Hacker Newsnew | past | comments | ask | show | jobs | submit | _se's commentslogin

It can be correct and slop at the same time. The reporter could have reported it in a way that makes it clear a human reviewed and cared about the report.

Slop is a function of how the information is presented and how the tools are used. People don't care if you use LLMs if they don't tell you can use them, they care when you send them a bunch of bullshit with 5% of value buried inside it.

If you're reading something and you can tell an LLM wrote it, you should be upset. It means the author doesn't give a fuck.


No it can't. These aren't "Show HN" posts about new programs people have conjured with Claude. They're either vulnerabilities or they're not. There's no such thing as a "slop vulnerability". The people who exploit those vulnerabilities do not care how much earlier reporters "gave a fuck" about their report.

This is in the linked story: they're seeing increased numbers of duplicate findings, meaning, whatever valid bugs showboating LLM-enabled Good Samaritans are finding, quiet LLM-enabled attackers are also finding.

People doing software security are going to need to get over the LLM agent snootiness real quick. Everyone else can keep being snooty! But not here.


Everyone is free to be as snooty as they like. If a report is harder to read/understand/validate because the author just yolo'ed it with an LLM, that's on the report author, not on the maintainers.

It's not okay to foist work onto other people because you don't think LLM slop is a problem. It is absolutely a problem, and no amount of apologizing and pontificating is going to change that.

Grow up and own your work. Stop making excuses for other people. Help make the world better, not worse. It's obvious that LLMs can be useful for this purpose, so people should use them well and make the reports useful. Period.


Try to make this sentiment coherent. "It's not OK to foist work onto other people". Ok, sure, I won't. The vulnerability still exists. The maintainers just don't get to know about it. I do, I guess. But not them: telling them would "make the world worse".

> There's no such thing as a "slop vulnerability"

https://daniel.haxx.se/blog/2025/07/14/death-by-a-thousand-s...

See the list at the bottom of the post for examples.


Those aren't vulnerabilities. You're missing the point.

Nobody is saying there's no such thing as a slop report. Not only are there, but slop vulnerability reports as a time-consuming annoying phenomenon predate LLM chatbots by almost a decade. There's a whole cottage industry that deals with them.

Or did. Obsolete now.


Yes, it is very possible for someone to be smart and an idiot at the same time.

Do you think you're smart? Have you ever done something and said "man, I'm an idiot"? It's just like that.

Of course, the other explanation is that he's just grifting, which is also very possible.


"Smart" is something you do, not something you are. People with very large amounts of raw intelligence fall down some very dumb intellectual rabbit holes that its practically a meme: https://www.smbc-comics.com/comic/2012-03-21

Having raw intelligence doesn't help if you don't apply rigor to your thinking. I suspect that very successful people actually end up falling into habitual mental shortcuts that cause them to promote stupid things at a later time.


250k isn't a budget. It's the minimum that he said someone _should_ spend or else he would think they're doing something wrong.

It's an insane take. Completely bone-headed. Just obvious grift.


The people who don't care about LLM slop being shoved down their throat at every turn are the "weirdos" here. The project might not be slop, but the website certainly is, and it's perfectly reasonable for people to stop reading immediately and decide that they don't care about what could be an otherwise useful project when they determine that the author didn't give enough of a shit to even write the text on the website themselves.

But there is an old-school README.me at the github homepage: https://github.com/stanford-scs/jai The repository has an old-school ASCII INSTALL file.

If you don't like the vitepress site, just use github and read the human-written README and man page there. All the information you need to use the software is available without laying eyes on any AI slop. Of cource, if you hate AI so much that you can't get past a vibe-coded landing page, you might not be the target audience for jai, because you probably aren't doing a lot of vibe coding. But maybe jai is still useful to you for grading programming assignments or running installer scripts.


Usually it's because the kid won't wear headphones. Not really an excuse, but a lot of the time the kid is just going to do what they want. What the parents should do in that situation is make them watch without sound, but that's harder than the alternative, so they just do whatever.

Or the parent should just take the phone away! If the kid won't listen to it quietly then they should do that thing that I believe is called "parenting". Bring a picture book or something for them if they need to be entertained without the phone.

This was done by my parents when I was a young kid. I wouldn't turn the volume down on my Game Boy on a flight, so my parents took it away from me until I promised to keep the volume down, which I did after that.


I've been on a flight where a set of parents took away their child's tablet, not for being noisy but as punishment for some other bad behaviour. What resulted was 6 hours of a child screaming on an 8 hour flight. Aside from wanting to punt the little shit out the door, I was almost impressed at the kid not giving up after a few minutes, and then hours when nothing changed.

I still think that's less actively inconsiderate than Cocomelon at full volume. At some level they can't control the kid crying but they can control the volume which their kid's media runs at.

Really, REALLY make no mistakes!!!


Are you implying that someone who prefers Eclipse is more likely to be a good software engineer than someone who prefers Emacs? If so, that is so hilariously backwards that I can't even begin to understand the types of experiences that you must've had.

I am sure that you're objectively wrong if that is what you're saying.


I'm reading it as: those unwilling to try both and make an honest evaluation and instead have preconceived notions and bigotry tend to make bad programmers. That preferences are fine, but dogmatism should be avoided.


Nowadays most people try VSCode or JetBrains "by default" in school or at a first job. It's Emacs that's for explorers who actually try alternatives


I went to a James Gosling talk where he excoriated the Emacs users in his audience for clinging to outdated technology and not using a state-of-the-art IDE.

But the IDE he was hawking wasn't Eclipse. I think it was Sun Studio.


Way, way more than 10, but I agree with you that they are not taking even 1% of tech talent per year.


Typing code has never been the difficult part of quant finance.


alcohol tolerance, patience, and willingness to work 80 hours a week are probably more important.


Definitely the first two, but the latter is not particularly common at most firms. It's hard to put in the type of thought that you need when you're working that much. It's not slinging power points.

55-60 is much more common.


Just like most nonfiction books, this post is a lot longer than it has to be. I think the core idea here is good, but it's pretty ironic that I wanted to stop halfway through.

When writing is good, succinct, and to the point, people will finish reading if they're interested in the material. If it's too long, fluffy, repetitive, annoying... people won't. I don't think it's a huge surprise.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: