No LLM Code in Dependencies

https://joeyh.name/blog/entry/no_LLM_code_in_dependencies/

by edward • 20 days ago

120 102 20 days ago

skybrian• 20 days ago

Maybe an LLM could be used to check for this :)

Was this done by manually reviewing commit messages? I think it would be interesting/useful to have a tool that could use some basic heuristics about LLM generated code to detect code-blobs even if they are not explicitly called out in a commit message.

api• 20 days ago

Just like with writing, any kind of AI detection is going to be inaccurate to the point of snake oil.

LLM detection in writing is basically today's polygraph test pseudoscience. There was a blog a while ago where someone fed classic literature into one and it was detected as probably AI.

neutrinobro2• 20 days ago

I'm not sure that is the case in this instance. Certainly general writing is a lot more variable and harder to classify, and on the other extreme certain one-line code changes don't have enough information to say anything. However, a blob with a 500+ line code change and 200+ lines of comments is a dead ringer for some of the current class of LLMs. That isn't to say it this behavior couldn't be obfuscated, but some basic categorization could probably separate the majority of human authored commits vs. AI commits. Heck, you could probably train an AI to detect commit-style just by using pre-2022 code archives and existing known-to-be-AI edits/commits.

verdverm2• 20 days ago

An agent doesn't have to be perfect to be useful. If it can find clear examples of stuff you don't want to see in a (potential) dependency quickly, that will save you time. Give it search tools and some policies, then have it go find things. You then check them out, ask followups.

Agents as a super powered (re)search assistant is underrated.

perrygeo• 20 days ago

It's not just "the code itself looks LLM generated" - it's also LOC/hr by a particular author which suggests vibe coding. You could look at the author's github contributions to identify time periods when the author was generating code at super-human speeds. Combine the two signals and you might get something better than a pseudoscience?

zahlman2• 20 days ago

The heuristics that would be used to "detect AI" here would be things that shouldn't be happening anyway, so false positives wouldn't matter.

dijksterhuis• 20 days ago

when i was reading this i thought of writing some quick and dirty cli tool that checks commit co-authors. wouldn't be perfect, but would eliminate a good chunk of low hanging fruit.

jonathrg• 20 days ago

The diff of the linked commit in git is completely trivial, clearly it just got tagged because of the signoff in the commit message: https://github.com/git/git/commit/d7971544fe17378f44f4998301...

I would be surprised if there is no LLM-assisted code in there prior to this commit, this is just the first where the author chose to disclose it.

wrs• 20 days ago

Apparently, though not very carefully. The "particularly large LLM generated code churn" in the ram library, for example, is the LLM being used to simply git-revert a change that was not originally done by an LLM.

joeyh• 20 days ago

The commit it reverted has a high probability of also being generated with an LLM, though without disclosing that in the commit message.

verdverm2• 20 days ago

We are all figuring this new technology out and people will make mistakes. Would seem overreactionary to swear things off completely because of a single commit and reversion. Look for patterns in dependencies and your own work.

botfriendsarent• 20 days ago

I think this is a fair and normal reaction to AI slop. Alot of work though. I think OSS projects are at serious risk of implosion due to the vigilance required which honestly may end up being a fool's errand anyway.

But maybe we are thinking about it backward. Have you ever wondered why there is so much "free software"? Beware of strangers bearing gifts.

I have always wondered and been suspicious of people who are so eager for you to use their software. Which isnt to say OSS isnt high quality. Im just saying that maybe when people are pushing free software on you they are kind of in it for themselves.

As for whats next, me personally, last year I pulled all my personal repos about 80 of them off of bitbucket and self host that all now. I think OSS projects should setup a paywall and charge money to create PRs.

Like 10-100 bucks per PR to cover the cost of the extra vigilance. Also I could see migrations away from github, to AI free dependency hosting or something like that. Its an interesting challenge. But its not insurmountable.

Either paywall OSS projects or take them off the interwebs. Also one option the OP didnt explore I dont think is forking and freezing the dependencies. Huge maintenance burden, but its better than source corruption.

Also use fewer dependencies. Maybe set a limit of 5.

haywalk• 20 days ago

when people are pushing free software on you they are kind of in it for themselves

I strongly disagree with this. The free (as in both freedom and as in free beer) software movement was to provide an alternative to proprietary and closed-source software, which is developed by people and corporations who are openly in it for themselves.

Like 10-100 bucks per PR to cover the cost of the extra vigilance. Also I could see migrations away from github, to AI free dependency hosting or something like that. Its an interesting challenge. But its not insurmountable.

You could just leave your project where it's at, keep it open source, and simply not accept outside contributions. Lots of open source software operates this way. The Ladybird browser notably switched to this model recently as a reaction to AI pull requests.

scotty792• 20 days ago

Paywalling contributions is an interesting idea. You could auction maintainer capacity. I'm super cutious how much people would pay to get their code into a popular oss project.

StableAlkyne• 20 days ago

Clicking through to https://git-annex.branchable.com/no_llm_code/

It looks like git after 2.22 was dropped because it took an LLM commit. Same with ghc.

If I have to choose between this or git and the latest ghc, I think I'm going to just wait for someone to fork annex.

I don't even feel strongly one way or the other on AI stuff; pragmatically, I'm just not going to stop using the most widely used version controller, or Haskell, just for some guy's (forkable, AGPL licensed) hobby project.

zahlman2• 20 days ago

TFA is about the dependencies of this project. How does that prevent you from using those things yourself?

remywang• 20 days ago

This will probably prevent git-annex from taking advantage of most new improvements to the Haskell language going forward. That is deeply unfortunate. This is the main reason why git-annex is not guaranteed to never change to depend on LLM generated code, because cutting it off from all future Haskell language improvements may be worse than the alternative.

Looks like they are aware, and git-annex has been around for decades written by one of the best Haskellers. “Some guys hobby project” is not fair

pseudalopex• 20 days ago

They said the non LLM dependency build was not default and could become untenable.

They said git-annex supports git back to 2.22. Not git after 2.22 was dropped.

An incompatible change in ghc would break compilation of other software also.

jsnell• 20 days ago

It's nicely symmetrical, because conversely I prefer my LLM-generated code to have no dependencies.

peteforde• 20 days ago

Bingo.

These days, my only deps are TinyUSB and LVGL - stuff that would be completely pointless and absurd to recreate.

chollida1• 20 days ago

It's nicely symmetrical, because conversely I prefer my LLM-generated code to have no dependencies.

How do you get your code to the point where it has no dependencies? How do you do any sort of database writing without a library, or web access without sockets from an os library?

What sort of code has no dependencies? I'm now very curious as I can't see how you can do anything without altest including the std lib from your OS to do any file i/o.

tayo42• 20 days ago

Write assembly to do the syscall instruction with whatever params you need.

nancyminusone• 20 days ago

You mean aside from previous work it was trained on?

20k2• 20 days ago

Dependencies: stolen from all code ever written without permission, including extremely illegal content

But other than that, totally dependency free!

moffkalast5• 20 days ago

Beats copy pasting from stackoverflow and calling it yours.

12hasgt• 20 days ago

It isn't your code, it is stolen.

sscaryterry13• 20 days ago

I guess code you get from a book too? Or learning it, and typing it out after you've mastered a particular algorithm?

(FYI I'm not disputing that the LLM vendors didn't steal, that doesn't mean the technology is shit)

moffkalast5• 20 days ago

It's March 18th, 2087, npm and conda are considered crimes against humanity in 23 countries...

InTheArena• 20 days ago

This is completely infeasible in the age of mythos. The reality is that the velocity is just not going to feasible from a security PoV without leveraging these tools.

20k2• 20 days ago

Analysing codebases with LLMs to find security vulnerabilities is completely unrelated to committing code generated with LLMs

alchemism• 20 days ago

It's a fair comparison. There's a fair amount of plausible-sounding bullshit being peddled as a transparent advertisement for an ai-driven "code security" firm.

bsamuels2• 20 days ago

and how do you propose fixing the hundreds, if not thousands, of valid, impactful security bugs that frontier models will find?

moffkalast5• 20 days ago

In ten years we'll look at human written code like the unreliable garbage it is, and never rely on anything that wasn't at least seriously looked over by an LLM. It won't be even close.

KronisLV2• 20 days ago

never rely on anything that wasn't at least seriously looked over by an LLM

I can imagine LLMs becoming a mainstay, but what you are describing isn't wholly different from sufficiently advanced static code analysis - where you'd want more determinism than most LLMs normally provide.

The problem is that such a thing might take a decade and billions of dollars of investments to create per-language (e.g. actually useful code analysis for Java, for Spring Boot, for processing and validating form data, and DB schemas and document processing and rendering reports etc., literal domain checks for anything and everything that is common across various enterprises) so nobody wants to do that, so it's easier to throw LLMs at it and call it good enough.

hypfer4• 20 days ago

Yes, the same way 10 years from now-10years, we'd all be looking back at how insane it was for people to drive cars.

Man do I enjoy my totally real full self driving.

gspr13• 20 days ago

Alternate take: in ten years we'll be pulling our hair out cursing at the world over how we could possibly accept "10k lines added, 8k lines removed" as the normal everyday churn of software development. We'll curse the morons who gave up understanding our own code.

lioeters• 20 days ago

In ten years we'll be drowning in subtle bugs introduced by the unreliable garbage that is machine-generated code, and the industry will hopefully have learned to never rely on anything that wasn't at least seriously looked over by an actual thinking human being that understands it. We'll look back on our youthful idealism and cultish faith in this new technology with embarrassment.

fatata123• 20 days ago

In ten years, crypto will be the world’s primary currency. Oh look, stupid hot takes aren’t that hard to have after all.

gravatron• 20 days ago

funny enough if you spent just a few minutes with a LLM working on the design of your website it wouldn't look like complete shit.

bitbasher2• 20 days ago

function > form

hombre_fatal• 20 days ago

If you had to pick one, sure. But it's trivial to have both which is the point of those cringey websites like http://bettermotherfuckingwebsite.com

NooneAtAll3• 20 days ago

wdym?

looks like a normal html-only website to me

bwestergard• 20 days ago

Git annex is a remarkable piece of software and I've been inspired by lead developer joeyh's approach to both FOSS and life. For example:

https://joeyh.name/offgrid/

jaapz• 20 days ago

I am unreasonably irritated by their use of kw instead of kW

bitbasher2• 20 days ago

I agree we need to address the elephant in the room, but our community is about as polarized as politics in America.

tumetab1• 20 days ago

Which elephant?

kzrdude• 20 days ago

I think the copyright and license question is one of the elephants in the room that hasn't had a satisfying conclusion. It's very important to have a clear idea of this for the open source movement.

hypfer4• 20 days ago

What confuses me about this stance is that LLMs are basically indistinguishable from any mid-to-low-tier dev.

And those we've let into our codebases with no concerns. Hell, some even threw parties inviting in more of them.

At least LLMs don't call HR on you when you rightfully tell them that they're full of shit. Though.. well. Claude probably might.

sscaryterry13• 20 days ago

This. So many assumptions. If you disclose you used an LLM, it is immediately assumed all of it is done by an LLM.

If there is a bug, its because you are a lazy piece of shit, not because humans make mistakes, and you missed it. It is branded slop.

We're living in interesting times, socially, OSS will die because of this.

Contributors are dwindling, and will continue to do so. If you want to play in your sandbox, please do. Don't open-source, keep it to yourself.

gspr13• 20 days ago

I think you're wrong. And I think that FOSS is our last best hope to keep software under the control of the individual.

The sloppers are diving head-first into a world where not knowing how a basic idea translates to code is embraced. This is not true of every slopper, but it is true of enough that sloppers are a threat.

mcculley• 20 days ago

OSS will die because of this

OSS will not die.

lmkg• 20 days ago

Godot's recent announcement spelled something out clearly: when a mid-tier rando contributes, you can provide feedback to that person and possibly help them grow into being a senior contributor or even a maintainer. That possibility of helping the human behind the code is part of the motivation for doing open-source. Mentoring shitty devs is itself giving back to the community, in a different form than the code itself is. And that is qualitatively different than giving feedback to an LLM.

hypfer4• 20 days ago

That is a good point indeed.

I am wondering though if that was really the world we were living in just before chatGPT launched, given that the whole OSS thing was already harvested super hard.

The "mentoring opportunities" often were just extracting free consulting out of experts + building a portfolio for getting hired by big tech.

Would we really want to go back to that?

So I agree with the idea but only in a vacuum, I think.

pooploop642• 20 days ago

I think I'm also going to refer people to the Godot foundation's statement on this from now on. Too often people try to lay it out like a moral conundrum, or some kind of purity test for "real" programmers vs larpers, but that's all just lips flapping. Meanwhile there are real-life practical consequences that follow taking AI contributions, and the Godot foundation has done a great job articulating what those things are. It's very nice for there to be a voice like saying these things.

gspr13• 20 days ago

What confuses me about this stance is that LLMs are basically indistinguishable from any mid-to-low-tier dev.

I disagree. Behind an LLM sits a developer. They steer the LLM. For them, directions to the LLM is the preferred form of modification of the software. The output of the LLM is not a preferred form anymore. This poses a huge problem for free software, especially when the LLM that translates preferred form into "source code" is not FOSS.

The low-tier dev was not used in this way.

bigstrat2003• 20 days ago

LLMs are worse at programming than any dev I've ever worked with. Yes, even $latest_model. They have no understanding or ability to reason, and they make mistakes no human would make. They are, in short, bad at programming.

hypfer4• 20 days ago

I know what you mean regarding the class of mistakes, but strong disagree on the "worse" part.

Or rather I envy you for your experience with humans so far.

sscaryterry13• 20 days ago

You've not worked with average developers then, or this is a purely reactionary/emotional statement.

jcelerier• 20 days ago

I've seen developers pushing code repeatedly to car engine firmware with for-loops that weren't even valid C syntax, have yet to see a modern LLM do this kind of mistake

lukaslalinsky• 18 days ago

If I had coworkers with the ability to program like Sonnet 3.7 did, I'd be extremely happy. In reality, I can probably count 1-3 people like that, out of many over the years. Honestly, pair programming with Opus is better than any pair programming I had with a human, especially at understanding the reasons behind my designs.

porphyra• 20 days ago

How come all the open source projects are fretting over the copyright status of LLM code but big companies are just vibe coding slop all day for their internal closed source projects without a care in the world?

dehugger• 20 days ago

Risk exposure of "internal closed source" vs "open source". No one (external) cares nor can inspect a companies pile of internal utilities and code. As long as the code works than there's no problems.

Everyone and their cat can look at open source projects, which can and will result in being called out publicly. This can also have legal ramifications on the project itself.

scotty792• 20 days ago

Because open source community is idealistic and corporations are pragmatic.

pull_my_finger• 20 days ago

It's almost like the big companies are playing by a totally different set of rules. How else could Sam, Zuck and co, just blatantly rip pirated, copyrighted, copylefted material and just call whatever repercussions they do (or don't) receive the "cost of doing business". I'm not "anti-AI", I think it's incredible what can be done, but HOW it was produced, and how it's being used is wrong on so many levels.

Spotify is running ads for a design "thing", that's basically a generative AI logo creator. Isn't that one of the few instances that's already been clearly put into law - that you can't copyright AI generated stuff? How can you create a business that's selling uncopyrightable logos (which definitely would need/want to be copyrighted/trademarked)? It's the Wild, Wild West out here.

periodjet• 20 days ago

These arguments are increasingly smelling strawman-ish to me. The authors seem to pick the absolute worst possible examples of LLM usage in software development, ignoring the fact that it is ultimately just a tool, and that all the blame for a shitty product continues to lie at the feet of the one wielding it like a giant doofus.

waterTanuki• 20 days ago

I sincerely hope people taking the side of the LLMs get everything they ever asked for.

When $llm_company begins asking you to open your wallet to fix every vulnerability, bug, or other breaking issue, instead of the guy in Nebraska doing it for free because someone mentored him, will the economics change? Probably not.

No LLM Code in Dependencies

Related Stories