Humans are bad at writing secure code, and GNOME developers are no exception. GNOME is primarily written using unsafe programming languages where simple mistakes in our code lead to devastating consequences for our users, and we make these mistakes all the time. No matter how much we try, GNOME developers will fail write secure code...
My silly pet project (the pi searcher) is in Rust, and I still got some useful feedback about a potential XSS and a potential high resource use DoS path on my code from an LLM. Nothing terrible or RCE-ish but it was still useful.
The power dynamics are not the same. You are a hobbyist and it’s difficult for you to get feedback.
They, on the other hand, are the GNOME project and have much stronger backing. They don’t get to say ‘well, clanker gave the green light, must be quality software’.
The author doesn’t understand or think about what quality software is or what it takes to write some.
Perhaps more accurate to note it’s a hobby project, or one where I’m acting as a hobbyist. (I’m a computer science professor.) It’s correct that I don’t bother soliciting feedback on this one as it’s just a personal project that amuses me, and that lack of code review does create more opportunities for bugs to linger. But that said, many , many bugs escape many rounds of code review in the real world too. It seems silly to not take advantage of LLM review if it’s providing a good ratio of accurate feedback to false positives.
I meant no disrespect by calling you a hobbyist, sorry about that. My point is, we are people, and they’re the GNOME project, and applying the same standards to us and to them would be unfair.
We should be able to gain power that’s otherwise inaccessible to us by LLM reviews, and they shouldn’t need it, at least, they shouldn’t need it as much as we do.
And they certainly shouldn’t throw their hands up and say “if you disagree with our perspective on LLM use, you’re insane or lying”.
The author doesn’t understand or think about what quality software is or what it takes to write some.
The author: “… a member of the GNOME Release Team, the Fedora Workstation Working Group, and the desktop team at Red Hat. Before joining Red Hat, I worked on the WebKit team at Igalia, maintaining Epiphany, WebKitGTK, and glib-networking.”
Seems more likely they understand what quality software is, you just disagree with them.
(I’m happy to see more nuanced LLM takes emerging, at least.)
After an appeal to authority like this, I’ll surely retract all my opinions and abandon all my positions.
Obviously.
Also, if ‘nuance’ means “let’s all joyously accept our LLM overlords, because frankly, we can’t write any quality software without them”, go ahead, exclude me from all ‘nuance’, I don’t need it.
People love to cite “appeal to authority” whenever an expert disagrees with them, as if it magically negates their expertise. But unless you can prove someone is NOT an expert despite having credentials/title/position/etc, their “authority” is a relevant shorthand for expertise. From a classical logic perspective, this is not true, but classical logic is simplistic. From a Bayesian perspective, authority should usefully update one’s priors.
Regardless, you provided even less justification for your assessment of the author, so it’s not like you have a logically better argument. There’s not even an argument there, just an assertion.
I know we’re being snarky, but I’ll respond to the nuance bit as if it were real. Nuance doesn’t mean we can’t write quality software without LLMs, but if we’re up-to-date on current LLM capabilities, we have to admit they can do a lot of what they say on the tin. In some areas, like debugging and security, they’re already better or faster than most human devs. Any argument that starts off assuming LLMs don’t work in any scenario, is either naive or out-of-date.
A nuanced argument involves looking at them and deciding how to handle the trade-offs instead. How do we enable junior devs to grow? How to we triage large numbers of issues/PRs? How do we compensate for LLMs’ (currently) weak high-level architectural design? How do I balance learning with throughput, so my skills don’t atrophy? Which skills are still relevant? Etc.
I guess this is where I should drop the snark and tell you that my attitude towards this discussion isn’t purely grounded in technical terms. In an idealized environment where LLMs have no adverse impact on the world they reside in, a developer can write code by hand, iterate until they can’t see an issue, and only then ask an LLM for a review. This evades a lot of the “technical” problems with LLM usage at a slight cost of development time. More importantly, it works.
I just think it’s especially ironic to make the claim “there is no way to write quality software without LLM use”.
I never for a second considered GNOME, Epiphany, GLib, WebKit, Fedora in general to be “quality software”. Quality software acknowledges that being readable is more important than having been written. Quality software is Lua, it’s TCC, it’s NetBSD, it’s Guix. And none of them required an LLM touch.
From what I’ve seen, Red Hat has never cared if people that are not their engineers can read their source code. (In fact, you may remember that they actively tried to close the sources of their operating systems.) Red Hat has no stronger incentive to create quality software than Microsoft does.
So no, I could not disagree more with the author about what “quality software” is. And hearing the author say “no quality software without stochastic parrot” is funny, because I think the author wouldn’t know quality software if it kicked down their door and announced it was suing Red Hat for impersonation.
I have no technical basis of rejecting LLMs altogether. The right open weights model may or may not be able to outperform your average developer, but there is no question if it would help when it’s used alongside a human brain (rather than as a substitute for one).
I have a cultural basis of rejecting them and objecting to them. LLMs are marketed as a way to replace developers, not make their lives easier. LLMs are not our friend, they exist so that we get paid less. In my opinion, no discussion that overlooks this or discounts this can be “nuanced”. And in my opinion, this one didn’t even get close to nuance.
Most importantly, there is absolutely no nuance in stating “you either agree with me, or you’re unserious or delusional”. Who does the author think they are? Jesus Christ? Anakin Skywalker? “Either you’re with me, or you’re my enemy”? Where’s the nuance in that?
My silly pet project (the pi searcher) is in Rust, and I still got some useful feedback about a potential XSS and a potential high resource use DoS path on my code from an LLM. Nothing terrible or RCE-ish but it was still useful.
score 2 · canonical
The power dynamics are not the same. You are a hobbyist and it’s difficult for you to get feedback.
They, on the other hand, are the GNOME project and have much stronger backing. They don’t get to say ‘well, clanker gave the green light, must be quality software’.
The author doesn’t understand or think about what quality software is or what it takes to write some.
score 1 · canonical
Perhaps more accurate to note it’s a hobby project, or one where I’m acting as a hobbyist. (I’m a computer science professor.) It’s correct that I don’t bother soliciting feedback on this one as it’s just a personal project that amuses me, and that lack of code review does create more opportunities for bugs to linger. But that said, many , many bugs escape many rounds of code review in the real world too. It seems silly to not take advantage of LLM review if it’s providing a good ratio of accurate feedback to false positives.
score 1 · canonical
I meant no disrespect by calling you a hobbyist, sorry about that. My point is, we are people, and they’re the GNOME project, and applying the same standards to us and to them would be unfair.
We should be able to gain power that’s otherwise inaccessible to us by LLM reviews, and they shouldn’t need it, at least, they shouldn’t need it as much as we do.
And they certainly shouldn’t throw their hands up and say “if you disagree with our perspective on LLM use, you’re insane or lying”.
score 1 · canonical
The author: “… a member of the GNOME Release Team, the Fedora Workstation Working Group, and the desktop team at Red Hat. Before joining Red Hat, I worked on the WebKit team at Igalia, maintaining Epiphany, WebKitGTK, and glib-networking.”
Seems more likely they understand what quality software is, you just disagree with them.
(I’m happy to see more nuanced LLM takes emerging, at least.)
score 1 · canonical
After an appeal to authority like this, I’ll surely retract all my opinions and abandon all my positions.
Obviously.
Also, if ‘nuance’ means “let’s all joyously accept our LLM overlords, because frankly, we can’t write any quality software without them”, go ahead, exclude me from all ‘nuance’, I don’t need it.
score 1 · canonical
People love to cite “appeal to authority” whenever an expert disagrees with them, as if it magically negates their expertise. But unless you can prove someone is NOT an expert despite having credentials/title/position/etc, their “authority” is a relevant shorthand for expertise. From a classical logic perspective, this is not true, but classical logic is simplistic. From a Bayesian perspective, authority should usefully update one’s priors.
Regardless, you provided even less justification for your assessment of the author, so it’s not like you have a logically better argument. There’s not even an argument there, just an assertion.
I know we’re being snarky, but I’ll respond to the nuance bit as if it were real. Nuance doesn’t mean we can’t write quality software without LLMs, but if we’re up-to-date on current LLM capabilities, we have to admit they can do a lot of what they say on the tin. In some areas, like debugging and security, they’re already better or faster than most human devs. Any argument that starts off assuming LLMs don’t work in any scenario, is either naive or out-of-date.
A nuanced argument involves looking at them and deciding how to handle the trade-offs instead. How do we enable junior devs to grow? How to we triage large numbers of issues/PRs? How do we compensate for LLMs’ (currently) weak high-level architectural design? How do I balance learning with throughput, so my skills don’t atrophy? Which skills are still relevant? Etc.
score 1 · canonical
I guess this is where I should drop the snark and tell you that my attitude towards this discussion isn’t purely grounded in technical terms. In an idealized environment where LLMs have no adverse impact on the world they reside in, a developer can write code by hand, iterate until they can’t see an issue, and only then ask an LLM for a review. This evades a lot of the “technical” problems with LLM usage at a slight cost of development time. More importantly, it works.
I just think it’s especially ironic to make the claim “there is no way to write quality software without LLM use”.
I never for a second considered GNOME, Epiphany, GLib, WebKit, Fedora in general to be “quality software”. Quality software acknowledges that being readable is more important than having been written. Quality software is Lua, it’s TCC, it’s NetBSD, it’s Guix. And none of them required an LLM touch.
From what I’ve seen, Red Hat has never cared if people that are not their engineers can read their source code. (In fact, you may remember that they actively tried to close the sources of their operating systems.) Red Hat has no stronger incentive to create quality software than Microsoft does.
So no, I could not disagree more with the author about what “quality software” is. And hearing the author say “no quality software without stochastic parrot” is funny, because I think the author wouldn’t know quality software if it kicked down their door and announced it was suing Red Hat for impersonation.
I have no technical basis of rejecting LLMs altogether. The right open weights model may or may not be able to outperform your average developer, but there is no question if it would help when it’s used alongside a human brain (rather than as a substitute for one).
I have a cultural basis of rejecting them and objecting to them. LLMs are marketed as a way to replace developers, not make their lives easier. LLMs are not our friend, they exist so that we get paid less. In my opinion, no discussion that overlooks this or discounts this can be “nuanced”. And in my opinion, this one didn’t even get close to nuance.
Most importantly, there is absolutely no nuance in stating “you either agree with me, or you’re unserious or delusional”. Who does the author think they are? Jesus Christ? Anakin Skywalker? “Either you’re with me, or you’re my enemy”? Where’s the nuance in that?
score 2 · canonical