← Back to feed

On May 30, 2026, someone opened a GitHub issue titled “Please Do Not Vibe Fuck Up This Software.” No bug report. No test case. A screenshot of a Mastodon post criticising the rsync project’s use of Claude. It accumulated 329 comments. One included drawings depicting violence against the maintainer.

The maintainer in question is Andrew Tridgell. He wrote rsync in 1996. He has 40 years of software engineering experience. He is also retired, by his own account would rather be sailing, and has been using AI tools to keep a critical piece of Unix infrastructure secure.

What Actually Shipped

rsync 3.4.3 contained regressions. Tridgell acknowledges this plainly: unusual but valid use cases broke. None of the affected cases were covered by the existing test suite or by the manual testing he ran. The release was intentionally weighted toward fixing a batch of CVEs, and that prioritisation left some edge cases exposed.

What also shipped: a complete Python rewrite of rsync’s test suite, previously a collection of shell scripts. Tridgell designed the structure himself. He used Claude, with cross-checks from Codex and Gemini, for the “grunt work” of the rewrite. He reviewed every part. He describes it clearly: he did not vibe-code a utility with 30 years of institutional trust. He designed first, used AI to execute, reviewed the output.

The Data Question

On Hacker News and Lobsters, a user asked the obvious question: is there actual evidence that bug rates increased after AI-assisted development began, or is this correlation manufactured from outrage?

A developer ran the analysis. The result, posted to GitHub Pages and landing on Hacker News’s front page: the regression count in 3.4.3 is elevated, but the confound is the CVE-driven security work, not the AI tooling. When a maintainer deliberately expands the attack surface of security fixes to catch more edge cases, regressions follow. The trigger was the flood of AI-generated security reports that started arriving last year — and Tridgell needed tools to keep up.

Multiple HN commenters noted the same thing. User zos_kia: “From a cursory look, it looks like a security fix in response to a CVE surfaced a coding error which has been present in the code since 2007. This is so banal that it’s actually hilarious to see people lose their shit over it.”

Tridgell’s Response

Tridgell posted a detailed reply on Medium titled “rsync and outrage.” Key passages:

On the AI-assisted test suite rewrite: “I did the design for that myself… I used AI tools to do the grunt work because they are good at that. I reviewed every part of it myself.”

On the regressions: “I quite deliberately tried to err on the side of fixing security issues for that release, and there were some valid (but unusual) use cases that got caught up in the changes.”

On the alternative: He ran openrsync — the fork people in the thread proposed as the “clean” alternative — against the new test suite. openrsync currently fails 85 of 98 tests. “I’m sure it won’t take you long to get it up to speed,” he wrote.

The Broader Pattern

This is not the first time AI-assisted commits to a critical open-source project have generated community backlash. It is among the few times the original author — not a new contributor, not a BDFL delegating to a junior — has been the person reaching for AI tooling. Tridgell’s defense carries a different weight than most: he has the context, the domain expertise, and three decades of maintainer track record to distinguish between AI-accelerated engineering and vibe-coding.

The regressions were real. The test suite improvement is also real. And the security work that created the pressure for both was triggered by the exact same AI wave that is now being blamed for the outcome.

Tridgell is deciding between a 3.4.4 point release to address the regressions and a larger 3.5.0 with structural security improvements that require the new test suite to be safe. “The large change set that is needed was a big motivation for the effort on the test suite rewrite,” he wrote. The anger may have generated the silver lining: several experienced security researchers found him through the controversy and are now contributing.

Key Numbers

• rsync 3.4.3 regressions: edge cases in unusual (but valid) configurations
• openrsync test results: 85 failures, 98 tests (Tridgell’s new suite)
• GitHub issue comments: 329
• CVEs being actively worked: undisclosed count, described as “a bunch”
• Tools used: Claude (primary), Codex (cross-check), Gemini (cross-check)