Post B8Xf0zGf6Dh0jvpvU0 by dysfun@social.treehouse.systems
(DIR) More posts by dysfun@social.treehouse.systems
(DIR) Post #B8XdzCzwykvYn5bkTw by ariadne@social.treehouse.systems
0 likes, 0 repeats
it is pretty cool that these AI companies have suddenly decided that FOSS maintainers cannot do the uber-scary-shaking-in-my-boots security scans, but "legitimate cybersecurity practioners" (read: script kiddies) are still able to and will just be sending us AI slop that is impossible to untangle.it is very cool. super cool.
(DIR) Post #B8XepjnUHJD7ZbpHk0 by ariadne@social.treehouse.systems
1 likes, 0 repeats
as a FOSS maintainer, I was willing to embrace the code review functionality in order to stay ahead of the curve of antisocial script kiddie e-trash chasing clout by copy and pasting Fable and GPT-5.6 findings into MITRE's new CVE formbut now I have to:- make a business entity to represent my activities as a FOSS maintainer, because they do not provide this functionality to individuals- pay business entity pricing to OpenAI & Anthropic- beg OpenAI & Anthropic for access to scan my own fucking code as the BUSINESS ENTITY
(DIR) Post #B8Xesi84w50lGksKNk by ariadne@social.treehouse.systems
0 likes, 0 repeats
so i think my new policy on Mythos bug reports is "fuck you"
(DIR) Post #B8Xf0zGf6Dh0jvpvU0 by dysfun@social.treehouse.systems
0 likes, 0 repeats
@ariadne i think it's rather moderate a stance. mine is "fuck you and the horse you rode in on"
(DIR) Post #B8XfCv9qCpvpT4Kvaa by whitequark@social.treehouse.systems
0 likes, 0 repeats
@ariadne oh, is this bc they got sanctioned or something
(DIR) Post #B8XfI3MF96noLcaK4O by ariadne@social.treehouse.systems
0 likes, 0 repeats
@whitequark i don't know, but i requested an audit and it was like "nah, we take CYBERSECURITY VERY SERIOUSLY!!!!!!!!!!!!111111 no audit for you"
(DIR) Post #B8XfM40Cgw7lVNBjmq by whitequark@social.treehouse.systems
0 likes, 0 repeats
@ariadne how tiresome
(DIR) Post #B8XfNozxRlh3YAua2K by ariadne@social.treehouse.systems
0 likes, 0 repeats
in fact, i think i am going to intentionally write shitty code moving forward, because why bother caring about security anymore(edit: to be clear, i'm being sarcastic here. we remain committed to fixing legitimate bugs in pkgconf & friends, but we do not want to wade through AI slop to do it.)
(DIR) Post #B8XfdrOoHwBrd6BSm8 by ariadne@social.treehouse.systems
1 likes, 1 repeats
also, in case it was not obvious, if you submit any bug to any of my projects that was actually written by Claude or ChatGPT, you will just straight up be banned from the project.i don't care anymore. fuck these assholes.
(DIR) Post #B8Xfyc44UrJY9TNZdA by cr1901@mastodon.social
0 likes, 0 repeats
@ariadne I will follow your example with great interest :D!
(DIR) Post #B8XgIWNvK8PoKO9qtc by ariadne@social.treehouse.systems
1 likes, 0 repeats
i'm sorry it has come to this but my time for FOSS maintenance is limited & highly valuable: i would rather be spending time with my family than sifting through AI slop reports for legitimate ones.and, while i care about the foundational FOSS software I maintain, if I cannot mitigate the impact of this technology by running the scans myself (so that they come back clean when the script kiddies run them), then frankly, I don't want to play anymore.
(DIR) Post #B8XgT9vj9O1Ns42eZs by ariadne@social.treehouse.systems
0 likes, 0 repeats
@dysfun i am willing to pay for a subscription in order to run the scans. my time is that valuable.
(DIR) Post #B8XgjgIUZsfqtCZIEC by whitequark@social.treehouse.systems
0 likes, 0 repeats
@ariadne no yeah totally reasonable. not wanting to participate in their marketing stunts is quickly looking like the only viable position
(DIR) Post #B8XgmG36clR4LobGSW by ariadne@social.treehouse.systems
0 likes, 0 repeats
@dysfun no, i did not really like the initial plan of "lets give script kiddies access to a hack anything model", but at least I could mitigate it in my neck of the woods by staying ahead of the script kiddies.
(DIR) Post #B8Xh5aTQuUKFCO8Coq by ariadne@social.treehouse.systems
0 likes, 0 repeats
at any rate, formally banning the AI code scanners & script kiddies using them is not a mitigation, but that's why I bought a pair of RTX 6000 blackwells and rebuilt my old Threadripper box into an LLM inference server.and there are self-hosted models that are just as good that you can use instead: GLM and Qwen found all of the same bugs Mythos did.
(DIR) Post #B8XhHOr9veFIdwrUQa by gsuberland@chaos.social
0 likes, 0 repeats
@ariadne Mythos is completely uninteresting anyway, imo. there's so little difference between it and other premium models. certainly far less of a difference than having someone vaguely competent checking the output or not.
(DIR) Post #B8XhPUe4I23Ouib7ia by ariadne@social.treehouse.systems
0 likes, 0 repeats
@gsuberland exactly.
(DIR) Post #B8XhTC25QuKmLWb2Rs by ariadne@social.treehouse.systems
0 likes, 0 repeats
@dysfun @gsuberland oh gnoes, sounds like it's WORKING AS DESIGNED
(DIR) Post #B8XiTRe7Tyhuiz4Ozg by ariadne@social.treehouse.systems
1 likes, 0 repeats
fuck AI, seriously. they force us to deal with AI slops and then won't give us the tools to mitigate the AI slops.you DO NOT under ANY circumstance act like there is a bug and REFUSE to tell the MAINTAINER what the fuck it is.
(DIR) Post #B8Xj16lNdBZdnrWAYi by ariadne@social.treehouse.systems
0 likes, 0 repeats
@dysfun how the fuck are maintainers expected to defend when they are not 'trusted cybersecurity professionals'.
(DIR) Post #B8Xj8kiFUwiBjPhMUC by ariadne@social.treehouse.systems
0 likes, 0 repeats
@dysfun i mean, last time i checked, i am a well-known cybersecurity professional
(DIR) Post #B8XjEeoGMGzdA3KKfo by ariadne@social.treehouse.systems
0 likes, 0 repeats
@dysfun seems so
(DIR) Post #B8XjLBYfVsAASy965w by ariadne@social.treehouse.systems
0 likes, 0 repeats
@dysfun if only, that seems like a dope career
(DIR) Post #B8XlvcBuAbHtOqzs6S by ariadne@social.treehouse.systems
0 likes, 0 repeats
@wren6991 no, it ran a fuzzer, which probably reported nothing of interest. and then it was like "ZOMG CAN'T SHOW YOU THE RESULTS"
(DIR) Post #B8XmHZJ3Zkgsp9oIhk by ariadne@social.treehouse.systems
0 likes, 0 repeats
@dysfun i mean, yes
(DIR) Post #B8XmZoDqrBY0IX4c76 by ariadne@social.treehouse.systems
0 likes, 0 repeats
all of this is more politely stated on LinkedIn: https://www.linkedin.com/posts/ariadneconill_as-a-foss-maintainer-who-specializes-in-building-share-7485120440890314752-ot6n/
(DIR) Post #B8Xmkof3Z8XcqP2yCe by ariadne@social.treehouse.systems
0 likes, 1 repeats
@nullenvk @agturcz to be clear, i don't CARE what their motive is. it most likely is ignorance.but i am not going to set up an LLC, go through the pain of acquiring another DUNS number (seriously, i would rather chew glass than do that ever again) and pay for a business-level subscription that may or may not be approved.they want to externalize the cost of releasing capabilities to script kiddies, they can fucking level the playing field for maintainers or fuck off.
(DIR) Post #B8XnE0du695cOyQbhI by imrehg@fosstodon.org
0 likes, 0 repeats
@ariadne this is wild! They really had to go out of their way to build this "hide stuff from the user" feature, isn't the conversation log held locally? 🤔 (Though I don't use OpenAI, I wouldn't know, all the others I tried should have local first convo logs)
(DIR) Post #B8XnHdJol3iJDplF7w by ariadne@social.treehouse.systems
0 likes, 0 repeats
@imrehg the streaming response API has provisions for 'safety refusals'
(DIR) Post #B8XnOuD0MLExdJ2fce by imrehg@fosstodon.org
0 likes, 0 repeats
@ariadne so server side peek-a-boo, of course! 🙃
(DIR) Post #B8XnZ8kx7v6heBnjYe by ariadne@social.treehouse.systems
0 likes, 0 repeats
@beaiouns as a maintainer, *thank you* for taking the time to write thoughtful, detailed and accurate reports ❤️
(DIR) Post #B8YAscsRezjhVsZAbw by peterrenshaw@ioc.exchange
0 likes, 0 repeats
@ariadne one assumes so, (I’ve added all my shite, early hack code to github by default) the contrast talking about security then suggesting that is a filter for readers ☺️
(DIR) Post #B8YlfEaiL9lojNkZw8 by juliancalaby@social.treehouse.systems
0 likes, 0 repeats
@ariadne This really sounds like a situation where someone like, say, the Linux Foundation, should step in and provide a pathway for maintainers like yourself to have functionally free access to these models for this precise reason, yet...
(DIR) Post #B8ZH69NWvT4uxhtjiC by ariadne@social.treehouse.systems
0 likes, 0 repeats
@bcasiello yeah basically
(DIR) Post #B8ZI3GBtF2RjAvdgtk by ariadne@social.treehouse.systems
0 likes, 1 repeats
@juliancalaby oh, no, do not get me started on the linux foundation's incredibly stupid idea: they want to run the scans for maintainers and provide a 'clearing house'.no thanks on that one.
(DIR) Post #B8ZIxzW1ubIPxr6w4W by oblomov@sociale.network
0 likes, 0 repeats
@ariadne @juliancalaby it's fascinating (in a train-wreck-in-slow-motion sort of way) how things end up being tied together.
(DIR) Post #B8ahqIK7UEfTmzPJ7w by juliancalaby@social.treehouse.systems
0 likes, 0 repeats
@ariadne I'm shocked they're doing something that sensible. I was seriously expecting them to leave maintainers hung out to dry. That suggestion was supposed to be a joke.
(DIR) Post #B8mNCZMYWssfGD7qgi by grahamperrin@bsd.cafe
0 likes, 0 repeats
@ariadne why not link?https://akrites.org/Cc @juliancalaby
(DIR) Post #B8mQjoouNdHacRvvYu by grahamperrin@bsd.cafe
0 likes, 0 repeats
@ariadne I can't empathise, because I'm not a coder. I can empathise, because I've gone ballistic about things in the past.More accurately: people, not things. A sincere thank-you for sharing the link to your LinkedIn post. Not that I'm a fan of LinkedIn (it's far 'worse' than X for AI-generated content), but it's useful here.
(DIR) Post #B8mT95eH9Iw7xZ8cPA by grahamperrin@bsd.cafe
0 likes, 0 repeats
RE: https://social.treehouse.systems/@ariadne/116955097468136397"… I have not fully made up my mind about so-called "vibe coding", …I care about software quality, and have an interest in emergent technologies, so I have tried to approach the AI debate with an open mind. …"@ariadne if you can: remain open.I see a deep, endless ocean of people whose visions have become polarised. Sink-or-swim strategies. The individuals who shout the loudest, and flail their arms, are most likely to drown.Stay afloat. Be a boat, not a swimmer. #AI #strategyRT: https://social.treehouse.systems/users/ariadne/statuses/116955097468136397
(DIR) Post #B8mTwgYEjcDWbIxiPQ by ariadne@social.treehouse.systems
0 likes, 0 repeats
@grahamperrin @juliancalaby because i am not interested in promoting obviously *bad* ideas
(DIR) Post #B8mUGwAEOdJAoZOHMu by grahamperrin@bsd.cafe
0 likes, 0 repeats
@ariadne your writing about Akrites is, in itself, promotion. @ciotbsd wrote about it a month ago – https://billboard.bsd.cafe/post/785 – I forgot about it, you successfully reminded me of the initiative.Cc @juliancalaby
(DIR) Post #B8mUMjxEhioqgW4z5s by ariadne@social.treehouse.systems
0 likes, 0 repeats
@grahamperrin @ciotbsd @juliancalaby okay, well again, i am not interested in promoting bad ideas. please respect this boundary, thanks.
(DIR) Post #B8mUTdW52TPIkEfLBg by grahamperrin@bsd.cafe
0 likes, 0 repeats
@ariadne I preferred your post about open mindedness, but I'll drop the subject here; let's agree to disagree.@ciotbsd @juliancalaby
(DIR) Post #B8mVIJaespzTiIyMXg by ariadne@social.treehouse.systems
0 likes, 0 repeats
@grahamperrin @ciotbsd @juliancalaby there is a difference between being open-minded on a macro scale and being disinterested in something which is, by design, intended to take power & autonomy away from maintainers, and put it in the fucking *linux foundation* of all things.i want to spend my free time with my family, not slaving through reports with deadlines about MY code that I work on voluntarily.
(DIR) Post #B8mVOspclmnIka6YsK by grahamperrin@bsd.cafe
0 likes, 0 repeats
@ariadne my comment was not about about your family, I did read those comments.@ciotbsd @juliancalaby
(DIR) Post #B8mVSonFj3sTNss73Q by ariadne@social.treehouse.systems
0 likes, 0 repeats
@grahamperrin @ciotbsd @juliancalaby like i do not think you understand how close all of this AI stuff is to making me no longer be a participant in free software at all, or working a tech job at all.
(DIR) Post #B8mVkQsJOOluPndZY0 by grahamperrin@bsd.cafe
0 likes, 0 repeats
RE: https://mastodon.bsd.cafe/@grahamperrin/116995110893781325@ariadne I was sincere about empathy.Ask me about ceasing to participate; about resignation; about closing my own pull requests without explanation; about choosing to have my accounts deleted.Cc @ciotbsd @juliancalabyRT: https://mastodon.bsd.cafe/users/grahamperrin/statuses/116995110893781325
(DIR) Post #B8mYAH7mT16Jc0K6Qy by juliancalaby@social.treehouse.systems
0 likes, 0 repeats
@ariadne @grahamperrin I feel much the same way. Someone said the ideal career in tech is a cabin in the woods. I'm finding it's call is louder every day.