> The truth that may be shocking to some is that open source contributions submitted by users do not really save me time either, because I also feel I have to do a rigorous review of them.
This truly is shocking. If you are reviewing every single line of every package you intend to use how do you ever write any code?
You do not need to review every line of every package you use, just the subset of the interface you import/link and use. You have to review every line of code you commit into your project. I think attempting to equate the two is dishonest dissembling.
To me, the point the friend is making is, just like you said, that you don't need to review every line of code in a package, just the interface.
The author misses the point that there truly is code that you trust without seeing it.
At the moment AI code isn't as trustworthy as a well tested package but that isn't intrinsic to the technology, just a byproduct of the current state.
As AI code becomes more reliable, it will likely become the case that you only need to read the subset of the interface you import/link and use.