They don't. If some code is so old or un-used that you would call it "dead" then there are no cve's on it. No one is using it to discover a vulerability, no one is studying it to find a vulnerability, who writes these supposed cves?

Even if by some miraculous combination of unlikely contrived coincidenses, someone researches, discoveres, writes up, and submits a cve, and the tracking orgs accept and publish it, so what? You just called it "dead" so who does it affect? What does this "cve" matter?

If they do matter because there are users, then it's not "dead".

It's just code that exists that may or may not be useful or interesting to someone sometime for something, or not, like a novel or song or painting.

If it's half-baked code with some problem if it were used exactly as it sits with no further work, so what?

Also I don't think it's wrong to use an action as an input to judging engineering character. That could be read as judging yt-dlp or judging bun but in this case I mean it's reasonable to judge bun's developers.

IDK if i'd personally judge this action quite so badly though. It depends how they went about it and what they proffessed to get out of it.

I am very much against letting llms think and decide for you, but I don't think it's so wrong for an actual coder to employ automation.

But if they are acting like it's magic and everything will be so much better after the magic llm uses the magic safe language... yeah that definitely gets the side eye. Or no eye. Just no longer interested in or concerned with their output.

Since this is being offered as the next release version while still being new and stuffed with unsafe, looks like it's the latter. So I'm with yt-dlp in this case.

It doesn't matter if the new code happens to be ok or not, it's still a problem that they got there by hoping a black box does the right thing. A black box that that no one wrote and no one understands, not just themselves.

gcc is a black box to me, but I know that someone wrote it and understands it (or some people collectively understand all it's parts), and I know that any time I want, I can choose to understand any part of it, and satisfy myself that it is doing something both sane and deterministic.

So a developer choosing to use gcc when it's a black box to them does not reflect badly on them to me.

But no one can say that about any llm or ai. So yeah, a developer choosing to use them, depending on exactly how, may reflect badly on them.

The same was true for cheap off-shore gig coding by humans too. I have tried to use them myself in the past, hire out for small generic programming jobs using those web sites where you put up some escrow money and post a job and people bid for it, you choose one, they do it and get paid from the escrow. I only tried about 3 times for the same small job and every time I git ridiculously shit (but technically functional) results.

These were humans 15-20 years ago, no possibility of hidden ai usage like today, and it's essentially the same dynamic of just hoping some magic will get you something good for cheap, and accepting any result that appears good as good.

If someone said that that's how they made their product, I would decide that product is probably pretty crap inside and no way should I buy it or invest in it as a dependency if I have any choice.

And that's humans not ai. The problem isn't really the ai, it's the judgement to use an ai that way.

This while paying them for premium for 20 years.

You know even though I said the execution is unlike linux, in fact, there are many many details that are just like linux! What a freaking ignorant liar eh? There's like 100 things like that you could say. No wait, no way it's exactly 100. There's obviously some other number like 105 or 612 things like that. So superficial and wrong!

If one project is dead, what makes another one alive? Recent updates? It's working as intended and no updates needed or worth the effort. Even if "working as intended" only means it works on some old platform and no current one. Other users? Why do I or you or anyone care about that?

Other users only matters for commercial software where you are selling copies or expertise or your resume or something tied to it.

If someone writes something and publishes it, and not a single other person ever uses it, and the author never adds another update, that is still not "dead". It's just software that exists.

It's some kind of focus on a weird goal. If your purpose in writing open source was for it to be popular, then buy advertising until you force it to happen.

But it's not a matter of surface area that makes openbsd solid, it's the priorities while writing that affects how every little thing has been written over time.

You can write 10 different versions of a function that all work and are all nominally perfectly free of security gaps.

Yet they will all still be 10 different levels of robust. Some versions will fail as soon as some assumption is violated, and some make fewer assumptions and remain safe even when varying amounts and forms of "that can't happen" happens.

It's not just cosmic ray bit flips either, or a hacker trying to do power glitch attacks or rowhammer etc, stuff that makes the hardware violate it's promises. But stuff like a different developer updating something 15 years later who is not the original and does not realize every single facet of how it works and just how the current implimentation covers all possible edge cases, and so doesn't realize how their change opened up an edge case that was covered before. With fragile code, the new code simply has the new security gap until someone discovers it the hard way. With robust code, it's more likely to still be safe. The edge case maybe makes it fail to function, but not in a way that anyone can use productively.

Not that freebsd is exactly swiss cheese. These are all relative. I would and do rely on freebsd any day.

What they said was what it looks like, and in fact it does look exactly like what they said.

The comment contains the exact same content and value as a bot comment. It doesn't matter who or what wrote it, the critique of the comment itself holds water.

So the critique was not "a bot wrote this" it was "either a bot wrote this, or a human wrote a comment that is no better than the ones bots write".

You know what else a human might do even worse than a bot a lot of times? A bot would read this and apologize for getting something so wrong.

openbsd = security

netbsd = portability

freebsd: performance, features, drivers, software compat - closest to linux in utility & usability though unlike linux in execution

openbsd: safety for exposed services

netbsd: portable across many cpu & hardware platforms - big-endian powerpc sun, hitachi sh3 jornada, etc, easiest to port to a new arch

In other comments I've distilled that down to "It can't be about what a thing can do, but about what a thing chooses to do." Which is a bit too distilled by itself but whatever.

The ability to solve a puzzle is just a correlation, probably a required ingredient, not significant itself.

The comment above was more focussed on it's parent about what you can deduce from outside observations. It's not true that there is nothing to go on. It's merely true that you can come up with a lot of examples of observations that don't prove anything.

Hearing something say "I think, therefor I am." doesn't prove that it thinks or is. Seeing something solve a puzzle or care for a baby doesn't prove that it is the same as you who can also solve puzzles and would care for a baby.

And yet, no matter how limited your means of expression were, if you had any means of acting at all, you could and would make yourself known. How I don't know because it's infinite and context sensitive. You would do something that only has meaning to me or other immediate observers because it would somehow refer to other immediate context.

You're nothing but a remote controlled roomba, and just to make the point we'll artificially remove the obvious easy direct possibility of writing letters out on the floor or tapping out morse code by bumping into something, etc. You can only communicate by actions. You don't know morse code and something like that simple doesn't occur to you because not everyone thinks like that or is good at thinking of things like that.

Yet... You see me looking around for something, and you push the cookie I dropped across the floor to where I see it. Then when I reach for it you move in the way because you wish to tell me I'm not supposed to have sugar & carbs, and indeed I do get that message. No single act like that says or proves much by itself, but stuff like that adds up to a pattern that exceeds the same sorts of things any dog routinely does, and none of it requires hardly any brute brainpower. Or maybe it does require brute brain power but it doesn't have to mean an ability to solve impressive puzzles. IE a dog will absolutely model that you are looking for that cookie and will absolutely desire to please you by bringing it to you, but will not joke with you by bringing a particular type of cookie that you both know you don't like. But it could be trained to do all the same outward actions. It has the brainpower to figure out even very complicated rules.

Yes other animals have demonstrated brain power that exceeds some humans, or even all humans while they are young enough, if you just go by some sort of puzzle-solving abilities. The fact that you can figure out how to unscrew a jar lid, and so can an octopus, doesn't imply anything about the octopus being the same as a human in an octopus body.

Similarly observing something simpler exhibit some of the same outward behaviors you and every other human does also doesn't mean anything. Humans do a lot of very simple things. A human seeks food and comfort and avoids pain and damage. And so does a plant. Electric motors turn shafts, and so do humans. So you have to discount anything that's merely a commonality like that, including other things that seem more complex, and so seem like they are what makes us different. We do also have more simple brain power than most animals, and so it is like a correlation with consciousness, but it is not consciousness itself or automatic proof of it and doesn't automatically or necessarily produce it. It's probably a required ingredient though. IE all beef is meat but not all meat is beef, all consciousness may have brain power but not all brain power has consciousness.

But, repeating an example I used in another comment, if you had no other interface with the world except a remote controlled roomba, you would be able to make yourself known. Not by anything as plain as writing out words on the floor, but by actions. There are an infinite number of ways that you a conscious being could disclose your existense to me who can only see the roomba. You could be anything from caring to menacing by simple actions. Because it's not the capacity to roll across the floor, it's where & when you choose to roll across the floor that ends up speaking and disclosing intent, which discloses the "you" in there.

Watch any horror movie about the robots going wrong, or like twighlight zone episodes where you don't actually see much action but the person wakes up and there is a knife sitting next to them, and the presumption is the creepy doll placed it there while they slept. It's a message that they could have killed them any time they wanted to, and they want you to fear.

No other animal has ever done anything like that, that can only be explained by "I want you to know that I know." or more generally "I want you to have a particular thought.", only things that can be explained much more simply and directly. Some things seem to come close like animals caring for other animals, bringing another animal food etc, but that is really just anthropomorphizing, because we also have all those same animal condition components to our own existense. We also feel hunger, feel a desire to relieve someone else's hunger, protect our young, etc. And animals do have some ability to model what they see. They can observe another animal and model what it wants or fears etc, because the ability to predict other things behavior is very beneficial to survival. And we see that and think it proves more than it does.

If you're a roomba that pushes a cookie across the floor to me, that doesn't prove anything all by itself, but it could be part of it. It's like how a word isn't a novel or a philosophical concept, but the philosophical concept is communicated with words.

The idea is to try to recognize how llms are like a misdirection tricking us into thinking certain things simply because they use text as the thing they manipulate. That makes them seem way more human than they really are, simply because they are slicing and dicing prior recorded human communication, which up until now has been something unique to humans. You don't need any words at all to make yourself known to me as being not just a roomba.

A cat doing anything that can be explained by simple tropism doesn't prove or disprove anything, it's simply data of no value one way or the other.

The fact that you sleep and so does a cat does not prove that you are just a cat or that the cat is actually postulating about the inner life of other cats but just choosing not to ever write it's thoughts down. It's simply a silly trivial surface thing to even talk about.

And you can't tell the difference between a person exhibiting many behavioral actions and something I could rig up with an electric motor and a light sensor to exhibit tropism, seeking things, avoiding other things.

But if you only had a remote controlled roomba to interact with the world, you would be able to make yourself known to me.

I don't mean that you could substitute a voice with writing out words on the floor, I mean your actions, the overall totality no single act, would would expose a driving source of actions that so far nothing else exhibits.

We just anthropomorphize everything because we have so much in common with all the other animals. When a dog or a dolphin does something, we have had experiences that we recognize as being practically identical, and we know what our experience was like. It's protecting it's baby. I protect MY baby! Yes and an electric motor can turn a crank, and you can turn a crank.

Simple outward alignments like that are some kind of logical trap everyone falls for because we don't have any other conceptual vocabulary to even think with.

Unlike with an ai, a pm knows what it means to understand something. Just in general, they have had the part of the human condition which is gaining an understanding of something. Not memorizing a fact or learning how top perform some recipe steps, but understanding several dimensions of something.

They don't code, but there are other things they have learned and understand, and witnessed other people showing how they do or don't understand that thing. It could be about fishing or calligraphy or being careful what you say to kids or anything not just work stuff. From that they know how to recognize it in others on other topics. Modulo the effect of the exceptionally good and bad on both sides, a good bullshitter can fool a simple pm, but the exceptions to a generality are irrelevant.

And they know that some other people do understand the code. They haven't performed all the steps to reproduce someone else's reasoning and correct final result, but they don't have to do that every time to know that it's possible to do and would arrive at the same or equivalent result. It's not faith, or not blind faith like religion. It's just letting someone else do a job that you know if you wanted to you could do exactly the same and it would work exactly the same. You don't have to carry a load of grain from one pile to another to know for a fact that it's possible to do and roughly what it takes to do it.

They also know how to detect cues about consensus, or lack of it. When most people who understand a topic, you can tell, without relying on any simple rules about what words are spoken, you can tell when most of the people who have put in the time to understand something agree or disagree on some premis. And the people you are guaging that consensus from are again other humans who you share the human condition with. You have a power to understand and interpret them that you don't for anything else.

They may also understand some level of code. It will have been explained to them at some point to some degree. They will have some sort of simple example in their history where they were walked through something in some class or a meeting.

These things are all missing with an ai.