RE: https://hachyderm.io/@evacide/117412045251981085
I have now heard from several maintainers of open source projects who tell me that this is something they specifically asked for and/or that it is a big improvement on the status quo, so this hot take was wrong.
@evacide Admitting one was wrong is a largely forgotten art. Kudos.
@evacide I'm going to try to channel my inner Eva. It's okay to disagree with your previous self.
@evacide
I wouldn't mind betting that the projects in question end up regretting their choices on this one, I guess we'll find out..
Oct 11, 2026, 10:09 PM@evacide Good to know
@evacide
improvement in that they get scanned, or improvement in that it's opt-in only?
Oct 11, 2026, 10:15 PM
@joshg @jef based on my exp and conversations with open source maintainers, I think they're in favor of having access to these (fairly sophisticated) static analysis tools for free.
Because I guarantee people are using these tools to find bugs to exploit, rather than reporting them upstream, and the average open source tool doesn't have a budget to get $20/mo claude to do this themselves.
@evacide I'm anti-using products such as Claude to contribute to OSS code bases, but think it's okay and sometimes necessary to use these tools to find vulnerabilities.
Oct 11, 2026, 10:14 PM@evacide Respect.
@evacide Good for you.
@evacide I suspect that attempting to scan many OSS projects without developer cooperation would be a very visible disaster.
@evacide nice to hear - tbh the phrase "opt-in" and "AI" coexist far too infrequently.
@evacide knowing maintainers want this is a good signal. Anthropic gives a rosy picture in their article that most of the PR's provided _aren't_ slop by quoting Linus (a reputable opinion source). I'm also seeing that Google suspend their bug bounty program. I guess it's not a solved problem that these PR's are useful, and if it's bad enough to shut down a bug program, feels like it's leaning towards less useful. I don't experience it myself so hard to say.
It's a thoughtful person who can change their mind. Many kudos.
I find this horribly amusing, as someone who's been dogpiled for being an AI Slopper, that now, grudgingly, they admit a good reason has been found for AI.
@evacide Thanks for re-posting.
@evacide Conceptually "opt in" is a big improvement. It acknowledges the possibility of "not".
Oct 12, 2026, 4:02 AM@mgorny @evacide It's a ponzi scheme, they're always running out of money. Everything they do is a lie and this is a rounding error.
The whole "fear our dangerous kaiju, we all must slow down!" was making excuses for the fact they already slowed down. Oh no, they _meant_ not to complete all those data centers, it's not unrealistic promises coming due it's prudence and caution. It's not that their stuff doesn't work, it works TOO WELL to ever actually deploy outside of closed door demos.
Oct 12, 2026, 4:34 AM@evacide This is good in general. The problem comes with automation and agentic scanning. And some reverse capabilities that can be inside the models... Meaning some root entity could tell to the model to "really improve" your code. But I guess this is always the problem with technology you don't make by yourself.
@evacide Respect.
@evacide
You don't need my approval. I'm not here to discuss the subject of your post.
I'd just like to say that in my book, openly admitting errors like this gives a major boost to credibility.
I hope others see it the same way 😃
@evacide not actually wrong. it totally adds a lot of work to teams that accept it. they even acknowledge it in the FAQ.
"This service is built for projects that are already able to keep up with verified high/critical vulnerability reports and are now looking to further secure their code.“
In fact. its teams that are able to deal with the verified, and unverified but thought because AI said so its verified, so can add more unverified.
or more generously, its access to a fuzzing tool for your researchers, not help for your triage or maintenance.
Oct 12, 2026, 1:50 PM@evacide Thank you for the update. Still, what I have heard about this (don't remember from which projects, but several) was rather a great annoyance because samples of the bug reports showed only false positives and issues barely exploitable if at all.
The overall vibe, to use that word, was that the incoming stream was so large and the signal to noise ratio so bad that it seemed neither feasible nor worthwhile to spend as much time as needed to work through that unfiltered mess.
Of course that is just hearsay.
@evacide it will all end in tears.