The without disclosure part tells everything you need to know here. If it’s such a benign and maybe even beneficial thing to do then why are you hiding it? What possible reason could you have not to label that? In an open source Community shouldn’t everything like that be known?
I wonder what’s the reason to make it optional? I think I’ve seen this approach with other projects as well. Isn’t transparency and accountability a good thing? Also, this kind of information helps immensely when reading pull requests or silly bug reports. And Debian acknowledge there might be licensing issues. So it might become some sort of liability to them once it taints everything and we can’t even tell?! So why? What’s the upside? Adorn oneself with borrowed plumes and not being forced to disclose the fact? Or too much bookkeeping?
I think it’s just the simple fact that there’s no way to enforce it
Which tells a lot about how good they are. Slop is slop because it’s bad, but a high quality PR isn’t
There are ways to enforce it. Yeah, you won’t be able to make everyone follow the rule, but it’s the same with any law and any public policy and they’re still valuable. You don’t make campaigns against DUI because you expect everyone to stop doing it, as that’s a nirvana fallacy.
Because the idea is to judge the code by its quality, not by who or what wrote it.
I think that’s a commendable effort. Usually I do it the same way. Just feels massively unfair to me towards human contributors. I’ve seen the AI pull requests and bugreports come in. And it’s very time consuming to deal with them. They’re long, convoluted, touch a lot of code… There’s frequently a good amount of “hallucinations” in them, because they’re sent in autonomously or by people who don’t know what they’re doing. There might be dozens of them in quick succession as with the larger projects. They eat up time and effort which is now missing to deal with human contributions or wishes. My own opinion is: Transparency would help a lot to prioritize stuff. I mean AI isn’t sentient, and as long as that holds true, I’d rather treat people with respect and the amount of attention they deserve… (In contrast to a level playing field between human and machine… Because the machines will easily beat us by sheer volume.)
True, but I think the kind of people who send those monster PRs either already have AIs cosign it or they aren’t reading the policy anyway. There have also been a number of studies that show LLMs usually ignore this kind of instruction.
Hmmh. Sure. People also deliberately instruct their agents not to reveal the fact. I can empathize with that, because there’s all these people out there yelling at you, and launching shit storms.
I believe the uptake in “co-authored by …” is due to some companies making it the default setting in their frameworks. It’s to some degree Microsoft being nice to us, not necessarily benevolence of the people sending in those PRs. Doesn’t really matter to me though. It’s enough to make me happy if that’s attached to some commit or PR. I don’t care how it got there, as long as it fits the purpose.
Edit: And thanks for your comment. I don’t think I agree. Nonetheless this might be the answer to my question.
There are so many levels of LLM involvement and once you make this distinction you actually have to devote some of your limited resources to define and enforce it. So I think it might not be strictly beneficial, but possibly also have downsides.
Where would you draw the line at which point it counts as LLM involvement? Having one run as some sort of spell/syntax checker? Doing some research (and being influenced by it) before hand coding something? Having it create a working prototype and then reimplementing it by hand? If you use code from somewhere else to solve a problem and ai use has not been disclosed for this code, do you automatically have to assume LLM usage was involved or is there plausible deniability?
I think in the end you’d have to use too many resources check it and debate where the line is drawn, when the real question is how you retain human knowledge and engagement within your community.
Just disclose how you used it.
Conversely… if it’s so benign, why should it have a label?
Not really worth discussing - it’s not benign, and it can be made purposefully not benign by a third party without notification or knowledge. A third party who has already demonstrated a penchant for world domination, both technologically and physically.
Code in general is proven not to be benign
Excuse you my code doesn’t even compile properly, so it can not be malign by definition.
I should hope that open source developers are exclusively using open source models that are trained on open source projects.
I mean, I would think, at least. It seems to me that most of the people in charge of big projects are usually FOSS purists.
That’s part of the reason why AI scrapers are breaking the small web. FOSS purists really have no significant defense against it aside from Anubis.
Real DoS protection comes from capacity, which costs serious dollars, especially in this day and age where botfarms can be hired by the hour for rather cheap and record-breaking attacks seem to happen like monthly.
The alternative is using a CDN, but there are none that align with FOSS ideals. And for CDNs to be really effective, you need them to break open TLS and handle the decrypted traffic, which raises privacy concerns on top.
But anyways…most license agreements would make it a requirement that if you’re using an open-source model, that it be properly attributed, right?
I should hope that open source developers are exclusively using open source models that are trained on open source projects.
Most developers who use these tools (even FLOSS developers) appear to be using the corporate owned models that were definitely trained on both proprietary source code and code that is incompatible with the GPL license. Some EU courts have also already judged that LLM code cannot be copyrighted, which also means it cannot be licensed as GPL.
Currently, all code generated with an LLM has a 3 to 10% chance of unknowingly plagiarizing the copyrighted code it was trained on, and any FLOSS project that uses it is making a huge gamble that their codebase won’t be scanned by corporations in the future looking for violations to sue about, shut down rival FLOSS projects, etc.
It would be Useful for doing a retrospective on whether AI is helpful or not
Eye contact is benign for most of us. We still give it a context warning in civilized circles. It costs us almost nothing, and lets people make an informed decision what you engage with.
Respect to Antoine. Having principles that are worth a damn is a rare trait amongst developers these days.
The world needs more people that act on principles and take a stance.
Weird that he didn’t care when Linus Torvalds adopted basically the same policy to the kernel that serves as the foundation of the main Debian distribution. I have an inkling that there is more going on at Debian, not LLM use alone.
didn’t he? have you checked?
the main thing is that it’s an upstream problem. the linux kernel is used in nuclear missiles. if you want to stay on that kernel you have to take what you are given. in your own organisation you can at least try to change things.
Nuclear missiles probably run vxworks or another rtos, not linux
FOSS nukes when?
the linux kernel is used in nuclear missiles
source:
Idk anything about this…but here is my Google results
Don’t think golden dome is actually implemented, though just some trump delusion…but apparently this Redhawk Linux is used in…
I don’t think so. I got no sources or anything, but I think most nuclear missile silos and their software predate the linux kernel. And since we don’t really build nuclear weapons anymore but stick with the ones we already have, I don’t think that the linux kernel is really used in these kinds of sites.
However, that’s me guessing - wouldn’t say that I’m even 50% confident.
He didn’t leave the Linux-based OS for Linus Torvalds himself stating a similar policy for the Linux kernel before Debian did.
Debian has a history of maintaining ancient kernels. But it’s hard to believe that he assumed Debian to just fork Linux…If he resigned only now, he didn’t resign before. What is there to check? That is common sense. Linus allowed LLM use and he was fine with Debian building on it. After all, all LLM use is literal fascism in his eyes.
if he commented on it, for one.
“AI scrapers break the web, to use this page you’ll need JavaScript enabled.”
The ironic…
@ProdigalFrog
> “Pretending to have a “neutral stance” when faced with fascism is not neutrality, it’s active collaboration.”Bars. I’m sure it wasn’t an easy decision, I hope Antoine gets to keep his peace undisturbed.
Fascism is when people can use AI.
So Open-Source and FOSS projects collectively decided that they want to jump on half-sunken ship in the middle of the ocean?
Amazing.
Is it a half sunken ship? I’ve been following AI in software for a while now, even though all signs point to failure and a crash, it just keeps going and people adopt it more.
Hot take: LLMs is the best thing has happened to open source movement:
- software copyright is defeated and basically eliminated in practice
- reverse engineering is so accessible that proprietary protocols cannot be hidden and can be reimplemented by AI agents as free software
- open weight LLMs are incredibly competitive and run on general hardware
- linux is de facto winner in all computing and rising in desktop and gaming niches
We’re literally in the golden age of free software
That would be cool and all, but people stopped reading their code. At work if I can not explain every line of my PR, it will get rejected. I use it as a powerful tool but a lot of people just output code and think their trash belongs in production.
@drmoose @Grandwolf319 Assuming you place zero value on quality, yeah this is great.
half-sunken ship
If you think the ship is ever sinking I’ve got bad news for you…
What’s Devuan’s position on this? They already forked after the SystemD switch. Here’s to hoping they also flip the bird to AI.
Doesn’t really matter because they still use the Linux kernel, which AFAIK allows LLM contributions.
I doubt Devuan will stop basing their distro on Debian. Or at least I hope they don’t. I specifically use Devuan because it’s basically just OG Debian.
My main issue is that the packages are really behind though. Even more so than Debian.
I wish there was a good in-between. Ubuntu was a good sweet spot, but I can’t stand how they keep forcing their technology on their users anymore.
Yeah it can be a bit annoying at times. I started out using Debian-based distros before systemd implementation, so Devuan with sysvinit just works for me. I’m not the sort of user who needs the latest updates on anything, so it’s mostly fine. I considered checking out Slackware since it also uses sysvinit, but it’s in a similar boat with updates and, frankly, I don’t want to deal with its package manager lol.
AFAIK they do not yet have an official stance on AI/LLM use within the project.
Not yet. I suppose it shouldn’t be long…
Surprising that it was even an option.
There were 8 options and Debian has ranked choice voting. This was actually around the middle of the spectrum of options, so with half voting most to least restrictive and the other vice versa, the middle of the road choice won.
and the death blow is when more like-minded developers do the same… there won’t be enough left that would vote to change policy to try to lure some back.
Didn’t we have the same outrage and series of rage-quitting when SystemD was introduced?
Difference is, Systemd wasn’t specifically being used to facilitate fascist governments surveiling their populace or contribute to global warming like LLMs are.
And here I was suspecting myself of looking for elitism for my thoughts of switching to some *BSD system
Yeah, I just heard the results of the vote yesterday (been traveling), so I plan on trying to replace Debian with NetBSD on my laptop as soon as I catch up post-vacation.
the distro you like is enshitifying so you’re switching to an OS with an even more permissive, business-friendly license, huh? why not find another GPL OS instead?
because I am not switching. another Linux project gives out some suspicious sounds, so I find myself thinking that moving to another OS altogether might turn out a good idea after all, besides the fun of learning something new
Is there another GPL OS instead? I am a fan of the GNU Hurd, but sadly I cannot run it on my hardware. The team of devs is really small, and it is amazing what they have done in all these years.
there is Gloire OS based on the Iron Clad kernel, partially formal proofed written mostly in Ada, their git repositories can be found in Codeberg, there is Genode OS which follows Qt style GPL with caveats, where one corporate entity sells commericial licenses, and holds full copyright through CLA
Are these usable on hardware, and daily drivable?
I don’t know, never tried them even in a vms myself
Looks like I better start learning OpenBSD ASAP. I really like my distro of choice, but if the distro it’s based off of is shooting itself in the foot, I have to switch over massive ethical concerns!
Second I find out I can put a second drive in my desktop, I plan on using it to learn to make something a lot less hostile to the actual people helping develop the OS. And OpenBSD sounds like a fun choice for now… at least until I find they have started betraying the actual people.
From what I understand, while OpenBSD is currently not accepting LLM contributions, they mostly made that choice out of legal copyright concerns, and seem like they would jump on the bandwagon when they consider it to be safer legally.
Then I hope now for it to never become legally safe to use LLM code. LLMs have poisoned literally everything pure and holy and I hate them for it!
NetBSD is also worth a look, especially with the MicroVM kernel stuff in 11. You can look at smolBSD to start playing with it immediately.
It’s a desktop, there should be sufficient space to fit more than one drive. You can also use external drives. I use three on my server.
If you’re worried about LLM generated code you better stop using computers altogether.
I’d rather spend my time using technology to spread the word that the creatures who use genAI can become human again through reeducation against genAI. Sounds much more productive.
Sure, just accept you will be using technology build with genAI.
Not much of an issue with that, I feel.
I can tell you for sure that the workers and the farmers did not own the pitchforks nor the materials for the guillotines with which they rebelled against their oppressors.
No, I am worried about idiots committing llm generated code straight into production without even bothering to review it
So you will check the development process or each project you use? Good luck with that.
So I will drop any project that goes nuts before they get a chance to fuck up my life or work
Return to monke. Literally.
Or maybe just get off the grid
Well what would the disclosure requirement improve? It’s unenforceable and it just gets in the way of evaluating the code based on quality. Every code should have high standards. Bad llm code is just as bad as bad human code.
If a project allows llm contributions then disclosing it will only make people wary of the wrong things. Putting a badge on it is not helpful anymore if it’s allowed. I have seen good llm code and bad human code.
Code is a liability. The only thing that balances it out is people who understand the code. The people are the asset.
If you contribute LLM-generated code but not your understanding, you’ve essentially taken out a loan in the maintainers’ names.
Building tech debt you never pay down is the way you kill open source projects.
Not only the contributor has to understand code. There have always been flyby contributers that just add their code and that’s it. So if a PR adds code that cannot be maintained by others it can’t be added. That is part of the review process. That is part of evaluating based on quality. It’s unimportant if a human or an llm wrote something unmaintainable.
Bad llm code is just as bad as bad human code.
Bad LLM code is worse than bad human code. LLMs sanitize out markers that humans use to catch and correct mistakes.
I have experienced both.
The Free Software Foundation of Europe recently published an article detailing why it’s legally quite important for developers to disclose and carefully catalog which code was created by LLMs.
https://fsfe.org/news/2026/news-20260825-01.html
Recommendations for AI usage in Free Software contributions
With these issues in mind, the recently published Recommendations When Using LLM-Backed Generative AI Systems for FOSS Contributions by the SFC outlines some of the legal difficulties for copyright and licensing that generative systems have created for software developers who wish to write, maintain, or contribute to Free Software projects.
Notably for the purposes of this article, the SFC recommends the full recording and disclosure of how and when an AI tool was used to assist in the creation of a contribution. As stated by the SFC:
“FOSS project leaders cannot make good decisions about LLM-gen-AI policy if they cannot survey which contributions were assisted, and how much they are assisted. Part of the contribution process should (at least) include a disclosure of what LLM-gen-AI system was used, its version (as these system change over time), and a brief description of how the system assisted the contributor. This information should be included in a machine-readable format in commit logs."
Indeed, such disclosure can be an important foundational step to allow for the accurate assessment of the copyrightability of code that has been assisted or generated by AI tools, in order to assess their licensability into Free Software. Open and clear disclosure is a helpful step for the Free Software community to maintain a healthy licensing ecosystem, which is currently threatened by the legal uncertainties that come with the advent of generative AI.
Additionally, it is worthwhile for developers to document in some capacity the extent of human work that they have done in their software projects, whether it be the writing of code, the selection and arrangement of components within the project, or the extent of human modification of machine generated content.
IANAL but from my naive perspective it might make more sense to not disclose this because no one can prove that something was written by AI if no one discloses it. That means for me that any claims that a certain part cannot be copyrighted are hard or even impossible to make.
FYI it’s wary. Weary means you’re tired. Wary is to beware of something.
What wrong things?
Well Debian has been a fun ride for the last 20 years or so… Wonder what’s next…
Great. So what distro should I be using now?
There’s this list of distros that actively reject AI/LLM contributions.
I’ve found that AntiX also rejects AI usage based on a conversation about it in their forum, but they are based on Debian, so…
There’s also this list with a few more not listed in the first.
I’m going to try to switch to NetBSD. The FreeBSD policy is not settled. The OpenBSD and Linux Kernel policies are permissive.
