The open garbage

Recently, someone rebuilt a famous and expensive piece of software with an AI agent, and published it for free. Thousands of people installed it. It made a lot of noise, and kicked off a whole “Reverse-Engineer-Everything” trend. Almost no one read the source. The author had not written a line of it either. There was no one left to ask. More than five years ago, I wrote a blog post called Do you trust your FOSS?. The idea was simple, and I still stand by it: a free licence does not mean someone checked the code. To trust a piece of software, you have to trust the developer, read the source, then read the dependencies, then the dependencies of the dependencies… and then you still have to trust your compiler. I called it a chain of trust problem. Back then, the person on the other side of the chain was still a person. You could look at their history, their commits, their name. You could, at least in theory, decide to trust them. But, today, that person might be replaced. The…