Anna Maniscalco 🦀 🏳️‍⚧️

In short I'd say AI reviews fail to capture the essence of what reviews are about. They are not about preemptively catching every possible bug at whatever cost. Reviews are an inherently human process that involves exchanging information and opinions to find better solutions, compromises and overall to build better software and become better developers.

A few thoughts on this new trend of AI reviews. For those that are unaware, if you submit a patchset to the linux kernel mailing list, as of recently, you will get ai reviews by a bot called sashiko. My experience as a developer with it has honestly been rather negative. Sashiko will generate way more comments than a human would, all pointing out potential problems with your patches. This has, for one, an impact on your morale. Your code is being absolutely shredded apart by a bot which isn't fun. On closer inspection though a lot of the comments are based on very shallow and inexact reasoning. They may look plausible and clever while being completely wrong and meaningless. So for one one must go through all of them and carefully judge each comment. Blindly applying the comments can lead to outright broken code, but at the same time among the comments there might be genuine problems being pointed out so ignoring them won't do either. The comments are not the result of proper reasoning but there's enough of reasoning like logic in them that it takes significant cognitive load to judge them. But then, if I'm submitting code to the kernel there might be things I'm unsure about, the kernel is huge and not every submitter will know the intricacies of every kernel API. Reviews generally play an important role there. If someone experienced points something out I can generally trust it and, even if the advice turns out wrong we can collectively take responsability for it and reason about it again when the bug shows up. But if the bot points out something about code I was dubious about, what should I do? Did human mantainers not point out the bug because the bot did and agreed with the comment? Did they just not notice either the bug or the comment? Should I just blindly trust potentially wrong advice? Should I ignore potentially good advice? If it goes wrong the bot can't be held responsible for it, only I can, so maybe ping human mantainers? But then on top of me having to do more work to sift through the huge volume of comments human reviewers need to spend more time carefully analizing those comments. In the end it adds more friction and more work for everyone involved, and it's non trivial. Arguably the end result might be better, among the many comments the bot makes there could be some genuine bug or security vuln that might have gone unnoticed. But at what cost? The cost is huge and I'm not even getting into the environmental implications and whatnot. As far as I'm concerned I'd rather go back to the old workflow where comments I got in my patch where all meaningful and an opportunity to learn. Merging bugs has always been a part of the game and trying to preemptively prevent them is infeasible anyway. What good is it to have a dubious and marginal improvement in the final code quality if the price to pay is making the process so much more exhausting and un-human for everyone? What impact will that exhaustion have on the code long term? It may very well be a net negative. If someone really cared about the potential bugs sashiko can catch they should run it on the codebase themselves and do the work of sifting through the noise out of choice. Even then, filtering without enough care can lead to needlessly burdening patchsets that mantainers have to review.

@karolherbst@chaos.social @mupuf@social.treehouse.systems well yeah no opinion should be rejected based on things other than logic reasoning. That I agree. Also yeah your social status surely does determine how available the resources to learn are. That it's not THE reason one gets good at something though. Lots of people with access to computers and the internet never learn programming. Even then I suppose you could argue that genetics are luck too, and that's where I argue that society should do better at treating people with different genetics and generally diverse skills equally. However I think when one talks about merit they focus on whether people are judged for who they are when they are hired rather than some other factor. It makes sense that people that are best at a certain job get to do that job, what I think we should focus on is that everybody gets an equal chance to live and enjoy their life regardless of things that are out of their control like interests and skills.

@karolherbst@chaos.social @mupuf@social.treehouse.systems I think having a certain shape of autism does make you better at doing certain things. The unfair part is that some skills are considered useful while others aren't. So, a person is never better than the next, but a person can be particularly good at one thing and in this world being good at certain things gives you an advantage. I wouldn't put it as being all luck tbh (although I guess having the "right" skills is luck). That's not true especially in the open source field where lots of people are hired because do the work they do voluntarily.

@cadey@pony.social I wonder how crates.io differs or whether those attacks would be equally feasible there.

So when people talk about AI there's a lot of discussion on whether it works, whether it is a tool, whether it is not and whatnot.
I'm frankly tired of hearing all of this.
I don't care about any of it because the simple truth is that I don't want it.
We are humans, we don't just do things because they have purpose. You are gonna reach the leaves of the tree if you follow through the branches hard enough and you need to ask what's the purpose of it all.
To me the answer is that we are humans with feelings and are driven by arbitrary and irrational impulses that where carefully chosen by nature over millions of years to keep things balanced.
I don't write code to reach some goal, I write code because it's my craft and I feel fulfilled in taking care of some project, exploring knowledge, experimenting. By the time I see the final result the path to get there has taught me new aspects of math or some algorithm or whatever and I feel like I'm expanding.
A tool that promises to do this for me is simply undersiderable.
It takes something I love doing and makes it less interesting and less valuable to me as a person.
When I wrote code I write it my own way, someone that has worked with me for long enough might even recognize my code just by reading it sometimes.
If an LLM is doing that typing for me then that code won't be mine the same way.
Even if the LLM gets the job done I'm still not happy with the output because it won't be written the way I would have and I won't feel as comfortable working on a codebase the same I would have if I had proper control over it.
All of this matters.
I keep hearing from people around me that the companies they work for are now forcing them to use those "tools" because it maximes some shallow metric of productivity. It is truly sad and depressing because it effectively forces them not to care.
It feels like yet another capitalistic fever dream of maximizing some number at the expense of many other metrics which aren't modeled in the simplistic charts they look at. Yet our brain goes beyond those metrics and that's why to many of us it all feels wrong and dehumanising even if we can't always put our finger on why. That feeling does point at something real, just because it is too complex to put on a 2d chart doesn't mean it's not there.
I don't think it is sustainable, the world is made of humans and humans are maintaining the machinery that keeps making them money. If they make everyone depressed, even if they get a 10x boost in the lines/h that their developers put out or whatever, it's all inevitably going to collapse under it's weight.

@drakulix can't you run Wayland apps as root just by setting WAYLAND_DISPLAY to the absolute path to the socket?

@karolherbst@chaos.social But also we have driconf to sometimes work around specific game's bugs that technically violate the spec and whatnot.

@karolherbst@chaos.social yeah Mesa is also p good at this. I feel like it's the king of thing that makes software something you can rely on.

@karolherbst@chaos.social yeah It makes sense tbh because totally removing it would probably be a lot more effort both for HW and SW.

@karolherbst are those the cards that keep some gfx or the ones that remove it?

@karolherbst afaik they give it bare minimum raster perf and strip down the ISA somewhat requiring some emulation. I'd imagine the reason being that this way they can run the same driver stack?