惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

H
Help Net Security
T
ThreatConnect
SecWiki News
SecWiki News
F
Future of Privacy Forum
AWS News Blog
AWS News Blog
C
Cisco Blogs
A
Arctic Wolf
Vercel News
Vercel News
The GitHub Blog
The GitHub Blog
Scott Helme
Scott Helme
V
V2EX
博客园 - 叶小钗
阮一峰的网络日志
阮一峰的网络日志
K
Kaspersky official blog
G
Google Developers Blog
freeCodeCamp Programming Tutorials: Python, JavaScript, Git & More
P
Privacy International News Feed
C
Cyber Attacks, Cyber Crime and Cyber Security
N
News | PayPal Newsroom
Schneier on Security
Schneier on Security
NISL@THU
NISL@THU
Microsoft Azure Blog
Microsoft Azure Blog
量子位
The Hacker News
The Hacker News
Stack Overflow Blog
Stack Overflow Blog
Security Latest
Security Latest
M
Microsoft Research Blog - Microsoft Research
Google Online Security Blog
Google Online Security Blog
博客园_首页
C
CXSECURITY Database RSS Feed - CXSecurity.com
I
InfoQ
Google DeepMind News
Google DeepMind News
Y
Y Combinator Blog
The Cloudflare Blog
Microsoft Security Blog
Microsoft Security Blog
Martin Fowler
Martin Fowler
Cisco Talos Blog
Cisco Talos Blog
钛媒体:引领未来商业与生活新知
钛媒体:引领未来商业与生活新知
T
Troy Hunt's Blog
F
Fox-IT International blog
S
Security @ Cisco Blogs
博客园 - 司徒正美
cs.CV updates on arXiv.org
cs.CV updates on arXiv.org
C
Comments on: Blog
Threat Intelligence Blog | Flashpoint
Threat Intelligence Blog | Flashpoint
L
LINUX DO - 最新话题
GbyAI
GbyAI
Project Zero
Project Zero
腾讯CDC
T
Tailwind CSS Blog

Lobsters

Announcing BABLR Splitting Konsole views from Helix to run tools | AksDev GitHub - yugr/rust-slides Serving files over HTTP three ways: synchronous, epoll, and io_uring The User Is Visibly Frustrated uv must be installed to build a standalone Python distribution Encyclical Letter of His Holiness Leo XIV Magnifica Humanitas (15 May 2026) Using AI to write better code more slowly The Open/Closed Problem in AI A Simple Makefile Tutorial On C extensions, portability, and alternative compilers The social contract of writing Building a Host-Tuned GCC to Make GCC Compile Faster Switching to Colemak | Pedro Alves Fully in-browser container builds Nix's Substituter List Is Not a Routing Table What are you doing this week? Scoped Error in Rust Lambda on Lambda: Serverless Haskell on AWS | Blog Announcing feed-repeat v1.0 Scaling Akvorado BMP RIB with sharding EYG news: A host of CLI improvements, new guides and new effects The Eternal Sloptember JS Crossword C array types are weird; and related topics Flatpak will depend on systemd – OSnews Migrating from Go to Rust | corrode Rust Consulting Building Pi With Pi abyss * your_dotfiles_are_not_a_distro Vivado Licensing Options How my minimal, memory-safe Go rsync steers clear of vulnerabilities From AFSK to Goertzel the entropy layer of a wavelet codec, on its own 10,000 Lines Later: When a Tool Became a Compiler - Rob Durst - Gleam Gathering 2026 Debian SE Linux and PinTheft fht-compositor: A dynamic tiling Wayland compositor A Network Allow-List Won't Stop Exfiltration — André Graf Does bulk memmove speed up std::remove_if? (No.) What is Git made of? wake up! 16b 声明式部分更新 | Blog | Chrome for Developers Don't Roll Your Own ... Dianne Skoll's Web Site - Remind “Long-Term Support” doesn’t mean what you think The Architecture of Open Source Applications (Volume 1)Berkeley DB Pardon MIE? - ironPeak Blog seriot.ch It's time to talk about my writerdeck hershey Cuneiforth: A Forth for your Chifir z386: An Open-Source 80386 Built Around Original Microcode waylandcraft - Minecraft Mod On the <dl> HP QuickWeb, Singular And Pointless mvm - a fast virtual machine for Go That one time I used Go panics for flow control A new suite of modern tools coming for editing and publishing RFCs From the Tabletop… The Digital Antiquarian .NET (OK, C#) finally gets union types🎉: Exploring the .NET 11 preview - Part 2 Revised^7 Report on Scheme, Large: Procedural Fascicle Draft is now public The Soul of Maintaining a New Machine - Third Draft | Books in Progress
Human proof for FOSS contributions
dillo-browse · 2026-05-26 · via Lobsters
Written on 2026-05-25 by Rodrigo Arias Mallo

When receiving patches from first-time contributors it is sometimes hard to determine if the person has used an LLM to write the patch, looking at the code alone. We usually rely on the person's good behavior to tell the truth, as the patch mimics the same style as a person would have written, including comments and variable names.

In Dillo we only want to accept fully human created contributions, but relying on unknown people to tell the truth doesn't seem to be very conforting. So I would like to find a better mechanism to distinguish LLM patches from human-made.

I've been playing around with asciinema to record and replay some programming sessions in vim. If you have never heard of it, is a small CLI program that records the keystrokes and the terminal output to a file, so you can play it later and it will look exactly the same as originally recorder, including the colors or the time between keys. After a bit of experimentation, the idea came to my mind that it captures the human "essence" when writting a program. The many mistakes, the rabbit hole of finding a complicated bug, the typos and other syntax errors. So I'm considering it a candidate to provide a proof that a patch was written by a human.

Asciinema recordings as proof

The advantages of using a tool like asciinema are that the user only needs to start and stop the recording, so it has barely no additional cost. Additionally, the size of the recordings is fairly small after compressed with gzip or similar as the files contain only text. In contrast, recording the desktop requires significantly more effort, as you need to keep a heavy process running in the background and it would produce a larger file.

On the other hand, it also has some shortcomings. It won't work if the user is programming in a graphical editor like VScode or similar. Also, we would see a part of the programming effort that the user may not want to share with other people. For this case, my suggestion would be to send the recording by a private email, so that is only shared with the reviewers and is not publicly available.

Despite these shortcomings and assuming the user is using a terminal editor, I'm curious if this method would work.

Asymmetric complexity

In the same way that LLMs generate patches, they can also generate the asciinema recordings themselves. Then, the contributors can lie to the reviewers pretending to have made the edits. Perhaps surprisingly, this is not a easy task for LLMs, at least from my observations. The corpus of recordings of developers making mistakes and thinking the whole process of editing a file is not as large as the corpus of FOSS programs and patches in which to train an LLM. During my very simple tests I haven't been able to generate an asciinema session that remotely resembles what I would expect from a human, and even less so from a human with a nice editor theme and editing an existing Dillo source file.

Perhaps this method may work for a while, but LLMs may get an incentive to improve their capacity to mimic human behavior. But at least for now, it may be enough to protect our contributions from LLMs.

Closing remarks

I would like to test a bit more this theory, perhaps by running some experiments. In fact, the whole edit session for this page has been recorded in asciinema, which you can download here, decompress and replay with asciinema play --speed 16 proof.cast (adjust the speed as desired).

The ideal solution would be for us to trust that a contributor will not lie about their submission, but it is common from FOSS projects to receive one-off patches, so this method reduces the need to trust the user.

As a side benefit, looking at the way in which other people program is also a good mechanism to learn from others. This of course only if the person wants to share the recording publicly. A potential problem with sharing edit sessions is that LLM may use them to mimic how you program, so is a double-sided sword.