I did not spend more than fifteen years honing my craft to be degraded to a babysitter for someone's poor quality tool.

Because every developers favorite part of using code analysis tools has always been sifting through all the false positives.

the source is reading their fucking AGENTS.md you dipshit

Edit: you blocked me, but this was my first fedi account, so yes it's masto.social. Is that the best you've got, mister terminally online who replies in 30 seconds?

There are two possibilities with AI: either it’s a shitty coder or a really good one. The latter is way more terrifying, when you consider the small circle that controls it.

Funny how people that should’ve known why that is the case turn out to have been running a theater all along.

My experience with them is that they do work, they highlight things that is wrong and should fix, things that can be a potential security issue, etc. But so far, I have yet to see it highlight something that a non-AI static analysis tool would find with a fraction of the resources.

It can bug about things that isn't an issue, this is something that the "old" tool does as well. So, all in all, higher resource use for about the same output.

What can LLM tools do that the old tools could not? Of course, they can suggest a fix.

That part is the dangerous one. Using LLM to detect potential issues should not come at a high risk, though the benefit compared to existing tools now seems low. This might improve over time, I dunno...

Using them to suggest patches has a high risk of patches being applied without enough critical evaluation. Not ok.

@davidgerard

I agree with all the rest too, it's a slippery slope. I'm not ready to throw out the baby with the bathwater, but it's going suspiciously sideways fast.

Honestly I've been suspicious of Graphene for a while because its proponents have a tendency to be shills. Top results for "Degoogle" on YouTube are often fear mongering.

Great resources, will check them all out!