I am sorry to say Graphene has fallen to the slop.

[piffio@mastodon.social]

@davidgerard That sucks.

I wonder if anyone has started making up a list of untainted/ethical/respectable OSS projects, as it's becoming increasingly hard to find projects that haven't given up to the broligarchs.

If not, should we start one? I reckon it might be depressingly short.

[robinsyl@meow.social]

@shimst3r @davidgerard I think I posted this in another thread but like, I should start creating issues saying a random block of code has a vulnerability. They must take my issues seriously because what if I am right and they miss out on a valuable report?

[haverholm@radikal.social]

@piffio I'm not sure there is a list with both criteria, but I've seen a few #NoAI lists floating about.
* https://noai.starlightnet.work/list.html
* https://noailist.org/
* https://codeberg.org/brib/slopfree-software-index

...of course I can't find the first one I thought of right now. Edit: found it! Added to top of list.

@davidgerard

[contrasocial@mastodon.social]

@davidgerard

I was always suspicious of the fact that they focused mainly on using Google hardware honestly. They claimed it was because it has the best security features, but then go and use a method of generating code that's notorious for creating security problems?

[oheso@ieji.de]

@davidgerard Only the finest artisanal slop

[zimzat@mastodon.social]

@davidgerard A cursory glance at their posts suggests they're stressing it isn't vibe *coding* if it's only "auditing" existing code?

Which is a very fine line that still results in /using/ the slop machinery.

I wish the software development ecosystem would fix the underlying architectural problems rather than keep brushing them under the rug. But we're now all so entrenched in arguing to slop or not to slop that few are talking about what it means not to slop.

[bredroll@mas.to]

@haverholm @davidgerard they may well just be "tools" but they are tools created by stealing the work of our artists, writers and musicians and free software legacy, tools that are run by companies that cant even spell "ethics" let alone coherently define it with a straight face.

[raccoon@fedi.raccoonden.moe]

@davidgerard
Time to switch to a fairphone with calyx next time I have to change phone

[mansalia@social.maid.zone]

@davidgerard
You posts atrract immense amounts of whiny imbeciles with reading impairments

[haverholm@radikal.social]

@Bredroll @davidgerard Narrator: "They were not, in fact, only tools"

[sorro@woof.tech]

@davidgerard

[engideer@tech.lgbt]

@zimzat @davidgerard This post makes it sound like they're using it for code generation too; the same "oh but it's just a developer's private test branch" shtick as with the Bun Rust migration:

https://grapheneos.social/@GrapheneOS/117227346006458958

Plus, their AI-generated AGENTS.md explicitly talks of code generation, so yeah. I can imagine them perhaps being a tad more careful than many sloppers, but even then, AI use has this tendency to make the user less careful and less capable over time.

[piffio@mastodon.social]

@haverholm @davidgerard

Great resources, will check them all out!

[davidgerard@circumstances.run]

@zimzat also it never, ever stays true. It's another "i'm totally not vibe coding, I'm" [list of things anyone else would call abject vibe coding]

[zimzat@mastodon.social]

@engideer @davidgerard Thanks, that specific message is a lot closer to an explanation of what's going on. It's the libertarian "personal responsibility" CYA.

I agree with all the rest too, it's a slippery slope. I'm not ready to throw out the baby with the bathwater, but it's going suspiciously sideways fast.

Honestly I've been suspicious of Graphene for a while because its proponents have a tendency to be shills. Top results for "Degoogle" on YouTube are often fear mongering.

[engideer@tech.lgbt]

@zimzat Yep def same, wouldn't know of an alternative that checks all my use cases as of now, unfortunately. Same goes for the Linux kernel etc after all. But at least one can adjust their expectations accordingly knowing this

[helpstertee@social.helpsterte.eu]

@davidgerard@circumstances.run oh nice they are not even arguing against the social and environmental problems and just talk about tool efficiency.

guess as long as Soylent Green meets the nutritional macros…

[lettosprey@tech.lgbt]

@shimst3r We have AI tools at work doing these kinda "review tasks" automagically, and report potential issues.

My experience with them is that they do work, they highlight things that is wrong and should fix, things that can be a potential security issue, etc. But so far, I have yet to see it highlight something that a non-AI static analysis tool would find with a fraction of the resources.

It can bug about things that isn't an issue, this is something that the "old" tool does as well. So, all in all, higher resource use for about the same output.

What can LLM tools do that the old tools could not? Of course, they can suggest a fix.

That part is the dangerous one. Using LLM to detect potential issues should not come at a high risk, though the benefit compared to existing tools now seems low. This might improve over time, I dunno...

Using them to suggest patches has a high risk of patches being applied without enough critical evaluation. Not ok.

@davidgerard

[dysfun@social.treehouse.systems]

@FediThing @contrasocial @davidgerard yes but have you considered the new models change everything?

[haverholm@radikal.social]

@piffio Happy to share! @davidgerard