Tridge has responded on the rsync vibe disaster

[dysfun@social.treehouse.systems]

@davidgerard

I’d rather be out sailing than working on rsync security issues, so I have reached for several AI tools to help with what needs to be done. I have absolutely no regrets about doing that

you know tridge, i'd rather you were out sailing too.

[bloognoo@retro.pizza]

@davidgerard
You can hear the wind whistling through the hole in their forehead.

[barubary@infosec.exchange]

@dysfun @davidgerard

I have reached for several AI tools to help with what needs to be done

"We do what we must because we can."

[davidgerard@circumstances.run]

@bloognoo reads like a blog post written by a drug

[shadowjonathan@tech.lgbt]

@davidgerard ok so the original rsync is actually dead now, shame

i hope debian will switch to alternatives like openrsync or the likes

[peter_sc@chaos.social]

@davidgerard "People keep telling me gambling is bad, but what they don't know is this: I have a *system*. These new machines are so much more sophisticated, your ideas about how they work are totally outdated. What do you mean 'am I on cocaine?' Of course I am! It's part of the system, dummy!"

[dysfun@social.treehouse.systems]

@davidgerard i dunno man, it seems a little harder to justify how great AI is when you've just put out what was widely acknowledged even by slop coddists as one of the most disastrous software releases of all time with its help.

[netzblockierer@tech.lgbt]

@davidgerard I guess folks will have to fork off pre - AI Slop rsync (if that didn't happen already!) just like pre-Enshittification Vim got forked off as EVi.

#rsync #openrsync #AIslop #AI #slop #Enshittification #vim #evi #SlopCode

[sharkfie@infosec.exchange]

@davidgerard

I’m here to tell you that you are out of date. The world of software engineering has changed dramatically in the last few months.

They are better (I have to use them for work, not primarily a software dev though) but they do still do fundamentally broken decisions that "compile, run, end up with subtle bugs or silent failures". It was impressive until I began having to fix a lot of those.

I wonder if he hasn't gotten to that part.

[quincy@chaos.social]

@davidgerard

To be fair, what he writes, for the most part, doesn't even sound unreasonable to me, if I try to ignore the parts that are AI-pilled hyperbole.

[chiffchaff@tech.lgbt]

@davidgerard I think the intro actually says a lot. He's retired and toesn't really want to do it any more, but doesn't want to let go. I guess he sees AI as a way that he can retain ownership without putting in the extra work that he no longer wants or is incapable of doing.

I think that's fair enough. I'm sure everyone reaches that point in their life and struggles with those things, especially someone who has been so lauded.

In terms of rsync, I think it reinforces the idea of a fork for someone more hungry and able to work on this.

Tbh, I do feel sorry for him for all the dogpiling, despite my selfish frustration at the inconvenience this is causing me personally.

[sharpcheddargoblin@reclusive.blog]

@davidgerard So he's an arrogant asshole too. Great.

[robinsyl@meow.social]

@davidgerard can we normalize giving a project to someone else if you don't want to maintain it

[shadowjonathan@tech.lgbt]

@davidgerard also what the fuck are these replies glazing him

can you moderate replies as an author?

[addison@nothing-ever.works]

@davidgerard@circumstances.run Honestly, it's just kind of unpleasant to watch. I understand the pressures at play here, re: security-relevant bugs being reported at a higher rate (including some which actually exist). Also, there was a lot of criticism directed towards him for this, some of which was way too personal or rhetoric-laden. That tends to cause walls between people that stifle actual change. I doubt he will change course following this sequence of events.

On the other hand, the dismissal of legitimate concerns and criticisms is really gross to read; rubs me very wrong. It also irks me that he characterises all of the criticism he got as concerns about correctness, and how he addresses even that. I don't care at all if he thinks it's "right"; he hasn't put in nearly the same time or effort or thought as he would have needed to otherwise, and that's what he has 40 years of experience in. I care that it is well-reasoned, and doesn't rely on something so fundamentally problematic for reasons other than efficacy.

I don't know. This whole movement continues to reveal that a huge chunk of open source does not hold the values I expected.

[robinsyl@meow.social]

@ShadowJonathan @davidgerard I know someone with a Medium account and yes you can hide replies you don't like

[david_chisnall@infosec.exchange]

@robinsyl @davidgerard

The problem is finding people who are both willing and able to do it (and not, as with liblzma2, just there for the supply-chain attacks).

This is especially true for codebases written in C with a bunch of idiosyncratic things. I had a quick skim of some of the rsync source and it has a few more comments than a lot of contemporary code, but also some cryptic things. My favourite was an ad-hoc inlined memmove with a comment explaining that memmove didn't handle overlapping regions correctly on 'some platforms' (the only difference between memmove and memcpy is that the former is required to be able to handle overlapping regions). I wouldn't want to take over maintaining it, even if I had time to do so.

That said, I think we do need to normalise projects being done. No new features need to be added, the project is complete.

This is much easier when the project is designed around extensibility, so missing features can be added with external plugins, maintained by other people.

[robinsyl@meow.social]

@ShadowJonathan also possibly some sampling bias as people who use AI are prolly more likely to have a Medium account

[hsza@social.tudbut.de]

@ShadowJonathan @davidgerard chances are you can, but also picture the average individual with a medium.com account

[passocacornio@tech.lgbt]

@davidgerard no, like i get it... i don't know their level of understanding about machine learning, so i will not conflate their feeling overwhelmed by the surge in llm-driven issues reporting with lack of knowledge, also I don't know if any maintainer of rsync is trustworthy enough (in their experience) to pass the project to.
but i do think we need to normalize saying a software is complete more often.
what i mean by complete? that it will not get more features and will only get security updates and at a slowed down pace.
the "move fast and break things" did much more damage to to software engineering than we are comfortable admitting. i don't agree with their main points, but I empathize with the thought processes they are putting "to paper", even the subconscious ones.
anyway, let's migrate to openrsync