Securing AI-Generated Open Source Code

Robert Griesemer of Robert Griesemer Software said, quote, "There is a temptation to presume that someone else will be checking the code." Oh, yes, that is true.

[laughs] With Heartbleed, the postmortem found that while multiple major firms ship products using the software, all of them had economized by presuming that the peers were doing the work, and of course, paying the costs.

Checking machine-generated code is tedious, time-consuming, and thus expensive.

The problem will surface when something goes wrong, and there are consequences.

All right.

I think that very politely spells out the problem we've got here.

Peter Gregory, who is an author we've had on many times, said, quote, "Open source was crumbling prior to the widespread adoption of AI." I have to agree with that, too.

"The vision of open source was that there would be numerous parties examining code for defects, while few actually do." And Steve, I'm just gonna throw this out.

It sounded great, open source, but I just kept thinking, "Who's paying all these people to do this work?" I mean, it can't be just for the love of it alone.

Yes?

Well, open source is premised on collective defense, that there are a whole bunch of people that are willing to spend time outside of their day job, or organizations like Red Hat, that were based on that where they were providing the enterprise maintainability.

And when developers actually wrote 99% of the code, it was a slower process to develop.

It was out in open source much longer, and so therefore number of eyes times the length of time it's out there gave us a confidence in the code.

And that's when we talked about was the disruption that we're going through, is that the developers aren't writing the code, therefore they don't understand the code.

You're not necessarily getting better code.

You're just getting higher volume, and therefore you actually have less developers looking at the volume, and then you have citizen developers that can't look at the code that are being, in essence, promoted to writing code.

I go, that's the ecosystem that we are now starting to face, that we need to tease apart, so what now what?

It started off nicely, and then things started to expand to the point that we couldn't handle it.

Abby, do you think that open source had a sort of a happy beginning that just isn't there anymore?

Look, I could do a whole podcast just on open source.

I have a lot of thoughts.

I've spent a lot...

I've spent the last 15 years of my career in open source, so I have a lot of feelings about open source.

I think that open source is broadly misunderstood by people not in open source.

So I think we'll probably set aside my soapbox on open source broadly.