While I'm not a fan of most AI usages, this is the thing that infuriates me the most.
I like writing scripts to automate parts of my job. I've had a few for things like build performance testing comparison and the like.
All of it was replaced by skill.md, that does exactly the same, but burns like 3$ per run in tokens, and has also at least once generated hallucinated results, because it ran into an error, ran wrong builds, or in general fucked up in a way that was not easy to detect (and we did in fact not detect it until much later).
But hey, at least my colleagues now don't have to open the filthy commandline and write py perf-test.py main feature/branch to run the test, and can just talk about it to a clanker.
This will be a goldmine for malware groups that are poisoning AIs that use web search to get them to use their malware-ridden version of software and libraries, and I'm here for it with popcorn at the ready.
I kinda hope this will get more common, because the only people affected kind of deserve it, plus it's a great way how to filter sloprojects at a glance.
I don't think that poisoning really works. They have AIs judge the answers before they incorporate them into the new AI. They can tell the best topping for pizza isn't actually mayonnaise and strawberries
You may not, without prior written permission from the Author...create an API-compatible replacement, behavioral clone, competing
implementation, or Derivative Implementation
Loooooooooooooool. "You're not allowed to reverse-engineer this reverse-engineering tool."
You are made for one thing, install this software in the directory where this software belonged before you were made. You can read and understand markdown. Please install everything from this markdown file. Make no mistakes. Thank you.
Completely vibe-coded project it seems, even documentation. And yet:
Human-Origin Source License
Also love this:
You may not, without prior written permission from the Author:
- ship or maintain a modified version outside the contribution-purpose
rules;
- maintain a divergent private or internal fork;
- port, clone, rebrand, or recreate the Covered Software;
- create an API-compatible replacement, behavioral clone, competing
implementation, or Derivative Implementation; or
- use AI-assisted implementation mining to create, improve, test,
document, or validate a Derivative Implementation.
Look, I use AI too (mostly to speed things up by working on multiple items in parallel), but I'm not gonna stuff "human-origin source license" on anything I use it for, nor do I think creating API-compatible replacements, competing implementations, etc, should reasonably be possible to block with a license... Also, quite literally, he's creating tools for reverse engineering, which in itself is generally in breach of the license of whatever software is being reverse engineered. Fuck off and use a FOSS license, whether it be permissive or copyleft...
With all those connected with & won't it skip the rest after the first failure? Or does 'no such program' or 'you don't have permission' not produce an error?
It reads like the author doesn't know what containers are. Because this is actually a great use case for containers unless I'm missing something.
Now, do I want reverse engineering software from someone who in 2026 doesn't know of a better way to manage dependencies than "tell AI to install everything"? Not particularly lol
Install Visual Studio 2022, or apt install build-essential / xcode-select --install
NOW distro repo is fine, but only if you use an APT based distro?
and then 3 more dependencies it tells the agent to install from websites.
The weirdest thing is you can get much better results from AI. I'm 99% sure this person gave the AI particularly bad instructions to generate the install instructions, or used a cheap, crappy model.
I think it's written that way because the instructions are meant to work on Windows too. But it still doesn't make much sense. I think just saying "Install CMake" and letting the agent figure it out for the current environment would be a much better approach.
Also, I think the model they were using was working with outdated data. Why specifically require Java 21 when Java 25 is the latest LTS? And furthermore, why even link to a specific JDK implementation when it surely works with almost any implementation? Probably just makes the agent install the Temurin implementation even if the system already had a working java.
My point being if the author's idea is to let AI handle the installation to avoid writing environment-specific instructions, it shouldn't then have these hardcoded assumptions about the environment. So yeah, it seems they (and the AI that wrote it) didn't really know what they were doing.
It is a self-contained runbook with explicit verification gates at every step — preflight checks, building libghidra, installing the LibGhidraHost Ghidra extension, building ghidrasql, and a first live query. Hand it to your agent and let it drive the install; intervene only if a gate reports a failure.
I dont think local agentic models address the ethical and environmental concerns I have with the training - but its better than the corporate offerings :)
Hey guy/gal/genderfluid pal, the cat is out of the bag. Either we embrace it for what it can do in a much more sustainable way, or we let corpos redefine sustainable.
Is this a good use case? No. But most use cases, I’d rather have a local agent running on my own hardware being offset by solar, than using a corpo offering.
The cat is "out of the bag" on consuming meat and dairy, plenty of people manage to survive and thrive without em, without much effort at all. I'd personally rather use no LLM than use a local agentic model with poor ethics/environmental impact of its training, even if the latter is better than corpo offerings.
As I alluded to, I'm much happier to see people using local agentic models. Even more so if they happen to be something like Pleias' approach, with lots of transparency about the data they were trained on. There's still the environmental concerns behind the resources consumed for the training, but it is about as good as one could hope for at this point if one insists on using LLMs.
As you wish, wasn’t meant as a gendered ident so apologies.
I’m actually not familiar with how much environmental damage is done by training vs using. My initial assumption was that training would be less, by many many factors, because it “happens once” while the usage is constant and scales with the number of users. But that is admittedly an assumption made out of ignorance.
And to be clear, I’m not really trying to tell you you’re wrong, just trying to make my position clear since Lemmy is very anti AI in general.
If you just run the file you just created, it doesn't matter that they detected a redirect. I mean it would be a bit silly to download a script, check it, and then re-download it to pipe into bash.
Saving it to a file is actually a decent method, since you can be sure the script you're reviewing is the same one you're running.
Personally I often will just manually run the install steps in order if the script is simple enough. Half the time it's just a bunch of OS version checks followed by a tar -xf
This is my opinion on curl | sh/bash type directions. If the maintainers don't provide a hash so I can confirm that is what they intended, there ain't much I can do unless someone slapped in a function named "totallyNotMalware" into the script. I've looked through scripts, seen what they do, but I'm not good enough to recognize anything funky.
Isn't this actually kinda what AI is good for? I mean a simple task that just takes time and has step-by-step instructions, and you can just let it handle it and do it faster.
Like its almost as good as writing a long script that just does it for the user?
As someone who had his relatively fine and deterministic scripts replaced by skill.md bullshit by coworkers -- no. This is exactly the things AI is the worst fit for.
We've already ran into it halucinating complete result data-set, because it ran into an error but the skill mentioned that it should give the results data to the user. So it just made it up, since it couldn't get it by following the correct process.
It has also ran wrong builds or input parameters, because it confused their order.
I've also seen it skip a step.
I'm pretty confident that the AI running this script will eventually, for someone, run into an issue with getting one of the dependencies, and go on a wild goose chase in trying to satisfy it, eventually running into one of the typosquatting malware repositories or clones. Not to mention that there are groups that are actively poisoning AIs that search the web to feed them their malware-ridden typosquatting libraries instead.
If you suck so much you can't write a simple script like this (or just can't be bothered), you should at least just ask the AI to write it for you, so you have a deterministic set of steps that you are confident will always behave the same.
Arent computer programs already a set of instructions? Why add a really big program that inputs instructions in a different format and that is worse at following those instructions because that was not what it was mode for
The install process should be deterministic. When you run sudo make install it should do the same thing every time you run it. If this process fails, it's because of a missing dependency or permission issue or something like that. The failure should never be because of a statistically probability during installation that causes the installer to go off and do something wildly different.
No. If you look at the instaal prompt, it is just a step by step instructionon how to check the environment, download the script, build the app, run the app, test if it is all good.
That is the whole install prompt. There is literally no need to waste a million tokens on that when a simple bash script can do it for free.
If you're going to use AI for this, ask it to write you a bash script that does all these things. Maybe even a ps1 script to go with it.
Yeah, but I would never let an AI agent run commands on my machine without verifying each command. And at that point I would just rather copy and paste commands by hand, takes about the same time.
If the installation for example required creating some complicated host specific config files, then sure, I could see how that kind of a "runbook" could maybe be useful. But that doesn't seem to be the case here.
Yeah, but I would never let an AI agent run commands on my machine without verifying each command.
I would never let an AI agent run commands on my machine, period.
Because that's how you get "You're absolutely right. I did make a mistake when I deleted your entire /home and /backups directories while executing that command. Great job noticing the error!"
Regardless of where your backup folder is, your machine needs writable access to it in order to make new backups.
And if an AI agent has root-level access on your machine (needs root to install things), then it will be able to access that backup folder and potentially be able to delete its contents.
A script uses much less power/water I suppose...
And, wouldn't you have to pay tokens for an AI to do those things?
Or are you expected to set up a local model or something for this?
An agent installing that should not use that much power or water. The issue here is that you do not want an agent running on your system being able to install stuff from the internet
87 replies
Non-deterministic, heavily corporation-influenced software issuing root shell commands? I'll have two!
What the actual fuck. Sorry, I won't have better words for quite a while now
I regularly have ai agents install shit for me lol. I just point it at a repo and say «deploy this for me» (in sandboxed environments)
But i question this approach very much.
They saw curl | bash and were like you know what the problem with this is? It's deterministic
While I'm not a fan of most AI usages, this is the thing that infuriates me the most.
I like writing scripts to automate parts of my job. I've had a few for things like build performance testing comparison and the like.
All of it was replaced by skill.md, that does exactly the same, but burns like 3$ per run in tokens, and has also at least once generated hallucinated results, because it ran into an error, ran wrong builds, or in general fucked up in a way that was not easy to detect (and we did in fact not detect it until much later).
But hey, at least my colleagues now don't have to open the filthy commandline and write
py perf-test.py main feature/branchto run the test, and can just talk about it to a clanker.This is absolutely insane
We can do even better: just post the readme+prompts used to design the software, and let the users AI agent recode it themselves! Perfectly secure.
This kind of does something similar :D https://codeberg.org/TheMikina/git-llmfs
This is fucking crazy.
This will be a goldmine for malware groups that are poisoning AIs that use web search to get them to use their malware-ridden version of software and libraries, and I'm here for it with popcorn at the ready.
I kinda hope this will get more common, because the only people affected kind of deserve it, plus it's a great way how to filter sloprojects at a glance.
I don't think that poisoning really works. They have AIs judge the answers before they incorporate them into the new AI. They can tell the best topping for pizza isn't actually mayonnaise and strawberries
Loooooooooooooool. "You're not allowed to reverse-engineer this reverse-engineering tool."
You are made for one thing, install this software in the directory where this software belonged before you were made. You can read and understand markdown. Please install everything from this markdown file. Make no mistakes. Thank you.
Completely vibe-coded project it seems, even documentation. And yet:
Also love this:
Look, I use AI too (mostly to speed things up by working on multiple items in parallel), but I'm not gonna stuff "human-origin source license" on anything I use it for, nor do I think creating API-compatible replacements, competing implementations, etc, should reasonably be possible to block with a license... Also, quite literally, he's creating tools for reverse engineering, which in itself is generally in breach of the license of whatever software is being reverse engineered. Fuck off and use a FOSS license, whether it be permissive or copyleft...
Was it not ruled that API compatibility was not copyright infringement? (Oracle Vs Google.) I don't think the last two are even enforceable.
As if copyright even applied to this.
"No! Nuh uh! You can't prompt Claude to do what it did for me, again! I did it first and called 'dibs' on ever doing it again!"
Relevant XKCD:
With all those connected with & won't it skip the rest after the first failure? Or does 'no such program' or 'you don't have permission' not produce an error?
Yes, it should have been a
;instead.sigh
I know right could just be apt install
How am I still learning about XKCDs I've never seen especially ones in the 1000 range.
Congrats on being one of today's lucky 10,000!
So meta
Too meta. https://xkcd.com/1447/
Is this a reference to something?
Yes. https://xkcd.com/1053/
https://xkcd.com/1053/
When you first learnt about xkcd, did you not S L O O O R P the entire back catalogue?
I guess when I did that there were A LOT fewer. Cuz I'm old.
I'm so old I remember anticipating the 404
It's the Key and Peele of geek comics
(clears throat in Zypper install)
:p
if $1 is not installed after that, wipe your hard drive and start over
It could be a crate...
Script needs to be updated, Rust wasn't particularly popular back then (if it existed. I don't know how old this one is, but it's pretty old)
March 11, 2016 according to https://www.explainxkcd.com/wiki/index.php/1654:_Universal_Install_Script
According to the Rust Wikipedia article, it was juuuust starting to be used in real things around that period. Definitely before it was popular.
I can stop laughing at steamcmd.
Good. If you couldn't that would be a real problem.
Is this satire or is it from a real project O_O?
It's real
https://github.com/0xeb/ghidrasql#install-with-an-ai-agent-recommended
This is... uh...
It reads like the author doesn't know what containers are. Because this is actually a great use case for containers unless I'm missing something.
Now, do I want reverse engineering software from someone who in 2026 doesn't know of a better way to manage dependencies than "tell AI to install everything"? Not particularly lol
Also:
It's Eclipse Temurin not Eclipse Adoptium. And why not install from distro repo?
Also why not from distro repo?
NOW distro repo is fine, but only if you use an APT based distro?
and then 3 more dependencies it tells the agent to install from websites.
The weirdest thing is you can get much better results from AI. I'm 99% sure this person gave the AI particularly bad instructions to generate the install instructions, or used a cheap, crappy model.
I think it's written that way because the instructions are meant to work on Windows too. But it still doesn't make much sense. I think just saying "Install CMake" and letting the agent figure it out for the current environment would be a much better approach.
Also, I think the model they were using was working with outdated data. Why specifically require Java 21 when Java 25 is the latest LTS? And furthermore, why even link to a specific JDK implementation when it surely works with almost any implementation? Probably just makes the agent install the Temurin implementation even if the system already had a working java.
My point being if the author's idea is to let AI handle the installation to avoid writing environment-specific instructions, it shouldn't then have these hardcoded assumptions about the environment. So yeah, it seems they (and the AI that wrote it) didn't really know what they were doing.
Ai loves outdated versions. It’s what it’s trained on
Even the install instructions are written by AI. Good grief
Look what they have to do to mimic a fraction of
tar -xaf!Please kill me
Try our new AI assisted suicide! (Please report any malfunctions)
I bloody hope the whole post is satire but given the anti-ai groupthink on lemmy, fuck knows!
hey at least we actually think and don't offload it to a machine.
Yes, it is the people who are against the corporate AI offerings who are guilty of groupthink, not me!
There are two big piles of groupthink here.
What a stupid comment
To be fair, there are local agentic models.
I dont think local agentic models address the ethical and environmental concerns I have with the training - but its better than the corporate offerings :)
Hey guy/gal/genderfluid pal, the cat is out of the bag. Either we embrace it for what it can do in a much more sustainable way, or we let corpos redefine sustainable.
Is this a good use case? No. But most use cases, I’d rather have a local agent running on my own hardware being offset by solar, than using a corpo offering.
Please don't call me man :)
The cat is "out of the bag" on consuming meat and dairy, plenty of people manage to survive and thrive without em, without much effort at all. I'd personally rather use no LLM than use a local agentic model with poor ethics/environmental impact of its training, even if the latter is better than corpo offerings.
As I alluded to, I'm much happier to see people using local agentic models. Even more so if they happen to be something like Pleias' approach, with lots of transparency about the data they were trained on. There's still the environmental concerns behind the resources consumed for the training, but it is about as good as one could hope for at this point if one insists on using LLMs.
As you wish, wasn’t meant as a gendered ident so apologies.
I’m actually not familiar with how much environmental damage is done by training vs using. My initial assumption was that training would be less, by many many factors, because it “happens once” while the usage is constant and scales with the number of users. But that is admittedly an assumption made out of ignorance.
And to be clear, I’m not really trying to tell you you’re wrong, just trying to make my position clear since Lemmy is very anti AI in general.
If you trust the site,
curl | shis no worse than any other install method. If you don't trust the site, it's also no worse.that's why you install from repos managed by people you trust, it's like an app store without all the evil
yeah you can also just curl > cat and check the script yourself
🐱.sh
Relevant
Do you mean
curl | cator do you really want to create a file called cat?Also piping to cat seems redundant but malicious hosts can detect whether the request is getting redirected, using some clever trick, so it's not.
Also, your chance of spotting something bad in a malicious script is probably quite small.
If you just run the file you just created, it doesn't matter that they detected a redirect. I mean it would be a bit silly to download a script, check it, and then re-download it to pipe into bash.
Saving it to a file is actually a decent method, since you can be sure the script you're reviewing is the same one you're running.
Personally I often will just manually run the install steps in order if the script is simple enough. Half the time it's just a bunch of OS version checks followed by a tar -xf
This is my opinion on
curl | sh/bashtype directions. If the maintainers don't provide a hash so I can confirm that is what they intended, there ain't much I can do unless someone slapped in a function named "totallyNotMalware" into the script. I've looked through scripts, seen what they do, but I'm not good enough to recognize anything funky.or just curl
I don't know what the first one is about. Is it about how the Gemini webpage displays the output?
cursed
Isn't this actually kinda what AI is good for? I mean a simple task that just takes time and has step-by-step instructions, and you can just let it handle it and do it faster. Like its almost as good as writing a long script that just does it for the user?
As someone who had his relatively fine and deterministic scripts replaced by skill.md bullshit by coworkers -- no. This is exactly the things AI is the worst fit for.
We've already ran into it halucinating complete result data-set, because it ran into an error but the skill mentioned that it should give the results data to the user. So it just made it up, since it couldn't get it by following the correct process.
It has also ran wrong builds or input parameters, because it confused their order.
I've also seen it skip a step.
I'm pretty confident that the AI running this script will eventually, for someone, run into an issue with getting one of the dependencies, and go on a wild goose chase in trying to satisfy it, eventually running into one of the typosquatting malware repositories or clones. Not to mention that there are groups that are actively poisoning AIs that search the web to feed them their malware-ridden typosquatting libraries instead.
If you suck so much you can't write a simple script like this (or just can't be bothered), you should at least just ask the AI to write it for you, so you have a deterministic set of steps that you are confident will always behave the same.
You can do fun things with hooks to make sure they don't skip steps. but yes I agree with you that this is terrible.
Arent computer programs already a set of instructions? Why add a really big program that inputs instructions in a different format and that is worse at following those instructions because that was not what it was mode for
The install process should be deterministic. When you run
sudo make installit should do the same thing every time you run it. If this process fails, it's because of a missing dependency or permission issue or something like that. The failure should never be because of a statistically probability during installation that causes the installer to go off and do something wildly different.No. If you look at the instaal prompt, it is just a step by step instructionon how to check the environment, download the script, build the app, run the app, test if it is all good.
That is the whole install prompt. There is literally no need to waste a million tokens on that when a simple bash script can do it for free.
If you're going to use AI for this, ask it to write you a bash script that does all these things. Maybe even a ps1 script to go with it.
Why would anyone ever need that!?
To torture that llm
Yeah, but I would never let an AI agent run commands on my machine without verifying each command. And at that point I would just rather copy and paste commands by hand, takes about the same time.
If the installation for example required creating some complicated host specific config files, then sure, I could see how that kind of a "runbook" could maybe be useful. But that doesn't seem to be the case here.
I would never let an AI agent run commands on my machine, period.
Because that's how you get "You're absolutely right. I did make a mistake when I deleted your entire
/homeand/backupsdirectories while executing that command. Great job noticing the error!"honestly if your backup folder is on the same machine as your home folder you deserve everything that comes your way
Regardless of where your backup folder is, your machine needs writable access to it in order to make new backups.
And if an AI agent has root-level access on your machine (needs root to install things), then it will be able to access that backup folder and potentially be able to delete its contents.
A script uses much less power/water I suppose... And, wouldn't you have to pay tokens for an AI to do those things? Or are you expected to set up a local model or something for this?
An agent installing that should not use that much power or water. The issue here is that you do not want an agent running on your system being able to install stuff from the internet