Re^4: copyfail challenge: making Perl version smaller

So we can trust open source modules?

There was a recent blog-/reddit-post about hundreds of pull requests produced by AI and accepted within a week.

Some commentators pointed out that some of the original tickets were nonsensical and introduced bugs.

Edit: For the record

I'm not proclaiming security by obscurity. I'm doubting the PR value.

Cheers Rolf
_{(addicted to the Perl Programming Language :)

see Wikisyntax for the Monastery}

Comment on Re^4: copyfail challenge: making Perl version smaller

Replies are listed 'Best First'.
Re^5: copyfail challenge: making Perl version smaller by marto (Cardinal) on May 01, 2026 at 08:33 UTC
"So we can trust open source modules? It's reasonable to expect you can trust something more if you have access to the source code, but you'd need to read and understand it, and the wider implications of what the code does. It's likely easier for someone to find a problem with open source software by virtue of having the code, e.g. very recently cPanel CVE-2026-41940, Shai-Hulud Themed Malware Found in the PyTorch Lightning AI Training Library. "There was a recent blog-/reddit-post about hundreds of pull requests produced by AI and accepted within a week." The grift existed in the 'before times', including https://lore.kernel.org/lkml/202105051005.49BFABCE@keescook/, AI is just making this worse, cURL end bug bounty, cURL - death by a thousand slops.	[reply]

Replies are listed 'Best First'.

Re^5: copyfail challenge: making Perl version smaller
by marto (Cardinal) on May 01, 2026 at 08:33 UTC

"So we can trust open source modules?

It's reasonable to expect you can trust something more if you have access to the source code, but you'd need to read and understand it, and the wider implications of what the code does. It's likely easier for someone to find a problem with open source software by virtue of having the code, e.g. very recently cPanel CVE-2026-41940, Shai-Hulud Themed Malware Found in the PyTorch Lightning AI Training Library.

"There was a recent blog-/reddit-post about hundreds of pull requests produced by AI and accepted within a week."

The grift existed in the 'before times', including https://lore.kernel.org/lkml/202105051005.49BFABCE@keescook/, AI is just making this worse, cURL end bug bounty, cURL - death by a thousand slops.

[reply]