Pasting a huge AI generated explanation to a problem in an issue or pull-request is nothing but RUDE.

[safigo@c.im]

@bagder I maybe missing something, but what do you have an example?
I think it’s better than no description at all

[mk@bsd.network]

@safigo @bagder false dilemma.

[bagder@mastodon.social]

@safigo https://github.com/curl/curl/issues/21782 and https://github.com/curl/curl/issues/21779 for example

[woosh@social.linux.pizza]

@bagder I think this is an instance of "If you couldn't be bothered to write it, I can't be bothered to read it."

[lstoll@tinnies.club]

@bagder I think my favourite take on this is "if you didn't take the time to write this, why do you think I should take the time to read it"

[malwareminigun@infosec.exchange]

@bagder Pasting an AI response as long as it's accurate and the person pasting it clearly understands what's going on can be OK. It's the clearly "this person is being a crappy conduit to a chat bot somewhere" behavior that sucks.

[safigo@c.im]

@bagder now I see. You were too polite in your description. I thought it would be a PR with a description generated by LLM.
Your cases are just copy paste from a LLM after asking it to find a security issue, without understanding or even not reading an answer…

It’s sad…

[safigo@c.im]

@bagder I do not manage an open source project, but even in my experience it happens much more often than I’d like to

[safigo@c.im]

@mk @bagder why?

[breathoflife@infosec.exchange]

@bagder

i love how llms are good at finding bugs, but not actually providing a fix for them.

the one thing an automated llm would be useful for it doesn't actually do lmao

(god... imagine not having to spend hours fixing bugs and security vulns in the code)

[malwareminigun@infosec.exchange]

@bagder @safigo Yeah these are awful.

[bagder@mastodon.social]

@breathOfLife we use several AI powered tools that are pretty good at generating patches as well. They often aren't 100% correct, but I find even 80-90% to be rather helpful. It helps explaining the problem I f ind.

[joshlaw@mastodon.social]

@bagder ai can't write normally when it comes to development

they write stale and robotic because they think that the project requires stale and robotic

(+ emdashes everywhere)

i do agree tho

[maddiem4@raphus.social]

@bagder "Not worth writing, not worth reading" has a delightfully similar cadence to "not my circus, not my monkeys", and in the last year or two it's given me about the same peace of mind.

Of course, for vuln reports, you have to be less picky about who's reporting and what tools they use, as long as the bug is real. A bug's a bug. But in a context where hundreds of people are throwing big token budgets at a single project and largely reporting duplicates, I'd guess the odds of missing something important from a reporter who didn't even bother to write the ticket (let alone do their own dupe-checking diligence) are pretty sparse.

[sharkfie@infosec.exchange]

@bagder @safigo Raymond Chen calls these "being on the other side of an airtight hatchway", which I really like.

Sorry you are dealing with this especially when so overworked from recent security reports.

https://devblogs.microsoft.com/oldnewthing/20221004-00/?p=107246

[fynnnd@mastodon.social]

@bagder honestly, I have a hard time wording things right, so I tested local AI to see if it could help me

I learned that it is worse than I am

[kumarvibe@mastodon.social]

@malwareminigun @bagder even when it’s accurate, though, it’s unpleasant to read — it’s overly verbose, riddled with irrelevant minutiae, and devoid of conversational inflection.

[malwareminigun@infosec.exchange]

@kumarvibe I guess I would consider "contains irrelevant minutiae" as "inaccurate"

I don't think "devoid of conversational inflection" is a problem

[sibshops@mastodon.online]

@bagder @safigo Oh wow, waste of time. Who would pass LONG_MAX to a timeout value?

[bagder@mastodon.social]

@Sibshops @safigo no one, it's just that chase trying to find something that could end up a security issue