<![CDATA[the critiques I've seen of the php patch have little to do with "moral purity" and "feeling icky" and are more about the actual approach to mitigating the problem]]>the critiques I've seen of the php patch have little to do with "moral purity" and "feeling icky" and are more about the actual approach to mitigating the problem

*including* considering the goals and point of view of people whose job that is, so it's not about making unconsidered demands for human labour either

"pick your battles, e.g. complain that AI is hurting artists" it's also hurting programmers and distorting how programming gets done so I'd consider this relevant

]]>https://forum.fedi.dk/topic/464e9bde-013c-4fb8-8d8b-b35f2656fcdb/the-critiques-i-ve-seen-of-the-php-patch-have-little-to-do-with-moral-purity-and-feeling-icky-and-are-more-about-the-actual-approach-to-mitigating-the-problemRSS for NodeSat, 24 Oct 2026 06:07:55 GMTThu, 22 Oct 2026 07:03:08 GMT60<![CDATA[Reply to the critiques I've seen of the php patch have little to do with "moral purity" and "feeling icky" and are more about the actual approach to mitigating the problem on Thu, 22 Oct 2026 07:48:11 GMT]]>also pertinent criticism: people having to spend money on tokens to fix issues found, and to some extent created by, the people selling the tokens

]]>https://forum.fedi.dk/post/https://mastodon.social/users/jcoglan/statuses/117483457199298812https://forum.fedi.dk/post/https://mastodon.social/users/jcoglan/statuses/117483457199298812Thu, 22 Oct 2026 07:48:11 GMT<![CDATA[Reply to the critiques I've seen of the php patch have little to do with "moral purity" and "feeling icky" and are more about the actual approach to mitigating the problem on Thu, 22 Oct 2026 07:05:43 GMT]]>@jcoglan heard conflicting reports on if this particular bug was unearthed by / only practical via LLM-driven programming.

but it sure does remind me of the previous times where there was definitely a LLM-discovered and slopped webpage promoted zero day like, twice within a week.

it really does not increase my confidence in "okay for all the harms I guess they fix security bugs" as explanation when the thing that mostly seems to happen is "surprise new zero-day with no patches" regularly.

]]>https://forum.fedi.dk/post/https://teal.social/ap/users/117295594955528526/statuses/117483290205782113https://forum.fedi.dk/post/https://teal.social/ap/users/117295594955528526/statuses/117483290205782113Thu, 22 Oct 2026 07:05:43 GMT<![CDATA[Reply to the critiques I've seen of the php patch have little to do with "moral purity" and "feeling icky" and are more about the actual approach to mitigating the problem on Thu, 22 Oct 2026 07:03:51 GMT]]>idk it sucks to see analysis like "yeah of course backporting 12kloc patches is hard which is why it's useful to think of other solutions that don't involve 12kloc patches" written off as moral purity testing

"I am concerned this huge patch is a symptom of a lack of design coherence and will just hide further bugs" is not morality policing

"a security patch that is impractical to review is a category error" is not "feeling icky"

]]>https://forum.fedi.dk/post/https://mastodon.social/users/jcoglan/statuses/117483282833783902https://forum.fedi.dk/post/https://mastodon.social/users/jcoglan/statuses/117483282833783902Thu, 22 Oct 2026 07:03:51 GMT