Post by @IngaLovinde@embracing.space

2026-04-03 08:48 UTC

@illogical_me @aredridel I'm not saying that you should not really review long time contributors code. I'm saying that regular _thorough_ review (and in my experience, what most people in corporate setting typically do is _way_ less than that) is nowhere near enough the kind of review that's needed to catch sophisticated adversaries. xz is a small project at least. But when you're working on a typical corporate project that has hundreds of lines changed per person per day, and not all people are good at reviewing even regular code: those who are good at reviews simply won't have enough time in the day to review all the code in "adversarial" mode with extra scrutiny.

Replies (2)

@illogical_me@mastodon.cloud 2026-04-03 09:07

@IngaLovinde @aredridel anyway my point was not that doing adversarial reviews is easy, but that doing them only to new contributors gives a false sense of security. The xz story proves that sophisticated attackers are aware of this and use it against the OSS community. Again, this is not an LLM problem. It’s just a difficult problem.

Open ##2002864
@illogical_me@mastodon.cloud 2026-04-03 09:02

@IngaLovinde @aredridel When people describe corporate environments, I’m often shocked. You’ve worked in nicer places than I have. If someone accepts a basic code review comment like ‘you copy pasted this instead of extending the function,’ rather than shopping for another reviewer, I call that a win. That may be why AI doesn’t upset me much: with moderate feedback, I get better results from it than I often did from humans.

Open ##2167960