Relevant XKCD:

Is this satire or is it from a real project O_O?

Completely vibe-coded project it seems, even documentation. And yet:

Human-Origin Source License

Also love this:

You may not, without prior written permission from the Author:

- ship or maintain a modified version outside the contribution-purpose
  rules;
- maintain a divergent private or internal fork;
- port, clone, rebrand, or recreate the Covered Software;
- create an API-compatible replacement, behavioral clone, competing
  implementation, or Derivative Implementation; or
- use AI-assisted implementation mining to create, improve, test,
  document, or validate a Derivative Implementation.

Look, I use AI too (mostly to speed things up by working on multiple items in parallel), but I'm not gonna stuff "human-origin source license" on anything I use it for, nor do I think creating API-compatible replacements, competing implementations, etc, should reasonably be possible to block with a license... Also, quite literally, he's creating tools for reverse engineering, which in itself is generally in breach of the license of whatever software is being reverse engineered. Fuck off and use a FOSS license, whether it be permissive or copyleft...

They saw curl | bash and were like you know what the problem with this is? It's deterministic

You may as well just completely replace your package manager with this one simple script.

#!/usr/bin/env python3
import sys

exec(TrustedAgent.request(f"Write a Python statement to install {sys.argv[1]}, make no mistakes"))

You may not, without prior written permission from the Author...create an API-compatible replacement, behavioral clone, competing implementation, or Derivative Implementation

Loooooooooooooool. "You're not allowed to reverse-engineer this reverse-engineering tool."

While I'm not a fan of most AI usages, this is the thing that infuriates me the most.

I like writing scripts to automate parts of my job. I've had a few for things like build performance testing comparison and the like.

All of it was replaced by skill.md, that does exactly the same, but burns like 3$ per run in tokens, and has also at least once generated hallucinated results, because it ran into an error, ran wrong builds, or in general fucked up in a way that was not easy to detect (and we did in fact not detect it until much later).

But hey, at least my colleagues now don't have to open the filthy commandline and write py perf-test.py main feature/branch to run the test, and can just talk about it to a clanker.

Vibestrapping

We can do even better: just post the readme+prompts used to design the software, and let the users AI agent recode it themselves! Perfectly secure.

If you trust the site, curl | sh is no worse than any other install method. If you don't trust the site, it's also no worse.

This is absolutely insane

I don't know what the first one is about. Is it about how the Gemini webpage displays the output?

What the actual fuck. Sorry, I won't have better words for quite a while now

Non-deterministic, heavily corporation-influenced software issuing root shell commands in a scenario easily foreseen by attackers who can just make spam pages to poison training data? I'll have two!

"How the fuck did Doom get installed onto my smoke alarm and not my D: drive? This is the last time I ask AI to help."