AI code review is nice to have an additional pair of eyes but it doesn't substitute to the maintainer eyes.
A big part of a review is deciding if you want that change merged in. Not because of the immediate code but what it means to the project to bring this in.
AI code review, to my eyes, just reduce the number of bugs, they do not shorten the review time. Otherwise, it means you are compromising on the direction of the project.
I help maintain a big project as well and I can totally relates what the author is describing.
The amount of security advisories and PRs opened is getting out of hands.
This is no longer just spell check PRs that you can merge in less than 1 minute of review. Often that's going to be supposed perf improvement, attempts at fixing things that are not broken, or submitting completely new features.
These relatively low effort PRs takes a lot of effort to review or even just to filter out.
Having seen this happening in the past, pre-AI, the answer is usually that they don't. They just stay on that version forever. Or it's maintained until the original author moves on, after which it's someone else's problem to figure out how to move back to the upstream, which has now had years of changes.
I never had so little free time as I have these days. Most of my time is spent at work or with my lovely family.Love my family, and work is great.
The thing is that, probably like many of you, I love going deep in a side project, even if it lands nowhere. With so little time, working on them has become a very frustrating activity.
This is where I found my trap... do more with very little time by delegating to an LLM. You get dopamine shots, the feeling of achieving something but the cognitive dept is just crazy. So much that the activity becomes almost meaning less. After couple of months doing this, I'm not even sure it's a good use of this time. I get very little satisfaction on the long run.
I don't have a solution to this problem, not even sure there one. I think I have to accept that this is an activity that takes time, and only time gives the real gratification.
This is a very good analogy. You have to do way more effort to make sure it's correct than if you have asked it yourself with a controlled context. I generally don't want to feel lucky when I ask questions to coworkers.
I very much like Go's simplicity, but nils are terrible. Pointers carry 3 different intents that are not encoded in the code:
- Optionality
- Mutability
- Memory optimisation
I agree with the author that when the pointer is here for mutability or to limit copies you need to check nullity at the outer layer. But for optionality you need to check it each time you access that value.
Sometimes the intent is not clear and you are forced to check nullity everywhere. An Option type fixes this but it's not idiomatic Go code and forces to wrap every thing you call
In a previous job our unhinged devs decided that optionality was defined by golangs default value for primitives (empty string, 0, false, etc) simply because they didn't want to put pointers everywhere.
So the JSON APIs would accept nulls or absent keys when sending data to the API. But when retrieving it we would get golang default values for those keys. And, of course, the backend code was full of == 0, == "", == false...
"Claude" would probably be the response of a typical tokenmaxxer. I have no desire to use software that was drive-by forked by someone who doesn't understand the trade-offs made by a project, or the values underpinning them. I'll AI-assisted domain-expert, or experienced maintainer who stumbled into the role over someone with no grounding in the domain being the human in the loop for AI agents.
I find this kind of rewrite both disrespectful and completely useless. Useless because the difficulty isn't getting to a working state but maintaining it. You now have to build a community around it to make any of this worthwhile. What would this software be worth if security issues weren't patched and bugs weren't fixed? You can't do this alone.
And I find it disrespectful because people have spent decades building this, and you're taking all that collectively built knowledge to create something that will compete with the project itself.
I hope people will restrain themself from doing this at least in the name of good ethic. I fear this is going to hurt OSS a lot.
I hope people will hold back from this, if only out of respect for the work that came before. I fear it could do real damage to OSS. It would discourage the maintainers whose effort makes any of it possible.
Hmm I view open source as purely positive sum. Valkey was forked from Redis in the first place.
But this is more about memory safety - you can have immense respect for the giants who built these tools but also be worried that memory safety might become an even bigger deal. If someone found a memory zero day in nginx or openSSL for example that is a very big deal!
I think this is one strategy we should look into, hopefully people in the C community look into other options like project Glasswing/ next generation fuzzers etc. When the world of security is changing so fast it is good to get a lot of shots on net.
And what if they get owned by a memory safety issue that's in the original and not the rewrite?
I know many of these projects have been around for years but it's time for developers to put on their big boy panties and start taking memory safe languages seriously. Watching the same attacks again and again for 30 years is getting droll.
At this stage, AI is no longer a tool that enhances your ability to ship code, it has replaced you entirely in that role. You don't control what is shipped, and you can't verify if it's correct. That's a serious problem! As software engineers, we remain accountable for code we no longer fully understand.
Then, what comes next feels less like a new software practice and more like a new religion, where trust has to replaces understanding, and the code is no longer ours to question.
Speak for yourself, I don't ship any code that I don't fully understand. Yes that requires less autonomous AI and less frequent merging.
But I don't even want to think about the disasters that could happen if you really get into the habit of shipping code you can't verify or understand.
Out of interest, what's the speedup between having an LLM write code for you and then having to go through and understand it, vs writing code that you understand immediately because you wrote it?
It depends. If all I want is some prototype or pet code project, my LLM can write most by itself. The speedup could be 10 times or more.
However, if I'd let a LLM write code for my work, I'd have to very thoroughly review it and most likely ask it to rewrite it several times. Each time this would require a new review of course.
There would still be a speed up but I guess at most somewhere around 25%.
In practice I try to combine the best of both worlds. I write some code by myself and rely on my LLM for parts that are not too big and where I expect it to do a pretty good job.
Don't you need to obtain consent before filming random people in the street? I already feel uncomfortable when someone takes a photo in public and I happen to be in it, but this type of device takes things to an entirely different level. With smart glasses, there's no visible cue that you're being recorded. No phone held up, no camera in sight. I'm questioning the legality of this in Europe, where privacy laws tend to be stricter. In the meantime, should I just assume that anyone wearing these glasses is always filming? And would I be within my rights to ask them to stop the moment I notice them?
Note that there is a difference between being allowed to take a photograph, and being allowed to share it. Unless you're threatening or harassing, you're mostly free to photograph as you want. But you might not be allowed to publish it.
Pretty much the same in Finland. You are allowed to film/photograph as much as you want in a public place, but publishing the material might be against the law depending on the contents. Particularly the law regarding "dissemination of information that violates privacy". It's fine to publish a photo of people walking on the street, but you'll probably get into trouble for uploading an arrest to YouTube where the suspect is recognizable.
In a general rule you can record. But sending it to Meta AI would be a AVG (GDPR) violation in the Netherlands if no consent is given as you share it with a third party. There is also the difference of recording a public place with people in the background and clearly recording someone: The first is fine, the second is not (without consent). You also cannot disable the recording light, doing so would put you up for libel en decency lawsuits (and libel and public decency can be criminal, not just misdemeanors).
So if you take a video of specific people looking at flowers at the Keukenhof you would have to ask them for permission if you are recording them primarily and publish it but recording for yourself is fine as it is a clearly public space. If you take a picture of all the flower and catch some people in it in the background you are fine. If you do it in a place where people do not expect it they can ask you to remove the video and they have to (e.g. in a restaurant when you are eating as it is not expected to be recorded there).
There are some exceptions for journalism, law enforcement and public good. I doubt strongly any Meta (AI) post would classify for that.
There is also the small caveat that if you can avoid recording innocent bystanders you must. E.g. putting up a doorbell camera and pointing it to the street instead of your door is bad as it's easily avoidable by putting it top down.
People send their private photos to their private cloud backups with the reasonable expectation that those photos remain private and therefore not a privacy violation.
If it transpired Google or Apple had staff looking through people's cloud photo backups, yes this would be considered a violation because "cloud backup" is framed as a personal solution and not a hosting or processing solution.
Yes, actually the AVG (GDPR) is very broad in what it considers personal data.
Sadly that means it is not enforced well since it is too broad to be enforced in a meaningful way. And therefore it is violated A LOT, both by companies or people since no one can be bothered!
AVG (GDPR) includes the following things as personal data: name, address, phone number, passport photo, information about someone's behavior on websites, allergies, customer or staff numbers, recognizable recordings and more.
Rule of thumb, any information that can be used to relate a specific person.
An important distinction is that you are allowed to film/photograph when you are actively doing it (so the glasses do belong in that category). You're not allowed to set up a camera to autonomously film/photograph outside of your own private property.
Besides that there is the issue of publishing said footage, as others point out.
> you are allowed to film/photograph when you are actively doing it
Does it really count as "actively doing it" when the glasses are constantly filming while you do other stuff.
With a phone/camera people can see you are filming or taking pictures.
In many countries the shutter needs to make a sound when taking pictures.
For video surveilance cameras a noticeable sign or sticker is needed.
US here. Definitely more permissive than any EU nation. Public space typically means free for all in terms of recording[1]. The incident I link is relevant as we are bound to see a whole new bunch of 'content creators' going for various new ways to engage the public.
That would make taking pictures impossible, so no, such a requirement cannot be reasonably() codified into law.
() By reasonably I mean in a way to be actually followed. Of course there are lots of impossible laws created by politicians to cater to their fan base.
These glasses have a light when recording. You can buy many hidden recording glasses that are much more discrete with no light. Are you also paranoid when someone has their smartphone in their shirt pocket with the camera exposed?
On the french trains, you can sit opposite someone else. I'm feeling really uncomfortable when this person scrolls on its phone, with the phone back camera pointing to me for hours.
I sometime ask this person to hide the camera and they generally understand my feeling.
Definitely not.
But when someone looks at me, my gaze is drawn to that person, to say "hello" for instance. I have the same kind of feeling with a camera.
(Maybe if i was living in a town, i would loose this reflex.)
In Germany, you don't need permission for recording image material (including moving images) in public places, though usage of the material might be restricted.
However, audio recording of conversations is prohibited.
Filming is legal. In public spaces (streets, parks), there is no "reasonable expectation of privacy." You do not need permission to point a camera. The exceptions are usually for offensive or harassing type of filming.
Publishing is regulated. In EU, once you share the footage , you are "processing personal data" under GDPR. There are also exceptions where publishing without permission is legal. Legitimate Interest (security footage or incidental background), Public Interest/Journalism, and Artistic Expression.
Generally you must ask permission to publish, not to film. Although asking permission to film is good ethical principle too.
Note that there is a difference between Panoramafreiheit (freedom to record a public building / space with people walking around) versus recording the street before your house with an always-on security camera (almost always forbidden).
Even having a fake camera pointing at a public space can be forbidden as it creates surveilance pressure on people using the space.
That's quite an antagonistic way to request an explanation, particularly as it seems straightforward:
If you needed consent to film people in the street, security cameras (in public places) couldn't be used. They _are_ used. So it must not be the case that you need consent to film people in the street. Assuming there is not just widespread lawbreaking, I suppose.
The difference is if you are actively filming, or the camera is set up to film by itself. Security cameras are in the latter category and therefore can only be used on your own property (you can allow someone else to do it on your own property, such as a security firm).
Depends on a country, but yes, police generally has more privileges in that regard. The laws here are also different for casual public filming vs. permanent camera or otherwise targeted filming (without consent) in public space. It also matters what you do with the material.
I actually don't know if businesses are anything special compared to individuals in that regard. They can, of course, have security cameras filming their private properties (like individuals can) as long as they are open about it. And again, they can't use or spread the material however they want.
Given that the article is from a Swedish publication, you often need prior permission to use a security camera which could take images of the genera public. Much of this is regulated with GDPR.
Only for stationary cameras. Filming/photographing with a non-stationary camera is allowed as long as it is not in a sensitive situation (in their home, in the toilet/changing room/etc).
So I can mount my security camera on a WallE-like chassis to randomly drive around my property and I am no longer under the same strict regulation? What exactly made you come to that conclusion when IMY considers things like dashcams to be under the regulations of privacy and GDPR?
AI code review, to my eyes, just reduce the number of bugs, they do not shorten the review time. Otherwise, it means you are compromising on the direction of the project.