Over on the AboutCode blog, lead
maintainer Philippe Ombredanne writes
about an agentic LLM system porting the ScanCode
Toolkit to Rust.  In the process, the LLM (or the people behind it)
infringed the ScanCode trademark, stripped copyright and license notices,
"and started an outreach campaign, without ever engaging the AboutCode
community".  Ironically, the toolkit is used to scan source code and binaries in
order to figure out licensing and copyright information; it also reports on
package
dependencies, vulnerabilities, and more.

This is worth repeating: A comprehensive test suite, decent documentation, and
curated datasets is what makes automated porting possible. It is also what makes
a codebase easier to replicate without understanding it.

The agent's initial approach, using an existing Rust license-detection library,
failed to match ScanCode's output quality. The agent then did what any
translator would do when a loose paraphrase fails: it copied the original more
closely. The final port reproduces ScanCode's core algorithms, code
organization, and data-driven architecture in Rust, not because the agent
understood them, but because it had enough training data and test feedback to
converge on equivalent code.

https://lwn.net/Articles/1075832/
--- SBBSecho 3.37-Linux
 * Origin: Palantir * palantirbbs.ddns.net * Pensacola, FL * (618:250/24)