Who could have possibly predicted such a thing???
Linus Torvalds, creator and headmaster of Linux, has taken a pro-AI stance, supported not only by the speed of additional contributions, but also the fact that bots often don’t make mistakes that even seasoned developers do.
He’s “right”. LLM bots indeed don’t often make the mistakes that seasoned developers do… they make far more basic mistakes than those, often in far greater numbers.
we’re only at the start of this
So, what if — crazy idea, I know — we dig in our heels and refuse? Could we make this not the start but a quick skip to the end, where we just don’t do all the hellish robot junk and thereby minimise the workload of rolling back to the olden ways?
That sorta doesn’t really deal with the main problem here though imo. People who review and maintain the code have to review submissions. I doubt most of the idiots submitting slop pull requests are going to be upfront and say “hey before you spend your finite time alive putting effort into reviewing this, just know I put zero in but still want credit for ‘contributing’.” So they have to likely deal with a tsunami of this shit only to get part way through and realise it’s slop. The only solution would be to ban contributions or greatly complicate the process of it; which runs contrary to OSS. Torvalds stance certainly hasn’t helped and probably emboldened these types.
I want to see some projects experiment with a “refundable deposit” model for issues and PRs
If it’s slop, the maintainers get paid adequately to deal with it. If it’s not, it doesn’t cost the human anything in the long run
How do you prove it is slop? I agree it is something one often can identify, but how does one prove it?
Genuinely wonder :)
Yeah, I like the idea, but those models are pretty good at parroting desirable text styles. It might become a game of whack-a-mole to identify the slop unfortunately 🫤
Either they get good or they don’t
If they get good, xkcd has the answer https://xkcd.com/810/
If they don’t, they keep paying for it
I think you missing the point: we don’t want slop - as in low quality code. It does not matter if it is an AI or a Human created slop.*
*: just considering the project side, not the enironmental, and ethical side.
The problem is not identifying AI slop, the problem is wasting an already limited time on a PR which seems legit until you deep dive and find that it is utterly terrible. And multiple it with a large number of PR-s because the barrier of entry to create a slop is 0.
I agree but I think we’re in a tricky place. The vulnerabilities being found are real, and the pace at which they are now being found is previously unheard of, so in that sense they can’t just be ignored. I’m not a developer but it seems like codebases need to be tightened up as technical debt is finally being called. I don’t have a good answer or suggestion. I’m just a guy who enjoys mixing metaphors and who sees a lot of products that were good enough to ship and build our modern society upon, and suddenly the card foundation demolishing tools have been unleashed.
But are the vulnerabilities real? The reason the slop submissions are such time sinks is that they look plausible enough to not immediately discard, but they turn out to be non issues under further investigation. This is why Curl no longer has a bug bounty. It was just way to tempting for brain addled “coders” with a Claude subscription to see it as a potentialpassive income stream.
Most of what I hear about these AI bots going through a code base and finding hundreds of bugs is reports from AI boosters of not outright marketing claims from the slop merchants themselves, I wonder why they would want to push a narrative of LLMs fixing Swiss cheese software architecture in minutes 🤔
According to the lead Curl developer, the quality of LLM generated reports has gone up quite a lot, to the point where the number of high quality reports is the problem, rather than the number of slop reports: https://daniel.haxx.se/blog/2026/04/22/high-quality-chaos/
However, I doubt that their bug bounty program is ever coming back. As you say, that’ll just attract the people looking for a quick buck, and those are unlikely to care about the quality of their reports
That is not what the maintainer of curl said, lmao
This article explains the actual situation.
The link I posted is to the Curl maintainer’s own blog, in which he wrote a follow-up to his earlier post about shutting down their bug bounty program. See also this more recent blog post by the maintainer of Curl, in which he writes that
I personally don’t refer to [vulnerability reports created with the help of AIs] as AI slop because the reports are typically accurate and correct, even if much too wordy. I think “slop” implies that it is wrong, misleading or otherwise bad content.
This doesn’t seem to contradict what the article I sent is saying. It appears to confirm what that article says.
It’s annoying when the reporter surrender everything to the AI, including the communication part. The AIs are also still bad at figuring out exactly where the line is between a bug and a vulnerability, and if it is a vulnerability, what severity it is.
So, it can find vulnerabilities, occasionally, but a lot of what it labels as vulnerabilities are not actually vulnerabilities. It submits duplicate reports. It does a really poor job of actually fixing the “vulnerabilities” after it finds them.
Being able to find and publicize vulnerabilities but not actually fix them seems more beneficial to potential attackers than to anyone else.
I’ll start by saying I’m ethically against LLMs, but I see this as not an LLM thing but a corporate thing.
A large part of those unfound security flaws is companies really don’t prioritize revisiting old code. They don’t consider refactoring for stability a worthwhile endeavor at all. So much so that I’ve seen managers insist the proof of concept code get shipped. LLMs have kind of helped raise awareness of that, but not really because it just gets called a security flaw. If companies didn’t chase maximum profit I guarantee a large chunk of what we’re seeing with people patching right and left wouldn’t be a thing.
LLMs have only less to this vulnerability avalanche because people are firing the things off left and right on old code. The solution isn’t to keep doing that, it’s to shift culturally to not shipping until things are properly developed.
Absolutely agree. I used to be a Mac guy and I remember when Mac OS X (as it was called at the time) 10.5, Leopard came out. It had a lot of problems and Apple acknowledged it by following up with Mac OS X 10.6, Snow Leopard. The pitch was that they weren’t really going to ship new features but rather to refine 10.5 and make it suck less. I think it was pretty widely recognized as a successful effort. It’s boring stuff for the tech press and media at large, but Jobs was able to sell it. I wish more companies would do this, but it doesn’t make line go up in the same way “…Now, with AI✨™️” does
I don’t have a good answer or suggestion. I’m just a guy who enjoys mixing metaphors
Hey, me too. I don’t pretend to serve up solutions, but certainly accepting that we can’t simply navigate the internet or find human coded software anymore — isn’t an acceptable solution either?
It’s a Pandora’s box moment to be sure. I don’t see that allowing “AI” use to continue unchecked is viable in any field outside hard science. But then we have the “only outlaws” situation instead 🤷
AI is why we can’t have nice things. Not only have they ruined writing code for money. Now they’ve managed to ruin doing it for free too. I’d call it impressive, but it really isn’t.
Just because something is great, doesn’t mean it’s not terrible
Good ol’ Ollivander’s Law.
Linus’ recent comments suggest that he thinks we’re near the peak of AI slop for the kernel. All the bugs accumulated over the past 20 years of the kind that AI is good at finding are getting patched, and eventually the pool of those will be exhausted. We’ll soon find out whether it does happen that way.
https://www.vulncheck.com/blog/anthropic-glasswing-november-update
Read this, and if you’re still confident that AI is good at finding and fixing vulnerabilities, I have a bridge for sale.
Spoiler alert, it won’t.
After all this I can’t believe those who still pay for an AI agent to flood their inbox with junk like that think they’re helping.
So 2027 won’t be the year of the Linux desktop ™? /s
The year of the BSD desktop.
The year the wretched remnants of humanity go back to doing all their computing in uxn on salvaged GameBoys
I miss those days when I was trying to write a GB emulator with the only help of a weird text file.
https://problemkaputt.de/pandocs.txt
NoCash is still at it apparently, updating his emulators, what an absolute goat.
Oh no. Can a group fork the kernel before its too late? I wish it were that simple…
Forking a repo in git really is quite simple
Getting everyone else to use the fork is the hard part
