Yet another Hacker News

The Era of Software Quality, or the Era of Ostriches?

27 points birdculture 1 hour ago 6 comments

someonebaggy 1 hour ago | parent

Everything coming from GNOME about software quality should be taken with a Strategic Petroleum Reserve of salt.

While other projects rewrite things in memory-safe ways, GNOME's response is to ask a chatbox if there are any memory vulnerabilities.

tom_ 41 minutes ago | parent

Say what you like about the random word sequence generation machine, but it does actually seem to be usefully good at generating sequences of random words that correspond to problems in your software. And if you're inclined to write the code by hand, it's probably going to be easier to fix up your existing shit than rewrite it all. (And if you're going to use AI, then you're hardly going to listen to me.)

jeremyjh 33 minutes ago | parent

The purpose of this is to address a practice common in certain open source ideologies of banning all AI contributions - including vulnerability reports. Basically they are choosing to ignore security vulnerabilities because they had to read too much slop last year.

lelanthran 24 minutes ago | parent

> Basically they are choosing to ignore security vulnerabilities because they had to read too much slop last year.

That's not only an uncharitable take, it's also wrong.

If 999 out of every 1000 "reports" from a specific source is wrong, then it is not irrational to disregard all 1000, especially when they can be generated faster than you can read.

I mean, it's just probabilities, right? If you're okay trusting output from an LLM, you should be okay with using statistics in general as a source for informing decision-making.

jeremyjh 17 minutes ago | parent

The TFA is making the assertion that most vulnerability reports by AI in 2026 are valid. They reference the fact that the curl maintainer agrees. That has been my experience as well. Are you arguing something different?

boxed 6 minutes ago | parent

You are out of touch unfortunately. Your logic was correct last year, but things have changed radically and super fast. You need to re-evaluate, and this article by a core GNOME developer specifically doing security work should have made you do that re-evaluation!