Goodbye, and Thanks for All the Bikesheds!

The Wayback Machine - http://web.archive.org/web/20260718175423/https://queue.acm.org/detail.cfm?id=3818307

The Bike Shed

July 13, 2026Volume 24, issue 3

PDF

Please make my predictions come out wrong Poul-Henning Kamp Almost 20 years ago, my friend George (aka Kode Vicious) casually mentioned in an email that acmqueue was looking for articles about flash memory. Not thinking through the consequences, I asked, “How many words?” Careless questions cause homework, and thus started the “Bikeshed” column, if one can call something a column when it appears only about once per year. When I was a young man, I rapidly tired of old men who had no idea what I was talking about but were 100 percent certain that they had the infallible answer, and I promised myself I would never join their ranks. So, I will see myself out now. In this last Bikeshed in acmqueue, I will ponder the far future of free and open source software (FOSS), hoping to upset so many readers that my name will become an obvious addition to the “list of IT people who have predicted something utterly wrong and obviously silly about the distant future.” There are two hot envelopes in the FOSS inbox right now: LLM-assisted code reviews and age verification. The LLM-assisted code reviews are causing a lot of headlines because this comes out of one of those economic bubbles that seem to automatically inflate as soon as most people have forgotten how utterly stupid and predictable the previous bubble was. I’m not particularly worried about this. I have never felt particularly confident in myself as a programmer, so I have always applied all the “code-quality” tools I could lay my hands on, and the pattern has always been the same: — Day 1-2. Tried $tool out. Oh boy!

We have some work to do. — Day 3-5. OK, there were a couple of solid bugs there, and a fair number of what were technically bugs, but not actually all that bad. — Week 2. I guess that was it? This pattern first manifested when I read the Zilog Zeus reference manual from cover to cover in 1984 (while walking barefoot in the snow on the freeway, etc.) and read about lint(1). I saw the pattern most recently with Clang’s quite impressive static analysis facilities. Just on that repeated experience, I suspect we have already seen more than half of the “worst software bugs found with LLM-tools” list. Supporting that suspicion is that it would beggar belief that AI bros so desperate to blow hot air into their bubbles would not try to make as big a splash as possible, as soon as possible. (May I kindly suggest that they give their next LLM model the entire design and as-built documentation for a nuclear power plant? That is guaranteed to give them a lot of publicity and will maybe teach us something about the limits of human engineering complexity.) When I look at the nature of the bugs found by LLM tools, I see clear parallels to computers playing chess: The LLMs are able and willing to explore the tree both wider and deeper in detail than human brains evolved to economize energy and time, by probabilistically and heuristically searching for food, sex, and comfort only where the odds look most promising. That’s good. Cyberattacks and defense are by nature a chesslike game, and we also badly need better tools to write the programs that we will increasingly trust with our lives in the future. The only real question for me is: Are the LLM-code-review tools economically viable outside the bubble? All the work, and all the cost, comes up front, during “training” of the model. But the resulting artifact, the weights of the model—which you have to sell many million times over before you turn a profit—easily fits on contemporary pocket-sized storage devices.

This is not unlike a major film or video production where millions are spent on sets, actors, costumes, special effects, and marketing to create a 4K video stream that fits on pocket-sized storage devices, and profit is made in increments of fractions of a teenager’s allowance. Where [H/B]ollywood has somewhat successfully managed to wrap itself in a righteous cloak of copyright protections, the LLM industry may have trouble doing that, given how religiously they recite “fair use” in the many lawsuits where they are accused of infringement of copyrights. So, it is not obvious to me who will be training new iterations of these models once the current bubble explodes, in particular if the returns are diminishing the way I have experienced. In contrast to the LLMs, I think age verification is going to be a really big deal for the FOSS world. And, spoiler alert: I think we are at the beginning of the end for FOSS as we know it. Quick recap: In the beginning, nobody important cared about the early store-and-forward communication systems, and the open source phenomena that it begat. Then some money could be made on store-and-forward, and that funded further development, which gave us online digital communications—where the real money was. FOSS hitched along for the ride, and, because FOSS is nothing if not unselfishly helpful, that accelerated both the technological development and the moneymaking. When Edward Snowden revealed that Somebody Important had been taking an interest after all, the tech bros, who had grown up free of adult supervision, felt betrayed and started a campaign to encrypt everything and anything so that prying eyes could never again look them in the cards. And thus, we find ourselves in the present situation where it is trivial for any criminal to cover their online tracks well enough that only the most incompetent criminals and most economically consequential online crimes are prosecuted, while most digital crimes are not even reported to the police because everybody knows the police can’t do anything about them.

I can never remember if it was Sun Tzu or Clausewitz who cautioned not to back your enemy into a corner from which the only way out is over your own corpse, but that is precisely what the tech bros did to nation-states with encryption, and now the nation-states are making their way out of that corner. Right now, there is a LOT of shrill propaganda from the tech bros, who call themselves “privacy advocates,” about how mandatory age checking is the gateway drug to comprehensive identity checks on the entire Internet, and ridiculing the valid civic concerns governments are trying to address as merely “think of the children” strawman arguments. In comparison, tech sisters advocating for an absolute right to privacy seem to be a very rare, and maybe mythical, species. It may not quite be a law of nature, but my personal guess is that the opportunities for anonymity on the Internet will shrink until mothers no longer are forced to have “the talk” when their daughters get their first mobile phone. As the parent of a daughter, I am totally on board with that. And before you ask: Yes, I’m laying this one squarely down before (and partly on the toes of) the tech bros: We could have designed our protocols to be minimally compatible with “a nation of laws,” but the tech bros insisted that compromise was treason, and, as a result, we will lose more privacy than necessary. But how can age verification even work with FOSS? What’s to prevent the kids from changing the source code and recompiling once a fake mustache is no longer enough? Cryptographically attested software integrity is the only possible answer: Somebody will have to sign on the dotted line to verify that this operating system can be trusted, and nobody is going to do that if the user can change it and recompile it. The Internet is already fractioning into ever-smaller parts you can access with any browser, on any device, running any software you want. And a growing part of that can be accessed only from an “attested computing platform,” which you may or may not have the source code for but surely won’t be able to hack. That brings me to the biggest force of change to FOSS as we know it: accountability.

During the past couple of decades, rampant neoliberalism and “globalism” allowed the U.S. tech industry to capture almost the entire European IT market, including all “social media.” This has recently proved to be a ghastly mistake, and now the EU, along with its member states and companies, are scrambling to claw back their digital sovereignty. If the EU had grown its own tech-bro–infected online monopolies, that would be as easy as changing a few laws. And, in that situation, the EU wouldn’t have cared about FOSS any more than the EU cares about any other people’s hobbies. But there is no such thing as a European alternative to Google, Apple, Oracle, Microsoft, Facebook, or Twitter, and therefore you can hear European CIOs wander around at night muttering: — Is this an IT solution I see before me? — The source code toward my hand? — Come, let me clutch thee! But when, like Macbeth, they reach out, they grasp only the thin air, because there is no supplier to negotiate with, nobody to sign a contract with, and when they wake from their nightmare, they can still hear the voice of Groucho Marx mocking them: “The party of the first part shall be known in this contract as the party of the first part,” because almost everybody currently in a position of power grew up in a culture where “blame allocation” was comme il faut because it was seen as more profitable, and therefore obviously better to deflect blame to somebody else, rather than to solve the actual problem. It’s hard enough for them to pretend that blame allocation can work with “The buck stops here” problems such as digital sovereignty, but it clearly won’t work with FOSS because if there is one thing FOSS licenses all agree on, it is the “Don’t blame me” clause. So, a bit of a paradigm shift there, and they don’t know how to drive stick, because nobody ever got fired for buying Microsoft before.