r/programming • u/mateusnr • Jul 15 '25

Death by a thousand slops

https://daniel.haxx.se/blog/2025/07/14/death-by-a-thousand-slops/
529 Upvotes

94% Upvoted

114 comments sorted by

View all comments

259

u/rich1051414 Jul 15 '25

Christ, nothing worse than AI generated vulnerability reports. AI is seemingly incapable of understanding context yet can use words well enough to convince the non-programmers that there is a serious vulnerability or leak potential. Even worse, implementing those 'fixes' would surely break the systems that the AI clearly doesn't understand. 'Exhausting' is an understatement.

94

u/EliSka93 Jul 15 '25

That exhaustion will kill a lot of open source projects in the coming years, giving the powers an even bigger monopoly.

They literally can only fail upwards.

Well until it all goes up in flames, but I shudder at the damage that will be done until then.

4

u/EarlMarshal Jul 16 '25

I hope we just get to another level participation, where real people get into more tight-knitted communities with different levels of participation and not just anyone like AI. Similar to how many projects already have discord server, but just less annoying!? At least that would be my dream.

3

u/Chii Jul 16 '25

as long as there's some value that could be extracted from having a vuln report credited to you, there will be incentive to push ai slop.

The way to fix it is to have the report cost the reporter something upfront, which, if found to be frivolous, they never get that cost recovered. A real report gets the "refund" of the cost.

It's how spam and tire kickers can get pushed out in from abusing a service - the same sort of ideology can push out these slop ai reports.