65
Given the recent uproar about AI usage in rsync a PSA: maintainers owe you nothing (mikemcquaid.com)
submitted 5 months ago by to c/opensource@programming.dev
43 comments fedilink hide all child comments
 

For those outside the loop: rsync starting using AI agents to handle the influx of AI security reports to improve the test suite and fix bugs. It introduced a few CVEs and people who never contributed in any way started firing shots at the maintainer.

rsync maintainer's response to the people getting pissy about his usage of AI: medium and the related post on programming.dev

you are viewing a single comment's thread
view the rest of the comments
[–] 19 points 5 months ago (11 children)

Taking a project that works fine and making it actively worse by introducing AI made bugs is imho a valid reason to hard fork. The maintainer might not owe you anything, but it shows very poor judgement to slopify a good project like rsync this way.

  • permalink
  • fedilink
  • source
  • hideshow 11 child comments
    •
  • [–] 0 points 5 months ago (9 children)

    how did he slopify anything? he got a huge invtease in contributions and used a tool to help weed out slop.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 9 child comments
    •
  • [–] 12 points 5 months ago (8 children)

    They could have just refused merging slop. Rsync didn't need these "contributions".

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 8 child comments
    •
  • [–] 1 point 5 months ago (7 children)

    What about the 6 critical security bugs he fixed in that release. Didn't rsync need those "contributions"?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 7 child comments
    •
  • [–] 1 point 5 months ago (6 children)

    The "critical" bugs that I have recently seen being found by AI were all extremely unlikely to be exploitable under realistic assumptions 🤷

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 1 point 5 months ago (5 children)

    Which of the CVEs in question are you referring to?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 1 point 5 months ago (4 children)

    The ones in Nginx and the Linux kernel.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 1 point 5 months ago (3 children)

    I mean the ones in the latest release of rsync, tf does nginx have to do with anything ?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 1 point 5 months ago (2 children)

    I have not looked at the CVEs in Rsync specifically, but given the deludge of "critical" security issue found by AI lately that have been mostly nothing burgers, I am near certain the same applies to those included in that Rsync patchset.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •