Against This Book

illustration

A book that agrees only with itself is not worth believing, and this chapter is an attempt to argue seriously with my own theses. Most of the objections below I have heard from clever people, some I came up with myself at three in the morning, and none of them can I dismiss completely.

---

I will start with the most unpleasant one, because it strikes at the foundation of the whole book. I have repeated many times that in Reznik’s method all the cleverness of the construction lies in the selection, and that if the selection is good, what is good survives. But someone does the selecting, and that someone is often a person with a finite number of hours in the day.

Daniel Stenberg has led the curl project for almost thirty years; curl is a tiny program for transferring data over a network that runs, without exaggeration, on billions of devices. The project had a bug bounty programme, and until the beginning of 2025 roughly one report in six turned out to be genuine, which is normal for such a programme. Then people realised they could ask a language model to find a vulnerability in curl, paste the answer into a report, mark it as critical and wait for the money. The reports poured in one after another, each looked plausible, and checking each one took the maintainers hours, after which it turned out there was no vulnerability. In May 2025 Stenberg wrote that the limit had been reached and the project was effectively being subjected to a DDoS attack, and he began immediately banning everyone who sent such reports. And at the end of January 2026 curl closed its bug bounty altogether.

This is what I fear most. Generating variants is now almost free, while checking them is as expensive as ever, and if a person does the checking, cheap generation can simply bury him, as it buried the curl maintainers. Reznik’s method works as long as the selection keeps up with the generator. If it stops keeping up, the monkey turns from an author into noise.