@monsieuricon βIf we set aside the ethical concerns for a moment, β¦β
@monsieuricon My complaints with GenAI cannot be answered by improvements in LLMs.
I have ethical, economical, environmental, and educational qualms about them -- so even if they produce perfect output, I still have problems with adopting them as they are today.
So, yeah. I agree -- "slop" complaints are easy, but increasingly outdated and easily dismissed. If that's what GenAI opponents are leading with, in relation to code, then they're not going to succeed.
* The "slop" argument *does* work well with other GenAI uses like writing, art, etc., because it's less about the quality of output and more about the volume and dehumanization problem.
@monsieuricon This is such a cop-out of an answer. Just because there are other things that entail ethical concerns doesn't mean you get to set aside all ethical concerns and run full-steam ahead into normalising and entrenching even more ethical problems.
@jzb @monsieuricon I have to say here that I also don't think it's particularly true that "actually LLMs are good at code now".
Advocates have said this repeatedly over the last several years, for pretty much every new model, and the results have always been underwhelming. LLMs are good at code now if you vastly lower your standards of code quality.
[Edit to add: I do think that in all those other fields you list, there are people willing to argue that AI tools are actually good, even when it's obviously slop to the rest of us.]
On top of that, though, just to agree with the other issues you raise: *even if* LLMs were as good as advocates claim, it wouldn't justify their use.
@monsieuricon That's the classic "I'm an expert, I can handle this" response. And I agree that the only ethical use of LLMs is if you're already an expert on the topic you're using it for in order to spot LLM mistakes.
But it's human nature to have a deeply wrong self-image regarding one's own fields of expertise. (Even before LLMs, it was a common sight to see retired professors write crank research-style papers about topics they have no idea about, but insist to be taken seriously because of their career and academic title.)
LLM as a tool is primed to feed the user wrong answers and give them a false sense of knowledge where the user is incapable to detect if the plausibly-correct-looking answer is actually correct.
And an enticing, literally addicitive tool that inserts obscure bugs into large codebases that you as a software developer are incapable to detect due to hubris, human nature and employee productivity rewarding KPIs like LOC is definitely a problem for our craft.
@monsieuricon This is not actually an answer to my point, though; it's just repeating the same bad point as before.
Just because some ethical problems cannot be solved by you or me within the course of our everyday work, does not constitute justification to give up on ethics and adopt even more unethical ways of operating.
@monsieuricon While I appreciate the snark, I'm sceptical about the addictive potential of a team of contractors.
@monsieuricon I get it. You want to keep doing the unethical thing and you feel uncomfortable being challenged on it, which is why you keep repeating the same non-answers to everyone who calls you out on it.
@monsieuricon Again, your argument boils down to 'some other people are more unethical therefore I can do whatever unethical thing I want'.
It's an opinion, certainly. But don't try to pretend this is about not being able to meet unreasonable standards; it's about trying to pretend that any ethical standard at all is unreasonable.
@krans
@monsieuricon what you describe may be the motivation for a subset of users of LLM coding assistants, but there's a wide range of users who don't fit that description. (See the bcachefs incident as an example.)
@monsieuricon This "I'm an expert, I can handle this and use an LLM for good" argument is also in direct contradiction to the literal sales pitch of generative AI products that promise its users "a PHD in your pocket". They WANT you to use the product outside of your field of expertise and they also tell middle management that senior staff's in-house-expertise is overrated and can now be replaced with tokenmaxxing.
@monsieuricon I see that you have made up your mind, but no, I would argue that it is indeed very different. If it were not, people wouldn't have the visceral reaction of disgust to the net negative of what operating and using LLM products is doing to business, arts, politics and society as a whole.
@monsieuricon so you see all of the ethical and moral concerns, like the hundreds of thousands of engineers put out of work and the centralization of all software to the hands of a few billionaires with enough GPUs to write it, and you don't care because "it writes good code sometimes"?
@monsieuricon I still think it's different than your cheerful view.
LLM proponents are basically saying "I'm a doctor, opioids are a helpful substance in medical practice when handled properly", while critics are saying that the corporate behaviour, marketing and politics around opioids are outrageous deliberate misbehaviour and have devastating effects on society. We're both not wrong.
With current AI products, we're talking about an industry that is intentionally financing fascism, increases fossil fuel use and willingly accepts the death of vulnerable people to sell their LLM product, which they then freely help their customers to use in Torment Nexus scenarios such as deportation police using face ID on citizens or automated weapons targeting in war.
It irks me to consider the downfall of the society I live in as an acceptable side effect for having a slightly better code completion assistant in my IDE.
@monsieuricon there are reports that LLMs were used by DOGE to create the list of grants to be cut, with an expected long term death toll in the hundred thousands. There are other reports about chatbots being used within the military during the current war.
@monsieuricon Don't listen to me, listen to Pete about this. He's specifically talking about generative AI / LLMs there:
@hzulla @monsieuricon crank style professors out of their field=the so called thought leaders of antivax and transphobia
@dissident_fish @monsieuricon exactly the example I thought of when mentioning crank professors.
https://www.forschung-und-lehre.de/forschung/wirbel-um-studie-zu-corona-ursprung-3513
@monsieuricon wth I found Sonnet to be quite excellent. Miles ahead of Gemini 3 Pro and perhaps lacking a bit vs Opus
@monsieuricon Computer programming is a social activity. Without tools to thoroughly analyze LLM-generated code FLOSS becomes no better than proprietary black boxes. Users can only trust their βvendorsβ. Take for example the recent Bun rewrite. How is the community supposed to review a million lines of code? How to determine no additional malicious functionality made its way into the codebase?
This isn't a technical issue, it is a social one. LLMs are bad for the community.
@benjamineskola @jzb @monsieuricon I also think there's more to examine about the "vulnerability discovery" portion of this. Having now read quite a few such reports, I've seen some okayish results*, a lot of pointless reports, more than a few that are flat out wrong, and a bizarre number of duplicates that say they're duplicates. Which is to say that the quality there also seems, to me, to be wildly exaggerated. When the man said the new version would generate 10x the number of reports, he was unfortunately exactly correct.
But there's another aspect to that as well: as a maintainer, I'm effectively forced to use the LLM even if I don't want to, because that's the vulnerability scan I get, and I can't just ignore the results. I have to actually examine how underwhelming they are. It's one more way this supposed time saving tool is making more work, rather than less. Beyond that, it's also a very bad model of consent. It's 2026, and relatively unskilled would-be attackers get to choose what tools I use.
At least I don't have to use it to write code. Yet.
(* tbf: a few of these would have been serious if not for other circumstances intervening. I think I'm up to four.)
@vathpela @jzb @monsieuricon A point I keep coming back to is, yes, LLMs have been used to identify a number of significant vulnerabilities. But they've also cost a lot in doing so.
If the same amount of money (millions!) had been spent on 'traditional' security research, how many vulnerabilities would have been found? Probably significantly more. The calculation I saw recently suggested that even the much-hyped Mythos isn't actually particularly successful.
Part of why it's been so high-profile is that we've only seen the results of successful runs, and not the many more failures; it's survivorship bias. Being actually more directly exposed to the output of these things, as you say, means sorting through the garbage to identify the potentially relevant outputs.
It's basically just brute-forcing. We've had ways of doing that for decades, it's just that nobody has bothered doing so because it hasn't had any hype attached to it.
My own personal experience of the 'code reviews' they generate has been, like you, underwhelming; usually a lot of irrelevant nonsense and a few minor issues with their severity significantly exaggerated. Ideally I'd never have to see one again; unfortunately, I don't get given that choice, because I work with people who take it personally when I criticise their best friend Claude.
@benjamineskola @jzb @monsieuricon yeah, I've noticed that in the news articles about mathematical proofs as well - all of them sound like using the LLM was the first attempt to automate the search, and it seems that automating it a traditional way would have taken less time and resources. But the availability of the resources to automate it were there because the product wasn't the proof, it was an LLM marketing demo.
@vathpela @jzb @monsieuricon Oh, and the other way of qualifying the 'not useful' / 'universally bad' thing is that useless/bad is not a binary. It's a tradeoff against cost.
So yes, did Claude successfully identify an incorrect function in our work codebase a couple of months back? Yeah, sure. Was it worth the cost? Absolutely not. It flagged something up as a security risk that turned out to be nothing of the sort, just a leftover method that could never be used and couldn't cause any actual harm (would just lead to an error, no data loss or unauthorised access).
And so for the cost of actually running the analysis, and then for the cost of me having to dig through its pages of garbage to figure out whether there was anything of value there? (The 'report' included a bunch of other irrelevant 'issues' and conflated minor refactoring suggestions with security issues and exaggerated the significance of both.) Not worth it.
And that is before you even get onto the externalities: all the other costs that are actually borne by someone other than the user; the environmental damage and other ethical issues and the way they're just generally making the world a worse place, all so that a handful of people can avoid doing their jobs properly.