from xoron@programming.dev to programming@programming.dev on 30 Apr 08:02
https://programming.dev/post/49627061
Been banned for AI-Slop on a few subs here on Lemmy as well as on Reddit.
I always provide a good amount of technical detail in my posts and i try to be as transparant and communicative about the details. My projects are very complicated and I try to document them well.
my project is pretty cryptography-heavy… the act of me sharing my efforts in an attempt to show transparency… but it is used against my project by calling it AI-slop (undermining Kerkhoff’s principles).
It’s 2026 and most developers are using AI. I have used it to create things like formal proof and verification.
my project is aimed to be a secure messaging app. i have all the bells-and-whistles there along with documentation… but if the conversation cant move past “its AI-generated”… then it seems the cryptography/cybersecurity/privacy community isnt aligned with the fact that using AI is now common practice for developers of all levels.
AI is a tool. you cant (and shouldnt) “trust” AI to do anything without oversight. AI does not replace the due-diligence that has always been needed. i dont “trust” my hammer to bash in a nail… i “use” the hammer. AI is not different in how you need to be responsible for how its used.
i’ve busted my ass on my project for it to be called AI slop. i think its completely fine when it comes from folks in the community. cryptography is a serious subject and my ideas and implementation SHOULD/MUST be scrutinised… but its simply ignorant if mods are banning me for the quality of my work considering the the level of transparency and my engagement on discussions about it.
It’s a bit reductive to call it slop. I think i try harder than most in providing links, code and documentation. Of course I used AI… and it’s clearer for it. (you can find more detail on my profile)
i am of course sour from being banned, but am i wrong to think my code isnt AI slop? Some parts of my project are clearly lazy-ui… but im not sharing on some UI/UX/design sub. the cryptography module has unit tests and formal verification. if that is AI-slop and can result in me being banned, i simply dont have faith in that community to be objective on the reality of where AI can contribute.
while its understandable people dont want to review AI-slop… i think the cryptography/cybersecurity community needs to get on board with the idea of using AI to help in reviewing such code. am i wrong? is the future of cryptography is still people performing manual review of the breathtaking volumes of AI code?
#programming
threaded - newest
I can and I will.
AI-slop is easy to generate, but there needs to be a recognition that at some point ai-generated code is no longer slop. the failure to recognise that is the issue that seems to have got me banned.
Even if that were true (and in some rare cases it probably is) the machine is trained on stolen data, ignoring all licensing or companies selling people’s contributions without their approval - and that’s just the tip of the iceberg.
To call it slop is a great way to discredit it and to not support an unethical business/technology.
to call it slop just undermines the time and effort i put into the project. its not just code, i put efforts towards testing and documentation. but sure… if you want to believe you’re poking holes on big-tech’s practices here.
Why is your App cryptography-heavy if it’s a messanger? Don’t you just have to call msg.encrypt() or similar and then the library handles the rest?
github.com/positive-intentions/signal-protocol
that there is just the tip-of-the-iceberg in how im dealing with the cryptography.
reddit.com/…/security_audit_feedback_from_radical…
i cant get a proper audit, so i use these communities to share my ideas to determine any details im overlooking.
There are some interesting aspects to asynchronous encrypted messengers.
youtu.be/9sO2qdTci-s
Not that I would trust some random strangers slop over established projects like signal.
completely understandable and so the proactive attempt to get a professional security audit so i can avoid asking to “trust me”.
its completely understandable that you want to use something established. i cant offer more than open source and transparency in the implementation. if “trust” is behind the “paywall” of a security audit, its simply not an option without support.
i used AI to generate an audit. it took several days of my time and effort to get it to where it is. i made a genuine attempt to be objective.
in SWE we already have things in place for this like unit tests. if we dive further into cryptography we have things like formal proofs and verification.
formal verification has tooling to help make sure things work and behave how it should. (without AI) it can take a look at the code and create abstractions that can be used for verification. if we question if AI can be used with such tooling, we start discussing if the tooling we use is good enough (its pretty widely used!).
if the conversation cant move past that i used AI, then we’re not really having a discussion.
In my opinion, slop is slop. AI tends to result in slop, but it doesn't have to. But to ensure it's not slop, one has to put in effort and time. Which kind of defeats the purpose of using AI in the first place. So I think it's obvious why most people default to AI involvement = slop.
thats the part that seems disconnected from reality. im sure there are still people cranking out code manually, but lets be real; it isnt normal anymore.
in cybersec, there is scrutiny than most against the use of AI… i simply cant believe that the folks at Whatsapp, Signal or simpleX are not using AI in their daily workflow.
Was the AI you’re using trained like most; scrapping the internet and disregarding the licenses of code?
i used opencode (various models), cursor (claude, composer)
how these models are trained is arguably not ethical. the disregard of licences of code is not something i can influence.
I don’t think everything is getting called ai slop, but I would say if any part of your project is ai slop (like your “lazy uis") I’d also immediately lose trust in the entirety of the project, especially if it’s intended to be around security. I do think most projects that use AI for code generation are slop though, I’ve seen far fewer examples of good use (i.e. where the output looks human written because the operator reviewed and refactored every part of it, or where it was used to write small parts of functions rather than entire functionalities)
Your last sentence I think provides a great argument for why people here (and more and more broadly in engineering) hate on ai generated code in general. It produces such vast quantities of code (and often unnecessarily) that it becomes infeasible for a human to review it, immediately requiring us to place trust in the machine to both generate it and review it, and to continue maintaining it while the human operator probably does not even have full understanding of what’s changing. A machine, that we all know hallucinates and generates often low quality garbage, including severe security vulnerabilities by design. According to GitHub, your project has millions of lines of changes on a weekly basis in the earlier days, that does scream slop to me.
Last, AI is more and more hated due to the increasing number of horrible impacts it has on our world, personally I’d not support AI generated projects just on that principle alone.
in the recent post that got me banned it was a copy of this post here:
reddit.com/…/browserbased_file_encryption_no_inst…
i make a point in all my posts to be clear with the caveats. im not promoting this to replace anything. details to find out more is there along with advice to not use it for sensitive data.
for me messaging app, the caveats are similarly mentioned: positive-intentions.com/…/p2p-messaging-technical…
my projects are reasearch and development projects which i make sure to make clear when i post about them. im fairly consistent with advice around cautious use… knowing full well that it will deter people. im proactively seeking critisism in order to improve it.
bingo!.. youre framing as a negative understandable, but unless im mistaken, that the way its going to have to go. software development broadly speaking (for better or worse) is going to be AI generated. the tooling and methodologies have to keep up.
thats pretty vague, im sure it does some good too. AI is a tool. its easy to talk about how AI is impacting people badly. personally ive been unemployed for the past few months. its a horrible experience to go through countless interview thinking i aced it, but still come up with a rejection because the field has become so competative. but i dont blame AI on that. its a tool that i need to be learn how to use. perhaps others use it better than me.
I don’t know the context around you getting banned, unless there’s some specific rules you violated. I am not in support of that, but it’s also not the focus of my message.
I disagree with development having to go that way. If anything, the hatred towards ai is a sign that it’s actively not sought after, or at least not with LLMs. If they managed to develop actual AI that is on par with senior engineers, maybe? But we don’t have that. What we have is faulty and inherently flawed. Why would we have to push ahead forcefully with it..?
I didn’t include a list of why ai is harmful as the post was already long, but displacing workers is just 1 point.
I’m sure there are even more.
Not all of these are the fault of the technology, but I’m more than happy to throw the entire technology and everything around it under the bus if it means it makes it easier for people to unite against these companies - which I think it does.
Saying “it’s a tool and provides value” is like saying “force feeding chickens in a tiny cage” is a tool that provides value. True? Yes. Valid? No.
Cryptography is notoriously easy to get wrong. If you don’t know enough about it - you should not offload it to the hallucination machine, because you will not be able to verify it properly, and those who can - will not bother to.
This is not what a real audit looks like and it should not be presented as such. This “audit” is, in fact, slop.
Do you not see the problem in this line?
Or this?
perfect. you get it. you understand that generating an AI audit is wild!
reddit.com/…/security_audit_feedback_from_radical…
the AI audit comes after a long time of to-and-fro from the various communities that asked for an audit… of course they asked for a professional one… but those that ask, must know that they are all prohibitively expensive. especially for a solo vibecoding dev like myself.
i also understand that people would prefer a project with a team of experts… sorry to break it to you, a team of experts are not going to hire themselves on an unfunded project like this.
while the security audit, unit test, formal proofs and verification are not good enough when its done with AI, my hope was that it could serve as a starting point for anyone like ROS to perform an actual review. i cant offer more transparancy that open source, documented and discussions.
then… vibe-code something else?.. why do you think that you should be making something you are not an expert in, that can potentially put your users into danger and make you liable for it? if it’s a learning project - great, go wild. but if it’s intended to be used, then sorry - this is just an irresponsible approach that should not be entertained by anyone. I get that you have “positive intentions” but pick some other venue that you can get right. or contribute to an existing project (being mindful of contribution guidelines).
i vibecode a lot of things. my project is not inherently dangerous. people can use any software irresponsible. in my project and all my communications about it, i make it clear to users to use it cautiously and that its presented for testing and demo purpose. its mentioned in all of my post and i also have terms and condition within my projects the explain as much.
nobody is being tricked into sharing sensitive information… in fact i made a proactive attempt to create something that doesnt need any personal information.
dont tell me what i should and shouldnt be coding. i put time and effort into testing and verifying. this is the issue about mentioning AI is that it undermines all other efforts. its the low-hanging-fruit of critisism.
You might be expecting too much nuance from online communities. It’s easy and fun to oversimplify and dunk on a perceived common enemy. Lemmy has a very AI critical community. I imagine on reddit you might get less backlash, at least depending on the community. You might also find more AI friendly places here. In any case, trying to fight against a community bias is often a fools errand. I’m sure your code isn’t slop, but I don’t think you’ll be able to change the minds of random, biased people on the internet with no incentive to really listen to you anyways.
I’m sure you already know all the reasons why people are against AI and are sick of having to defend yourself. Still, I want to add that even if you use AI as a tool instead of vibe-coding, as a consumer I wouldn’t trust any privacy/security critical software that’s developed with the use of AI. As a layman I can’t check how secure your software is, so I have to rely on simple signifiers to make my judgements. At this point in time, AI is a red flag for me for security reasons alone. I know it’s not “fair” or “accurate”, but I don’t have the time and knowledge to individually check every software to that extend. I know allegedly every programmer now uses AI in some form to code (I personally don’t and most people I know don’t either, but I’m sure it’s just my bubble), but it’s not a sign of quality code in my mind.
Another thing I want to add is that your hammer comparison should probably include how the hammer was produced and how much resources your hammer consumes to function. There is a strong ethical argument against the use of AI for most use cases. I’d include coding and code reviews. Again, that doesn’t make your code slop, but it might help you understand why so many people are ready to dismiss it as that.
It’s a broad topic. Everytime I see some new AI-coded project linked in the selfhosted community, it’s kinda shit… I had hallucinated installation instructions. Very overexagerrated claims of what it’s supposed to do… Sometimes it looks okay but some buttons don’t do anything and then I look at the code and everything is more of a stub. Some projects have ridiculous security issues like someone finds a master key buried in the code, and of course none of the “developers” ever noticed because noone ever had a look at the code…
You’re somewhere in the same territory. Maybe you’re the one who gets it applied properly. But once I’m going to notice the tell-tale signs of vibe-coding, I’m going to start looking at it with the prejudice that got shaped by my prior experience. And I tend to be right most of the times.
But with that said, I don’t think it’s healthy to have a war over it, ban people and yell at each other. Most I want is transparency. I think all software projects should just disclose if and how they use AI, to what extent. And the users can make up their mind.
And with cryptography code… Isn’t that a bit dangerous? From my own experience, AI models tend to learn a lot of example code and the standard documentation of libraries… Wikipedia articles and such… And then generate responses closer to that, than completely new thoughts… But(!) all these examples, tutorials and boilerplate code use a lot of shortcuts to explain it in simpler terms. Shortcuts that weaken security. And I wouldn’t be surprised if your AI is then going ahead to reproduce that, and casually forget about the steps to prepare the numbers and follow up on the next steps if that wasn’t ever in the Wikipedia example code. And I’ve seen a lot of wrong advice on StackOverflow and Reddit, so you better hope it also didn’t internalize that. There’s some fairly common myths about security or cryptography details out there. And I never know if your average Claude learned more from Reddit discussions, or from computer science technical literature… And you probably used Claude to skip reading the computer science books as well (and have a really close look at the code), or you probably would have just typed it down yourself. So I’d expect your software to be roughly as sound as newbie code, up to the average of projects that’s out there on GitHub, which your AI has probably learned from. Not any better than that.
i agree with all youre saying. especially this which is why i entertain the idea of open source at all. what does transparency look like to you? code? documentation? open discussion? transparency is undermined when im trying to talk about something clearly complicated in order to seek feedback.
in software dev we have thing like unit test (you already know that)… but when diving into cryptography we have formals proofs and verification we can use. it doesnt need AI to extract abstraction from the code implementation to run verification on. the tooking there is common practice and if we question if AI is doing it ptoperly we bring into question if the tooling used is good enough.
individually, they are all easily AI slop. but combined i hope it can serve as a starting point for a proper review. i dont mean a proper review from you either… im was seeking a review from orgs that specialise in such review.
reddit.com/…/security_audit_feedback_from_radical…
you make a lot of assumptions about how i code and what i understand about my project. enumerating what ive done and plan to do wouldnt do it any justice… but i will say this project is the result of a long-term effort. i created the project without AI originally. the idea is unique around client-managed cryptography (github.com/positive-intentions/chat)… ultimately it was clear that open-source is dead and so ive started introducing less transparency in the project as i introduce a close-source UI. i still keep the cryptography related modules open for transparency (whatever thats worth when people see that AI was involved).
i wouldnt put my project out there if i didnt have faith in the implementation. i have actively seeked feedback and recieved good advice from which i iterated and improved. particularly concerning if im being banned from from communities for posting slop.
So many critical bugs and security holes have been made from an oversight of the people handling the code.
Now you want to tell me that instead of having people write code that tries to make sense, and then review it (sometimes a bit too late), you want to have an hallucination machine produce some code randomly, then have people “fix” it, then review it?
This is just a recipe for disaster.
AIs are not “AIs”, they’re just bullshit generators that everyone is falling for. Technical debt and lack of code reliability were the main problems of software dev, and AIs are sacrificing those two specifically, just in exchange for the illusion of speed.
If you train monkeys to pile up bricks, it doesn’t make a house, it makes a disaster waiting to happen. And monkeys, unlike AIs, are actually intelligent and sentient, which would make them more reliable still.
Yes we can. Watch me