For about a year as a hobby I've been writing an app that scratches several itches that I've had with the fediverse (multiple accounts at once, supporting both microblog- and threaded-style content, synthetic/hybrid feeds, etc.) and for the past month or so have been using it exclusively on the desktop and about 50% of the time on mobile (Voyager is my main mobile client and source of inspiration here). I'd like to open source the whole thing. But the code is mine, therefore buggy and bad. Normally I'd not worry too much about that, but in the age of LLM attacks I don't want to contribute more security vulnerabilities to the world. Should I use an LLM security tool to analyze my code and point out security issues so I can patch them before releasing the code? If so that would more or less be the only AI contribution. I'm a practical-minded person and use AI tools at work so it doesn't bother me, but I know lots of people here have strong (and often helpful) opinions on the matter.

you are viewing a single comment's thread
view the rest of the comments

[–] emb@lemmy.world 15 points 7 hours ago* (last edited 7 hours ago) (1 children)

For my 2c, I think it's a good idea. If you don't, and it gets any use, attackers or contributors will.

It's a little bit of a lose/lose. The target audience is very anti-LLM, so some people will hate it. It's that or leave low-hanging-fruit bugs in there.

Either way, make sure to include an AI disclosure and explanation front-and-center. If I see a new project posted any more, I immediately write it off as low effort, vibe-coded slop until I have a reason to think otherwise. But using LLMs is not necessarily equivalent to slop imo.

[–] artyom@piefed.social 5 points 5 hours ago

I don't think anyone would be opposed to using AI to audit code. It's when it's to write code that people object.