No LLM Code in Dependencies
摘要
作者分享自己近一个月为 git-annex 清理 LLM 生成依赖所花约 100 小时工作，并指出这是唯一正面结果。文章列出多起具体问题：ram 包 0.21.0 因大块 LLM 代码变动被 0.21.1 回滚；yesod 的 LLM 生成提交信息达 1489 行、变更超 10000 行；Cabal 与 git 等包的 LLM 生成代码首次引入时间，以及其他依赖链。提供 NoLLMDependencies 构建标志（stack 专用），支持回退到旧版 ghc（9.6.6）、memory 等包以规避问题，但强调无法长期保证。结尾提醒 prompt LLM 代码的隐含风险，并指出作者正重新评估社区参与。
荐读理由
开发者已验证 Git-annex 能完全剔除含 LLM 生成代码的依赖，提供了真实的技术变化，让你以后构建或维护项目时优先评估依赖质量，避免引入不可控 AI 产出
原文
joey/ blog/ entry/ no LLM code in dependencies
I've spent about 100 hours of work over the past month to make sure git-annex can build without dependencies that contain LLM generated code. At least so far.
https://git-annex.branchable.com/no_llm_code/
Needing to review a program's whole dependency tree on an ongoing basis is apparently what programming has come to?
I've found some real stinkers. Large LLM generated changes being reverted in the next release without any explanation. An incoherent 1489 line commit message with 10,000 lines of changes to a 26,000 LOC code base. A LLM prompt to copy code from another project that seems to have only avoided being copyright infringement due to luck.
I now have additional information about the quality of dependencies which will surely influence future decisions. As far as I can see, that's the only positive benefit of this work.
I realize that I am probably trying to hold back the tide at this point. That appears to be why Software Freedom Conservancy punted, and I doubt that the FSF will do any better.
As these dominos fall, I am reconsidering my participation in these communities. But I continue my work and support my users.
It may seem easy to prompt a LLM with
Add fourmolu config and restyled
neat
format a module
And commit the result and call yourself a 10xer. But please consider the broader impact of your actions. (In the above case, that project lost my further collaboration on it.)
这条对你有帮助吗？