Generated patches - Page 1
Forum section: electronics / general

author: golden_labels
author_rank: Super Contributor
timestamp: July 23, 2025, 09:22:41 am
content: Note: this is related to, but separate from various platforms and companies now employing automatic bug reports generated by machine learning algorithms. This post is not about these.Today I came across a sad incident. I’m skipping the identifying details, just conveying the picture. While receiving help in a support channel, a person confessed using Gemini to “fix” source code of a program which they believe contains a bug. The person isn’t even a programmer and it seems the issue is PEBCAK, not a program bug. They remained deaf to explanations, that this isn’t really a fix, the change mostly rewrites the same code in a weird way and skips some cases, and that it doesn’t matter if it’s “working now.” So be it, we can’t save the entire world. Could it get worse?Yes. They used Gemini to generate a full bug report with a patch and sent it to the upstream. Still not having even a slightest idea, what the code or the change do.Now, that brought some thoughts to my mind.One, instant reaction is: such reports and patches should be instantly dismissed, without being read. Whatever intentions of the “author” may be, it’s borderline dishonest. When a patch is donated, the value is not in the code. It’s in the work the author puts into understanding the problem, pinpointing the causes, finding a logical solution, and testing whether it works. The recipient is relieved of that work and only needs to do some rudimentary checks. But LLM offers none of those. Instead, it only adds work to the devs. Worse, if the “solution” is actually wrong, and even worse if it looks deceptively “right.”I would be delighted, if I could accept that position. So clean and simple! But my brain wouldn’t be itself, if it didn’t engage critical thinking.Let’s assume there actually is a bug. This of course is not given in this situation, but let’s be gracious. If the code offered changes program’s behavior, it can be used as a diff to trace down the actual issue. The patch may be utter nonsense, but its validity no longer matters. Instead, we’re in a situation where many people use random generators to find a differentiating case and some of them report successes. Call it distributed “reverse” fuzzing, if you wish.Any further thoughts? How to handle those best? How to find the right balance?

author: ataradov
author_rank: Super Contributor
timestamp: July 23, 2025, 02:24:17 pm
content: Anything touched by LLM is dismissed on the spot. It has a chance to miss real issues, but it has 100% chance of dealing with people that have no idea what they are doing.I do the same with forum posts. As soon as someone mentions "I asked ChatGPT and it said...", I close the tab and move one with my life. If people don't want to use their brains to even smallest extent, I'm not going to bother with them either.

author: JPortici
author_rank: Super Contributor
timestamp: July 23, 2025, 03:09:20 pm
content: Quote from: ataradov on July 23, 2025, 02:24:17 pmCouldn't have said it better

author: SiliconWizard
author_rank: Super Contributor
timestamp: July 23, 2025, 04:43:52 pm
content: So you're basically describing a "new" trend where people that don't know what they are talking about feel entitled to contribute to open-source software because they can use LLMs.I put "new" in quotes, because the trend actually predates the rise of LLMs, although it tended to touch more general topics and had kind of left engineering (that is, *real* technical work) alone for the most part.This started with the democratization of the Internet. That was the "googling" effect. Over time, almost anyone could begin thinking that they knew about some topic they ignored just minutes ago, just by using a search engine.With LLMs, that's the same thing, but cranked up a notch. At least, with the googling approach, that could be (was not necessarily, but at least could be) an opportunity to learn something new, even if just superficially. Better than nothing. With LLMs, people tend not to learn a single thing due to the fact they can spit out something allegedly "ready-to-use", so no further effort is required.Tools that can enhance what you do are great, but tools that just make you stop learning are a disaster. Things are of course even worse when said tools are not reliable (which they are not, at this point), but even when they are, that's still a major issue. If we stop learning, we are doomed.Now how to handle it if you are on the "receiving end", it's up to you. It sounds reasonable to discard such "contributions" immediately. Some people will say that they see no reason those contributions should not be handled just like any other. To avoid prejudice, I would take an objective stance: as a maintainer of some project, you may for instance consider LLM-generated "contributions" just like any other, for a while (set a specific time frame or number of such contributions). At the end of this period, evaluate what was the outcome. If most of them just made you lose your time, stop there and make an announcement that no LLM-generated contribution will be considered until further notice. In the end, it's all in how effective things are. If they aren't, why bother?As to people trying to contribute via LLMs when they wouldn't be able to make the same contribution on their own, this is unfortunate. Not just for the reasons above, but also because IMO they are wasting everyone's time, including their own. You don't need to be a software developer, or even a "tech" person to contribute to open-source projects. As a user, you have ample ways of contributing positively and in your area of "expertise". User feedback can be invaluable and can help a project get mature and improve in more ways than a single software developer can. Good bug reports, usability, reports... the list is long.Just my 2 cents.

author: ataradov
author_rank: Super Contributor
timestamp: July 23, 2025, 05:59:04 pm
content: It is fine if LLMs help someone to find the issue or whatever. But the report still needs to be in a form "setup - steps to reproduce - expected result - actual result - may be investigation of the reason and ways to fix". You don't need to be technical at all to do this, you just need to have common sense.If a report well formatted, there is no need to mention tools. Like, I don't say "I used Notepad++ to look at your code and I see the issue". But if the report is "it crashed for me, I asked ChatGPT to fix and here is the dump of what it spit out", then it is just a waste of everyone time.

author: radiolistener
author_rank: Super Contributor
timestamp: July 23, 2025, 08:59:34 pm
content: A possible way to handle this is to explicitly label such reports as LLM-generated and triage them using another LLM before they reach human reviewers. This allows to filter out low-quality or misleading submissions while still benefiting from occasional useful signals, without overloading maintainers.Quote from: SiliconWizard on July 23, 2025, 04:43:52 pmThat's a fair point, but I've also seen the reverse happen - when a user submits a detailed and technically accurate bug report, sometimes even pointing to the likely cause, but it's dismissed as "not a bug" by someone who may not fully understand the context. So while unqualified LLM-generated reports can waste time, we should also be careful not to disregard well-founded input just because it comes from a non-developer.I do agree that automatically generated LLM code patches should be rejected by default. They may serve as a useful reference for exploration or identifying potential areas for improvement, but they should not be treated as direct replacements for human-written code.

author: magic
author_rank: Super Contributor
timestamp: July 24, 2025, 05:32:39 am
content: Quote from: golden_labels on July 23, 2025, 09:22:41 amThat's easily done if the author admits to using LLMs, harder if he doesn't. For the latter case you unfortunately need to critically review everything getting submitted, which you always needed to do anyway because incompetence isn't unique to LLMs - they just happened to "democratize" superficially plausible incompetence.There is fear that you may miss a real bug, but my experience with a few such "contributions" so far is that they are 99% bollocks and the 1% is nothing deep. Current crop of LLMs is far from being able to properly understand complex projects and their unwritten assumptions (at least the sort of projects I'm familiar with), so their output reads like word salad with a blatant factual error every few sentences. This also helps with spotting cases of undisclosed LLM use.Arguably LLMs are worse than static analyzers, which at least produce a detailed and logically correct explanation of how they believe something wrong is supposed to happen. Then reviewing the report is simply a matter of reading it and going "ah, this here won't happen because the function will never be called like that". With LLMs, every step of the supplied "reasoning" may turn out to be logically invalid, or referring to something which doesn't even exist in the code. Static analyzers have been a similar nuisance for open source projects for years, because anyone can run one of those and produce a trivial patch which silences the warning without understanding the root cause of the problem and whether there is a problem at all.A fun feature of LLM contributions are hallucinated commit messages, which may include things like testing that you immediately think "no way this author could have actually bothered with it". Then a few quick "proof of work" questions confirm your guess

author: rob77
author_rank: Super Contributor
timestamp: July 24, 2025, 07:48:49 am
content: i'm using LLMs (self hosted) to point me to the right direction (google search is pretty crap nowadays) or generate a skeleton (be it code, report, document) but never rely on LLMs to generate the "final product". and i fully agree, a patch generated by LLM with no human verification/review should be dismissed immediately.

author: magic
author_rank: Super Contributor
timestamp: July 24, 2025, 08:34:08 am
content: On a related note, I admire the courage of people who run LLM-generated code on their computers despite having no programming knowledge and no ability to tell what those patches are really doing.Hmm, that sounds like a potential opportunity for malicious LLMs

author: golden_labels
author_rank: Super Contributor
timestamp: July 24, 2025, 06:15:30 pm
content: So far I’m positively surprised by quite balanced opinions. In particular in the poll.Quote from: magic on July 24, 2025, 08:34:08 amDo you mean:“I Watched Gemini CLI Hallucinate and Delete My Files”?Quote from: magic on July 24, 2025, 08:34:08 amIntentional, malicious activity is much, much less likely than plain mistakes. With both machines and humans. Both are equally destructive too. So we don’t even need malicious LLMs to wreak havoc!

author: Siwastaja
author_rank: Super Contributor
timestamp: July 24, 2025, 06:55:10 pm
content: IMO, it is irrelevant toknowif some contribution was made with an LLM.If it's good and we are unable to say it was done with LLM, then great!If it's crap, then it's crap anyway, and we should not only ignore it, but probably start paying some attention if more and more crap is coming from the same author. It is then only of academic interest to analyze for the cause of the crappiness - is it crap produced by a human, or LLM crap?I also accept the idea of quicker dismissal upon recognizing LLM (explicitly mentioned, or from the style of the contribution). It is completely fair. Just use LLM to produce good quality output, and no one will notice and it will pass, and everyone's happy. Can't do that because LLMs are crap after all? Then we have to live with that reality and stop the AI daydreaming, simple as that.Those who "want" to see AI succeed, need to deliver results and proof. It's on them, instead of others needing to accept crap and fix it manually.

author: paulca
author_rank: Super Contributor
timestamp: August 03, 2025, 10:10:23 am
content: Curl have now banned any AI assisted bug reports period.Cyber security space is where the "battlefield" is moving too. LLM/AIs/CodeAssists has created an army of "self taught" security researchers filing 1000s of vulnerabilities a week. 95+% of them are bogus, AI slop, BS.On the other hand.. the people using AI to find these bugs, NOT to report them but to exploit them are finding the AIs will still produce those 2/3% of valid bugs which may for initial attack vectors.So AI is blurring the sharp eyes needed to see the REAL threats at the same time helping those who know how to use them effectively to find more threats to exploit.All at the same time the next industry field for AI to begin penetrating is the networking side. They have been trying to get "delcarative and adpative" networking sorted for years are now jumping onto AI generative models for reconfiguring networks on the fly as demands change etc. etc.Now the UK want to ban VPNs and MPs are telling us "If you use a VPN you are siding with the predators"Popcorn times.More seriously. Time to keep your head down. This one might make a bit of a "flash" before it settles down. Don't want to loose any eyebrows.

author: golden_labels
author_rank: Super Contributor
timestamp: August 03, 2025, 11:41:28 am
content: 3/4 fortnight has passed. I assume most of people, who had something to say, did reply.Skipping the quantitative part,(1)the replies are surprisingly balanced. As I said before, that pleases me greatly. I was worried the thread is going to turn into half off-topic cesspool. It mostly did not.Replying to new coments:Quote from: ataradov on July 23, 2025, 05:59:04 pmQuote from: Siwastaja on July 24, 2025, 06:55:10 pmTo me that sounds like saying, that only package matters and not the contents. Would you say, that a charger in a neat case is fine, even if it’s so poorly constructed it fries your phone and zaps you with line voltage?I doubt that and I consider this to be a good parallel. Clear and readable format is important, but validity of the content is of much greater weight. A poorly worded or presented pull request, that is otherwise valid, is hard to follow, but is valuable. On the other hand receiving some trash, that is generated to look as if it was a valid PR, is just wasting time.(2)Even worse, if it’s so believable to be actually merged and later discovered to only cause trouble.Quote from: SiliconWizard on July 23, 2025, 04:43:52 pmYou are right on the irritating crowd of contributors, who cause more noise than actual input, not being a new thing. But I believe this is a distinct situation, even if it’s related. One can easily spot most of such poor quality contributions. LLMs blur the lines. Unless recognized as such, they may look as completely honest, quality, working pull requests. Even to trained eyes.As a side note, I stopped seeing people, who feel pressed to contribute without skill, as unambigously negative thing. I suppose that came to me with age and reflecting on the past of both me and other people. Nobody is an expert from the begining. By the very definition of being an expert. When I think of the things I published as a teenager, I wonder what a crazy person even permitted me to do this! So ignorant, so inexperienced, so naïve, lacking any deeper thought, and producing horrible code. Everybody needs time to grow and the more advanced persons should guide them. The problem only starts, when somebody refuses to improve. In the world of community moderation there is a saying: it’s easier to make a great moderator out of a bad one, than to find a good one. It embodies the issue well.Quote from: SiliconWizard on July 23, 2025, 04:43:52 pmIn this case I’ll note this isn’t a thing as fresh as the internet. I say it did start when the compulsory education gained traction.(3)This got coupled with values of the 19th and early 20th centuries middle class. Search engines and instant access to poor-quality, yet easily digestible “fast-food information” just increased both the speed and breadth.(1)The survey result is garbage from numerical perspective.(2)With the exception discussed in the opening post.(3)At least on massive scale. Wasn’t it also present earlier? In the form of all-knowing persons having great memory for anecdotes and even greater imagination?

author: radiolistener
author_rank: Super Contributor
timestamp: August 03, 2025, 01:24:32 pm
content: Quote from: paulca on August 03, 2025, 10:10:23 amold classic: "If you're not with us, you're with the enemy"Sounds oddly familiar...Next step: sealing the routers and tuning only to state-approved channels.We've seen this broadcast before, with different uniforms.Attached: original warning tag from 1933,issued with VE301 radios.QuoteTranslation:QuoteBut don’t worry - it’s all for your safety, citizen. The Ministry of Truth is here to help...

author: ataradov
author_rank: Super Contributor
timestamp: August 03, 2025, 03:21:15 pm
content: Quote from: golden_labels on August 03, 2025, 11:41:28 amNo, what matters is reporter's personal understanding of the issue. If something is not clear and you ask followup questions, you want to get a specific answer, not "I dunno, chatgpt told me that, I myself don't understand it". Clear steps to reproduce and understanding of the expected outcome is the baseline for this.

author: radiolistener
author_rank: Super Contributor
timestamp: August 03, 2025, 05:01:03 pm
content: Quote from: ataradov on August 03, 2025, 03:21:15 pmYes, clear steps to reproduce are important. As for understanding the expected outcome... em... in practice, testers often lack deep insight into implementation details or undocumented behavior. Still, when they notice that “something feels wrong”, it can be valuable feedback.

author: ataradov
author_rank: Super Contributor
timestamp: August 03, 2025, 08:51:12 pm
content: Quote from: radiolistener on August 03, 2025, 05:01:03 pmWell, they still expected certain behavior, and they got something else, which caused them to file the report. They don't have to be right and are allowed to miss why things done a certain way, but they need to be able to clearly formulate what exactly feels wrong and how wrong exactly.