For about a year as a hobby I've been writing an app that scratches several itches that I've had with the fediverse (multiple accounts at once, supporting both microblog- and threaded-style content, synthetic/hybrid feeds, etc.) and for the past month or so have been using it exclusively on the desktop and about 50% of the time on mobile (Voyager is my main mobile client and source of inspiration here). I'd like to open source the whole thing. But the code is mine, therefore buggy and bad. Normally I'd not worry too much about that, but in the age of LLM attacks I don't want to contribute more security vulnerabilities to the world. Should I use an LLM security tool to analyze my code and point out security issues so I can patch them before releasing the code? If so that would more or less be the only AI contribution. I'm a practical-minded person and use AI tools at work so it doesn't bother me, but I know lots of people here have strong (and often helpful) opinions on the matter.

you are viewing a single comment's thread
view the rest of the comments

[–] notabot@piefed.social 9 points 6 hours ago

You'll get blowback either way, the only difference is that in one case it'll be because your app was compromised and in the other case it'll be because someone doesn't see a difference between slopcoding the entire app and using it as a second pair of eyes in a limited, and human validated, context.

I think that LLMs for coding is both terrible practice and environmentally costly, but I can see this sort of usecase being beneficial. Trying to find a model that's only been trained on open source code, and that runs without a huge environmental cost is tricky though. You really don't want the risk that some proprietary code has got into the training set and it gets regurgitated for you. There's been way too many court cases over a few lines of code being copied.