alt Hacker News> This year is going to be different. PostgreSQL 19 most likely won’t be released until November… […] So, what happened? The short answer is that LLMs happened. […] There’s a huge amount of code, and that code contains a huge number of bugs. […] What’s different now is that it’s become vastly easier to find those bugs.
This seems…good?
That it might disrupt the project's "traditional" release cadence a bit doesn't seem terribly bad in light of the alternative, which is shipping another major update with bugs which have apparently haunted the codebase for some time.
Replies
> This seems…good?
You would think so but medicine has faced this paradox since the development of modern testing technology.
You would naively think more testing is always better. More sophisticated practitioners then talk about Type I vs Type II errors and the problem of false positives.
But even if you were able to come up with tests that had 100% accuracy, there are times when you don't want to run that test on someone. The key distinction is that people only ever die of one thing and having a tumor that doesn't kill them is often better than risking the surgery to remove the tumor.
Similarly, there are some bugs you don't want to find since the harm from the people it affects is smaller than the opportunity cost of fixing it. Ignorance of the bug is better than knowing about it and having to make an affirmative decision not to fix it.
This is great for the same reason open source software is great.
We want software that remains robust in the long term, so that even when people are able to inspect the source code, it's still solid, rather than hiding the source code and hoping people don't find holes everywhere.
I think it will be annoying in the short term, but the cleanup this causes will be a good thing in the long term (and of course LLMs can also help with fixing bugs, even without source code.)
Indeed, we did a whole release consisting only of an AI security scan of the codebase plus fixes.
Exactly. There's so much negativity, it sometimes borders Luddism.
"We found a bunch of ways to make our product safer and better. We need more time to ship a higher quality product."
PICKET SIGNS
This is good. This is how I would expect llms to affect a codebase. Nothing sucks more than having a coworker put out a code review but your codex immediately finds problems. Run llm/self reviews against your code before you have other humans review it. It is common courtesy.
Yes, exactly. The only question I have is whether the delay is attributable to high-quality bug reports or the burden of triaging low-quality ones. It's not completely clear which situation they're experiencing.
At work we have put a full halt on feature work because the number of security related tasks has become staggering and urgent.
We will hopefully get over this wave and be able to move forward with much more secure software, but it's crazy right now.