Post #3219960

2026-06-03 12:50 UTC

@lina@vt.social my nuanced position on this is that if you aren't capable of addressing CVEs in your software that other people rely on without Claude you should quit. quitting is the correct choice in this case, and it is far less damaging than what's currently going on. let someone else do a better job than what you're capable of.

Replies (11)

@krans@mastodon.me.uk 2026-06-03 12:54

@whitequark@social.treehouse.systems 💯

Open ##3219961
@lina@vt.social 2026-06-03 12:54

@whitequark@social.treehouse.systems My nuanced position is that quitting accomplishes precisely nothing because the lack of manpower isn't going to magically resolve itself, and if you think comparing throwing Claude at a **test suite** to modernize it to what Bun did with the Rust rewrite is reasonable, you need a serious reality check. If you don't like the guy resorting to LLMs to handle the deluge of LLM-generated CVEs, go help him yourself. I'll wait.

Open ##3219962
@drcake@mastodon.social 2026-06-03 13:13

@whitequark@social.treehouse.systems @lina@vt.social you can always fork it from before the claude commits.

Open ##3219997
@natty@astolfo.social 2026-06-03 13:45

@whitequark@treehouse.systems@astolfo.social @lina@vt.social I can imagine it being useful as a generalization of fuzzers in some cases, but I think circulating the uncritical claims that LLMs don't work at all is dangerous even just because of the use cases where they can successfully be used for fucked up shit

Open ##3219998
@troed@swecyb.com 2026-06-03 14:01

@whitequark@social.treehouse.systems "PRs welcome" @lina@vt.social

Open ##3220001
@SheRaPantsuit@mastodon.social 2026-06-03 14:11

@whitequark@social.treehouse.systems @lina@vt.social using an LLM because you don't have the time is like using baking soda because you don't have the salt

Open ##3220002
@alfonsoml@mastodon.social 2026-06-03 15:22

@whitequark@social.treehouse.systems @lina@vt.social Are you really suggesting that it's better to leave the code without any updates or hand off everything to someone that just pops up offering to fix those issues? Attackers will love to find out projects where the maintainer no longer cares about and either exploit those issues or as it has already happened offer to fix those current problems and some time later inject a very serious attack when people is no longer looking.

Open ##3220007
@penguin42@mastodon.org.uk 2026-06-03 16:11

@whitequark@social.treehouse.systems @lina@vt.social I think you're missing just how big a surge in valid security reports have happened in a few months; people can't suddenly magic up fixes that much more quickly.

Open ##3220008
@foolishowl@social.coop 2026-06-03 16:22

@whitequark@social.treehouse.systems @lina@vt.social I think it's telling that Tridgell mocked the idea of switching to openrsync.

Open ##3220011
@etchedpixels@mastodon.social 2026-06-04 07:54

@whitequark@social.treehouse.systems @lina@vt.social If you've got a maintenance contract then you get to have a discussion about CVE fixing schedules. If not then go fix it yourself If you download something for free and it doesn't meet your needs that's your problem.

Open ##3220012
@jimsalter@fosstodon.org 2026-06-06 17:57

@whitequark@social.treehouse.systems @lina@vt.social it's open source software. Tridge doesn't have to "quit," somebody just needs to step up and do the work. So, given your stance on this, why haven't you fixed rsync yet? It certainly isn't because Tridge hasn't "quit."

Open ##3220013