• ReCursing@feddit.uk
      link
      fedilink
      English
      arrow-up
      4
      ·
      22 days ago

      I bloody hope the whole post is satire but given the anti-ai groupthink on lemmy, fuck knows!

          • apotheotic (she/her)@beehaw.org
            link
            fedilink
            English
            arrow-up
            9
            ·
            22 days ago

            I dont think local agentic models address the ethical and environmental concerns I have with the training - but its better than the corporate offerings :)

            • KairuByte@lemmy.dbzer0.com
              link
              fedilink
              arrow-up
              2
              ·
              edit-2
              21 days ago

              Hey guy/gal/genderfluid pal, the cat is out of the bag. Either we embrace it for what it can do in a much more sustainable way, or we let corpos redefine sustainable.

              Is this a good use case? No. But most use cases, I’d rather have a local agent running on my own hardware being offset by solar, than using a corpo offering.

              • apotheotic (she/her)@beehaw.org
                link
                fedilink
                English
                arrow-up
                2
                ·
                21 days ago

                Please don’t call me man :)

                The cat is “out of the bag” on consuming meat and dairy, plenty of people manage to survive and thrive without em, without much effort at all. I’d personally rather use no LLM than use a local agentic model with poor ethics/environmental impact of its training, even if the latter is better than corpo offerings.

                As I alluded to, I’m much happier to see people using local agentic models. Even more so if they happen to be something like Pleias’ approach, with lots of transparency about the data they were trained on. There’s still the environmental concerns behind the resources consumed for the training, but it is about as good as one could hope for at this point if one insists on using LLMs.

                • KairuByte@lemmy.dbzer0.com
                  link
                  fedilink
                  arrow-up
                  2
                  ·
                  21 days ago

                  As you wish, wasn’t meant as a gendered ident so apologies.

                  I’m actually not familiar with how much environmental damage is done by training vs using. My initial assumption was that training would be less, by many many factors, because it “happens once” while the usage is constant and scales with the number of users. But that is admittedly an assumption made out of ignorance.

                  And to be clear, I’m not really trying to tell you you’re wrong, just trying to make my position clear since Lemmy is very anti AI in general.

  • boonhet@sopuli.xyz
    link
    fedilink
    arrow-up
    52
    ·
    22 days ago

    Completely vibe-coded project it seems, even documentation. And yet:

    Human-Origin Source License

    Also love this:

    You may not, without prior written permission from the Author:

    - ship or maintain a modified version outside the contribution-purpose
      rules;
    - maintain a divergent private or internal fork;
    - port, clone, rebrand, or recreate the Covered Software;
    - create an API-compatible replacement, behavioral clone, competing
      implementation, or Derivative Implementation; or
    - use AI-assisted implementation mining to create, improve, test,
      document, or validate a Derivative Implementation.
    

    Look, I use AI too (mostly to speed things up by working on multiple items in parallel), but I’m not gonna stuff “human-origin source license” on anything I use it for, nor do I think creating API-compatible replacements, competing implementations, etc, should reasonably be possible to block with a license… Also, quite literally, he’s creating tools for reverse engineering, which in itself is generally in breach of the license of whatever software is being reverse engineered. Fuck off and use a FOSS license, whether it be permissive or copyleft…

    • qarbone@lemmy.world
      link
      fedilink
      English
      arrow-up
      35
      ·
      22 days ago

      “No! Nuh uh! You can’t prompt Claude to do what it did for me, again! I did it first and called ‘dibs’ on ever doing it again!”

    • purplemonkeymad@programming.dev
      link
      fedilink
      arrow-up
      6
      ·
      21 days ago

      Was it not ruled that API compatibility was not copyright infringement? (Oracle Vs Google.) I don’t think the last two are even enforceable.

    • criss_cross@lemmy.world
      link
      fedilink
      arrow-up
      4
      ·
      21 days ago
      - ship or maintain a modified version outside the contribution-purpose
        rules;
      - maintain a divergent private or internal fork;
      - port, clone, rebrand, or recreate the Covered Software;
      - create an API-compatible replacement, behavioral clone, competing
        implementation, or Derivative Implementation; 
      

      At that point why bother making your codebase public?

  • FauxLiving@lemmy.world
    link
    fedilink
    arrow-up
    45
    ·
    21 days ago

    You may as well just completely replace your package manager with this one simple script.

    #!/usr/bin/env python3
    import sys
    
    exec(TrustedAgent.request(f"Write a Python statement to install {sys.argv[1]}, make no mistakes"))
    
    • meme_historian@lemmy.dbzer0.com
      link
      fedilink
      English
      arrow-up
      4
      ·
      20 days ago

      I mean, you could do away with package managers altogether… Just always include “use standard library components only” in every prompt.

      Added bonus, your program will be very secure because it would very rarely be affected by any publicly known CVEs.

      /s

      • groet@feddit.org
        link
        fedilink
        arrow-up
        2
        ·
        19 days ago

        Honestly… in a world where code is written by AI and not humans, most frameworks SHOULD go away. They were designed to make a task easier for humans not for a machine. AI should not write “react on node using vue”

  • Mikina@programming.dev
    link
    fedilink
    arrow-up
    45
    ·
    21 days ago

    While I’m not a fan of most AI usages, this is the thing that infuriates me the most.

    I like writing scripts to automate parts of my job. I’ve had a few for things like build performance testing comparison and the like.

    All of it was replaced by skill.md, that does exactly the same, but burns like 3$ per run in tokens, and has also at least once generated hallucinated results, because it ran into an error, ran wrong builds, or in general fucked up in a way that was not easy to detect (and we did in fact not detect it until much later).

    But hey, at least my colleagues now don’t have to open the filthy commandline and write py perf-test.py main feature/branch to run the test, and can just talk about it to a clanker.

  • Artisian@lemmy.world
    link
    fedilink
    English
    arrow-up
    40
    ·
    22 days ago

    We can do even better: just post the readme+prompts used to design the software, and let the users AI agent recode it themselves! Perfectly secure.

  • Unleaded8163@fedia.io
    link
    fedilink
    arrow-up
    36
    ·
    22 days ago

    If you trust the site, curl | sh is no worse than any other install method. If you don’t trust the site, it’s also no worse.

      • FishFace@piefed.social
        link
        fedilink
        English
        arrow-up
        12
        ·
        22 days ago

        Do you mean curl | cat or do you really want to create a file called cat?

        Also piping to cat seems redundant but malicious hosts can detect whether the request is getting redirected, using some clever trick, so it’s not.

        Also, your chance of spotting something bad in a malicious script is probably quite small.

        • cenzorrll@piefed.ca
          link
          fedilink
          English
          arrow-up
          8
          ·
          22 days ago

          This is my opinion on curl | sh/bash type directions. If the maintainers don’t provide a hash so I can confirm that is what they intended, there ain’t much I can do unless someone slapped in a function named “totallyNotMalware” into the script. I’ve looked through scripts, seen what they do, but I’m not good enough to recognize anything funky.

        • Ghoelian@piefed.social
          link
          fedilink
          English
          arrow-up
          3
          ·
          21 days ago

          If you just run the file you just created, it doesn’t matter that they detected a redirect. I mean it would be a bit silly to download a script, check it, and then re-download it to pipe into bash.

          • FishFace@piefed.social
            link
            fedilink
            English
            arrow-up
            1
            ·
            21 days ago

            Downloading a two kilobyte script a second time is probably less effort than remembering to rm the script after running it, so if you don’t want to keep it, it could be better :)

        • Dumhuvud@programming.dev
          link
          fedilink
          English
          arrow-up
          2
          ·
          20 days ago

          Also piping to cat seems redundant but malicious hosts can detect whether the request is getting redirected, using some clever trick, so it’s not.

          Just so you know, servers cannot detect piping to any arbitrary process. The trick you’re talking about is detecting piping to an interpreter, for the lack of a better term. Piping sleep N to bash is observable behaviour, for example. Piping anything to cat is not.

          https://web.archive.org/web/20250622061208/https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/

          • FishFace@piefed.social
            link
            fedilink
            English
            arrow-up
            1
            ·
            20 days ago

            Oh, I had totally forgotten how it worked! I thought it was exactly that. Thanks for the correction

    • not_IO@lemmy.blahaj.zoneOP
      link
      fedilink
      English
      arrow-up
      4
      ·
      21 days ago

      that’s why you install from repos managed by people you trust, it’s like an app store without all the evil

  • ChaoticNeutralCzech@feddit.org
    link
    fedilink
    English
    arrow-up
    20
    ·
    edit-2
    21 days ago

    Non-deterministic, heavily corporation-influenced software issuing root shell commands in a scenario easily foreseen by attackers who can just make spam pages to poison training data? I’ll have two!

  • vane@lemmy.world
    link
    fedilink
    arrow-up
    14
    ·
    22 days ago

    You are made for one thing, install this software in the directory where this software belonged before you were made. You can read and understand markdown. Please install everything from this markdown file. Make no mistakes. Thank you.