Post B6pqSPUpQyLcQjwoAC by glyph@mastodon.social
 (DIR) More posts by glyph@mastodon.social
 (DIR) Post #B6oDSWGaAiJw3cNweW by glyph@mastodon.social
       0 likes, 0 repeats
       
       Due to my somewhat prickly and precise definition of "software ethics" I would not, personally, do this, but I think it's good that someone has. The industry—and the "community", such as it is—needs a wake-up call. The conversation *around* this reminds me of the loud booing from commencement crowds as speakers wax rhapsodic about "AI" destroying their careers and their futures.https://github.com/jqwik-team/jqwik/issues/708
       
 (DIR) Post #B6oDSWV7IfwkmhBYJ6 by glyph@mastodon.social
       0 likes, 0 repeats
       
       Like the fact that I show empathy and understanding and, increasingly, have a sort of "no ethical consumption" / "harm reduction" message about LLM use makes me a bad messenger for the message that not only are LLMs abstractly "harmful" but that there are people who you *are harming* and some of those people are not going to take it lying down.
       
 (DIR) Post #B6oDSWkMO08jXyJj4C by glyph@mastodon.social
       0 likes, 2 repeats
       
       Your chatbot being (hypothetically) momentarily commandeered to delete your local copy of the project that you were *already explicitly forbidden to use it on* is the gentlest possible introduction to this type of direct action and if it happens to you, you should be *very grateful* that this is how you got the message and not via something much more elaborate, insidious, and potentially life-changingly bad.
       
 (DIR) Post #B6oDSXAEpmq8qEQOP2 by glyph@mastodon.social
       0 likes, 0 repeats
       
       Remember that point in history around 2021 where suddenly there was a rush of supply-chain attacks that were all *VERY* focused on infostealer malware that could detect metamask wallets, specifically?  Now imagine that instead of a few threat actors uploading a few scam typosquats, the people who are motivated enough to target you and want to ruin your life are your entire dependency supply chain, and the Metamask that marks you as a target is your Claude Max subscription.
       
 (DIR) Post #B6oDSXTjfIR5ohXxnE by glyph@mastodon.social
       1 likes, 1 repeats
       
       Real talk: the real "supply chain risk" is that you treat your open source "supply chain" like shit and assume that we will all take any amount of abuse from you and just keep doing volunteer labor forever without ever complaining. And, equally real talk: most of us—myself included—actually do love the process and the community so much that you're right, and there will never be any real consequence.But not all of us.
       
 (DIR) Post #B6oQ6zv0XouZ3SMUfg by ska@social.treehouse.systems
       2 likes, 0 repeats
       
       @dalias @jzb @glyph "But it could rm -rf my whole repository!"Yeah. That does sound like a pretty big fucking problem, now, doesn't it?"So it's irresponsible from you not to twist yourself into a pretzel in order to avoid triggering the security issue in my tools!"We are cooked. We are barbecued chicken. Software, if not society, is a pile of charred meat on the grill.
       
 (DIR) Post #B6pqSPUpQyLcQjwoAC by glyph@mastodon.social
       0 likes, 1 repeats
       
       @pfish.zone so much of the maintainer community right now is handwringing about "but if we ban LLM use, how will we tell?" and I am exasperated because the answer is not some sophisticated word-probability detection machine, it is "they will be blindingly obvious about it, and if they manage to not be obvious for a second, they will brag about it, they can't stop themselves"
       
 (DIR) Post #B6q6W9CfYEGyK8G1xo by 0xabad1dea@infosec.exchange
       1 likes, 0 repeats
       
       @glyph @pfish.zone "we can't ban this social behavior unless we have a 100% reliable technical means to detect it" is so programmerbrained
       
 (DIR) Post #B6q6WoxCK8qvoJLGgC by Epic_Null@infosec.exchange
       1 likes, 0 repeats
       
       @0xabad1dea @glyph @pfish.zone It's like these people have never moderated something. A rule like this is a tool you use to get rid of people when you see them acting questionably before things escalate. If someone hides indeffinately, then they are actively avoiding causing obvious behavior. This may be worse... but it's also the kind of thing that isn't going to deteriorate the social environment.
       
 (DIR) Post #B6q6d4AMg4KkjDTkQq by tokyo_0@mas.to
       1 likes, 0 repeats
       
       @glyph @dalias Yes. And even if some people do manage to circumvent the rule by making their violation of it impossible to detect, there is still value in the rule existing to aid handling of all the situations where this is not the case, and those skillful circumventors are still personally liable for any consequences of their own violation of the rule that emerge later simply because the rule exists."Some people might still avoid the rule" is not and has never been a sound reason to not have a rule. "Some people might get away with murder so we won't do anything about the people we actually saw commit murder and who are still stood there holding the smoking gun" makes clear how ridiculous a position it is.
       
 (DIR) Post #B6q6d4QfhRNTXn6lqi by glyph@mastodon.social
       0 likes, 0 repeats
       
       @tokyo_0 @dalias the only answer I've gotten to the question "and what mechanical tooling do you have in place to enforce your other voluntary attestation contribution policies, such as the obligation to not copy and paste your employer's copyrighted code into our codebase" so far is "that's different" but I really don't see how it is
       
 (DIR) Post #B6q6d4gck88cLGZViK by misty@digipres.club
       1 likes, 0 repeats
       
       @glyph @tokyo_0 @dalias Yes, this is the one I always think of. If people acknowledge it at all they say “well having a policy about not accepting copyright infringing code is different” but no one has ever given a meaningful explanation why.
       
 (DIR) Post #B6q6dhu6vv6DyOBKeO by jab01701mid@mastodon.social
       1 likes, 0 repeats
       
       @misty @glyph @tokyo_0 @dalias P1: "I don't take money from criminal enterprises"P2: "But it's laundered so nobody can tell where it come from"P1: "OK, that's cool"
       
 (DIR) Post #B6rD6A50Z0VSLlBqqW by asie@mk.asie.pl
       0 likes, 0 repeats
       
       @0xabad1dea@infosec.exchange @glyph@mastodon.social @pfish.zone@bsky.brid.gy it's really odd. we, as the software community, have successfully banned the social behavior of "offering plagiarized and/or copyright-infringing code to a project". most people in open source don't do it!it annoys me that people seem to act like generative model use is a special category of use that has had no precedent ever. like when AI bros complain about being banned from non-AI art contents, but somehow photography being banned from a hand-drawn art contest is normal and never questioned