Notices by Glyph (glyph@mastodon.social), page 2

A lot of "slop" is just trivial fixes that cannot possibly be copyright-infringing or holding hidden security holes. Vigilance in human review does tend to decrement over time, but that's not the same as it being totally worthless. Projects will still have standards, even if they're a little degraded. Some projects will simply observe these things through direct experience and eventually stop.

This doesn't mean that there are no boundaries. I will strenuously object if you smoke around me; if you're jonesing, and we're outside, I might begrudgingly bear it for the benefit of conversation. I will absolutely forbid you to smoke around my kid, though, and if you try to, we might not be friends for much longer. This distinction highlights that while all smoking is bad, not all smoking is *the same*.

It's not like the consequences aren't serious; some people will, in fact, contract lung cancer. Some of them will die from it, often in hideous agony. So I don't want to downplay that "it's fine to smoke" or anything.

But neither is a smoker who occasionally condemns others to secondhand smoke a morally irredeemable person, nor are they a doomed lost cause. They could always stop. It's easier to not-start than it is to stop, but lots of people stop.

After a couple of epic crash-outs the last few days, today I am feeling a bit more hopeful, which I assume is going to get more people to yell at me:

Your favorite open source project that is "embracing slop" is not lost forever. Some will be, but I think overall the ecosystem will be eminently recoverable.

If I may, here's another metaphor. 🧵

RE: https://mastodon.social/@Cheeseness/117085158745808683

FYI for anyone who drops by the stream, I have just disabled this.

Let's say I'm teaching someone to code. What's the best option for a place for them to be able to host a website that is:

A) able to run arbitrary code[1]
B) self-contained; I don't want to set up 5 different services
C) as cheap as humanly possible

[1]: in my case I care the most about being able to run a docker container that can listen on an arbitrary network socket, but for services that hit B and C really hard I would be OK being restricted to Python and/or HTTPS if that were the tradeoff

how are folks feeling about https://agentscan.tools ? I've seen several folks (including one of my comaintainers) start sending links to this when asking folks "did you use an LLM here?"

it feels rude, I don't like using "LLM detectors", but, maybe this is just the new etiquette now

@dalias I guess I'd be interested to see cross tabs on survey data but I don't know that I could draw any lines around "usual corpofoss garbage" and whatever you think the valorous part of the ecosystem is. corpofoss almost certainly includes like, Linux, and GNOME, and SystemD, and libc, etc, so it's a pretty big deal

@dalias by a pretty wide margin, yeah

This is the logic of the O-ring disaster. Everybody just relies upon everybody else's safety margin — in the software community, that safety margin is built mostly out of earnestness and the willingness to sit with a problem and *really* understand it — and hollows out their own, assuming that the load will fall somewhere else.

https://en.wikipedia.org/wiki/Space_Shuttle_Challenger_disaster#O-ring_concerns

like, it was always bullshit, but the bullshit kinda worked well enough because we were all doing our best and using tools that were simple enough to understand even their second-order effects, and everybody more or less had enough time and space to do the kind of thinking necessary to actually understand stuff and take responsibility for things at a social / community level

it makes it hard to talk about, particularly this fad in OSS of everyone being "responsible" or "accountable" for slop they submit, as a way of laundering responsibility for said slop. ultimately the root of the problem is that our whole system is predicated on the idea that all your contributors will be honest, work hard, and believe in themselves. it was always bullshit. even the word "guarantee" Is _supposed_ to imply that some formal methods were deployed, and we mostly don't do that

there's so much load-bearing good faith embedded in the structure of the work. for example, the "guarantee". the only source of authority for something like a database commit claiming that it's "guaranteed" not to lose data is that a human abstractly and *very carefully* understood some whole-system properties and asserted, based on that understanding, that they believe this property should hold under some set of implicitly stipulated conditions (like "your hard drive did not catch fire")

one of the horrifying things about watching the software developer community's slow-motion collapse is realizing just how many coders (and managers, for that matter) have been understanding loose metaphors and allusions as literal truth.

if a system provides a "guarantee" you can't actually get your money back. if developers are "accountable" for their changes you can't actually have them arrested and convicted for making a mistake

if this is all too abstract and airy then let me ground it in an extremely concrete example that is not a particularly Hot Take but nevertheless deeply impacts our current moment

"please tell me how I can quickly address your objections so we can meet our KPIs, I have a hard stop in 45 minutes" and "you are a human being with a heart and a mind in community with other humans who must give each other grace and time and enough mutual recognition that we can ever possibly have enough safety margin to allow for us to make mistakes" are not really mutually intelligible discourses

the conversation just ends up between one person who is trying to guess the password to push their commit, get to the next commit, get to the next feature, the next milestone, go go go, what are the rules for using this tech that can make us FASTER, you can't just say "no", you gotta let me know what form to fill out so this is OK

and another person who is trying to say "slow down, this whole system CANNOT work at this speed, you have to understand the thread of human frailty that joins us all"

when 1000 faceless github accounts crowd into your PR queue all at once, slinging slop, desperate (for what reasons I cannot quite understand) for some shred of clout that comes from an accepted commit on a high-profile open source project, even if every single one of them is a Real Human Being and they are all still doing their best to pay enough attention, but they are also all staring directly into the Not Paying Enough Attention beam, you can't just give it a pass because it's worked before

We have previously understood that there is a presumption of good faith amongst the software developer community, that most people on Github, on PyPI, on NPM are not trying to ship you malware. Even the flashy "supply chain attacks" that have shown up over the last decade are the exception not the rule, xz can happen to anyone, but probably xz isn't going to happen to *you*.

What does this have to do with our present apocalyptic hellscape discourse? Well, coding agents like to run tools, too. Every coding agent is a random die-roll away from running `rm -fr` on your entire project, maybe your entire production database.