

[david_chisnall@infosec.exchange]

@robinsyl @davidgerard

The problem is finding people who are both willing and able to do it (and not, as with liblzma2, just there for the supply-chain attacks).

This is especially true for codebases written in C with a bunch of idiosyncratic things. I had a quick skim of some of the rsync source and it has a few more comments than a lot of contemporary code, but also some cryptic things. My favourite was an ad-hoc inlined memmove with a comment explaining that memmove didn't handle overlapping regions correctly on 'some platforms' (the only difference between memmove and memcpy is that the former is required to be able to handle overlapping regions). I wouldn't want to take over maintaining it, even if I had time to do so.

That said, I think we do need to normalise projects being done. No new features need to be added, the project is complete.

This is much easier when the project is designed around extensibility, so missing features can be added with external plugins, maintained by other people.

[robinsyl@meow.social]

@ShadowJonathan also possibly some sampling bias as people who use AI are prolly more likely to have a Medium account

[hsza@social.tudbut.de]

@ShadowJonathan @davidgerard chances are you can, but also picture the average individual with a medium.com account

[passocacornio@tech.lgbt]

@davidgerard no, like i get it... i don't know their level of understanding about machine learning, so i will not conflate their feeling overwhelmed by the surge in llm-driven issues reporting with lack of knowledge, also I don't know if any maintainer of rsync is trustworthy enough (in their experience) to pass the project to.
but i do think we need to normalize saying a software is complete more often.
what i mean by complete? that it will not get more features and will only get security updates and at a slowed down pace.
the "move fast and break things" did much more damage to to software engineering than we are comfortable admitting. i don't agree with their main points, but I empathize with the thought processes they are putting "to paper", even the subconscious ones.
anyway, let's migrate to openrsync

[mackensen@higheredweb.social]

@davidgerard it's clear that he doesn't consider any criticisms of his choice legitimate, which rather confirms what his critics are saying.

[davidgerard@circumstances.run]

@dysfun did any of them acknowledge that??

[li@tech.lgbt]

@davidgerard

> Also, nobody actually knows if human intelligence is just finer grained stochastic prediction as well.

lmfao yes we do, people are not LLMs

[dysfun@social.treehouse.systems]

@davidgerard i heard (though haven't seen) that fedora wouldn't take the update and they are all in.

[davidgerard@circumstances.run]

@sharpcheddargoblin he's got a lot to be arrogant about! unfortunately,