Erik McClure

For basically my entire software engineering career, I have argued that programmers should strive to write as little code as possible. I have long been a proponent of using type systems to eliminate as many classes of bugs as possible, and a side-effect of strong type systems is that it makes fuzzing and static analysis easier, which can further reduce bugs. I have a vivid memory of arguing with a web developer at a convention nearly a decade ago about this, who was annoyed whenever the compiler “got in their way” and shockingly admitted they didn’t even understand the point of type systems at all.

There is a certain kind of person who, instead of thinking about the best way to solve a problem, will simply Executive Function their way through it because they have infinite spoons. These kinds of people are often celebrated for their “productivity” despite their actual output being extremely questionable, especially in open-source, where convincing people to do work for free is extremely difficult. So, we ended up with open-source projects selecting for people who had lots of spoons but little judgement, and could ship an impressive number of features that had an equally impressive amount of security flaws, like whatever the GPG devs are doing.

I have noticed there are two key types of people:

1. Gosh, this software is stupid, why would you have to do this same thing 20 times *proceeds to do it 20 times*
2. Wow, do I really have to do this 20 times? Surely not. *finds out solution* ah, right that makes more sense

- Orchestructive

Some people keep asking why all the open-source projects are full of fascists, without realizing that the structural incentives of open-source virtually guarantee this result. Open-source has no way to pay anyone, so the currency in open-source is how productive you are. This worship of executive function has trapped open-source projects into deals with the devil, like how the entire Rust ecosystem is propped up by David Tolnay’s batshit insane metaprogramming macro system that reimplements the entire rust compiler’s internal syntax parsing outside the compiler. When they tried to do something about this, the attempt to replace the macro-based metaprogramming with something more sensible was sabotaged by David Tolnay, which he even indirectly admitted to in an extremely weird non-apology.

The reason this keeps happening is because open-source projects are competing for one extraordinarily scarce resource: a programmer’s spoons (time and energy). They are forced to compete because people only use software that fixes their problems. They don’t care how, only that it does. Thus, whoever ships something wins, no matter how shitty it is. In academia, you publish or perish - in open-source, you ship or sink. This pressure forces open-source projects to rely on anyone willing to help, and heavily incentivizes turning a blind eye to any questionable beliefs held by those people. This pressure is immense, and those who have not attempted to maintain an open-source project likely aren’t aware of just how bad it is.

Nazis, bullies, and sociopaths are extremely aware of this, which is why a catastrophic supply chain attack nearly succeeded by simply offering to help one overworked guy on a project nobody cared about that happened to be shipped with every copy of Linux. This will keep happening, forever, because people only care if you ship something, and people with infinite spoons can ship features and fix bugs faster than an engineer trying to avoid writing bugs in the first place. A nazi has a near infinite fountain of important but neglected random libraries that nobody is helping. Politely asking companies to contribute back is never going to work, because many of the projects with a nazi problem aren’t even commercial products, they’re completely free!

So, any prospective nazi simply needs to find a useful-but-neglected library, and start fixing bugs. The project, desperate for any kind of help, will overlook any red flags (if there even are any), and then the new contributor starts inviting their friends to help contribute too, and now the open-source project is a nazi bar. The structural incentives make it extremely hard to prevent this from happening, because you have to either catch the first nazi (which can be very difficult, and involves turning away much needed help), or after you find out, you have to evict a significant chunk of your most productive contributors all at once, which is very hard, and they might just fork the library and win over the userbase, because time and time again, users have shown they really only care if it works, not who makes it. Sometimes, even if a user does care, they don’t have a choice, because there is only one library that fixes their problem, and they’re too busy fixing a different problem to invest time in maintaining a fork.

AI is a way to get infinite spoons. It has basically no judgement, but also never gets tired, or bored, or distracted. It is a way to turn compute into executive function. If you attempt to use it without giving it very strict guidelines, this goes about as well as telling a JavaScript dev who doesn’t like type systems to write a kernel module in C. Unfortunately, open-source projects are so desperate for executive function that they have huge structural incentives to accept AI-enabled contributions, for the same reason they’ve been accepting contributions from nazis. Of course Debian is accepting AI contributions now, the whole ecosystem is being pushed in that direction. If they banned AI contributions, then the most productive people would just be ones secretly using AI and not telling anyone, because open-source cares about perceived productivity.

The clear and unavoidable result is simple: Open-source projects will either accept AI contributions and piss everyone off, or deny AI contributions and be dominated by people who lie about not using AI and then secretly use it anyway. I’m not saying AI usage is inevitable - I’m saying the structural incentives of open-source make it inevitable. In order to stop this from happening, you must restructure the incentives around open-source projects away from the raw spoon-count of contributors. In a way, AI helps with this, because now we actually have a baseline to compare a contribution against. If an infinite slop machine with no judgement could produce the same results as someone’s PR, even if they wrote it themselves, those contributors should not be celebrated more than contributors that help the project by saying no to bad design that avoid creating those problems in the first place.

The immensely frustrating part of this is that people keep insisting on having their cake and eating it too: they want nice things, but absolutely refuse to put into place structural incentives to make the nice things happen. They want high quality open-source software, but refuse to pay the huge team of software developers necessary to make it actually happen, then get mad because devs rightly refuse to spend their free time fixing garbage code that has to fight a bunch of other poorly maintained libraries and OS APIs just to exist. A Nazi, on the other hand, will be happy to deal with lots of dumb nonsense, either for the purpose of trying to take over the project, or because they are actively being supported by far-right interests.

Volunteer run projects often make very poor engineering decisions because they’re volunteers, and it does actually require some kind of monetary support to convince people to go through all the effort necessary to do actual good engineering, and build tests, and think about things that aren’t on the golden path, and deal with hardware edge-cases, and all that. Despite this, almost no open-source project can survive on individual donations (with only a few exceptions) and this has been the case for years. The ones that are self-sufficient almost always either accept corporate sponsorship, or are a corporation that sells something, and then people act surprised when NixOS gets sponsored by Anduril. What were you expecting? The structural incentives force any open-source project to essentially take any money it can possibly find that won’t cause an outright rebellion among its users! It would be great if more governments had something like nlnet that funded open-source directly, but that largely doesn’t exist outside the EU.

I’m so tired of everyone’s response to this being “well, people should just be willing to stand up for what they believe in and starve instead of accept dirty money!” Almost nobody actually does this, almost everyone will take the job at Evil Corp Inc. to avoid being homeless. Those that are willing to go to such extremes often refuse to engage with any power structure that might give them the ability to actually change anything. An alarming amount of so-called leftist thought seems designed to disempower progressives by convincing them that acquiring the power to change anything is evil, and given the current state of things, it appears to have been quite effective.

Someone I follow on mastodon, who wishes to remain anonymous, pointed at this video discussing capitalism in America. The video was about the general act of creation, but as they pointed out, it applies to open-source as well: “the solution is that we go back to creating stupid, imperfect, small programs and sites, slowly, at a reasonable pace, and meet people one at a time who find this stuff useful”. The incentives have to change. Stop trying to solve systemic issues by demanding everyone suddenly becomes more individually responsible for no reason. Give people an incentive to change their behavior. Push them in the right direction.