A good thing about the "you're the author regardless of the tool you used to produce the code" policy is that if a developer repeatedly submits poor quality AI generated code, one does not blame the model or the agent, one bans/terminates the developer.
To me, that touches on the central issue. I think most people support the “I don’t care about the tool, only the outcome “
But, we have long had a stable social system for collaboration, and in particular dealing with low quality contributions. Mostly (or at least ideally) it involves taking some time to look at the contribution and provide some feedback. The time invested is not worth it on a single exchange basis, but it’s a repeat game, so you are investing in the future.
LLMs, and people willing to just spam crap they don’t really understand blows that all up.
Nothing. And that's the problem -- the issue isn't "should a contributor be able to use AI" it's quickly becoming "is this entire contributor an AI agent". Every actual-human who gets a bad first experience hurts the project. The contributors having to be suspicious of new people hurts the project. The whole thing just sucks, and I don't know how to fix it.
I use claude-code, but the AI ecosystem and some of the autonomous tooling coming out of it -- which some people "helpfully" use irresponsibly and point at OSS projects they aren't personally invested in -- enables a LARGE amount of abusive behavior towards open source projects. This is even before we get into how many infrastructural resources crawlers eat up.
Me, and most other OSS contributors, signed up to be a mentor, to create software, to work together ... not to be the equivalent of a reddit moderator banning AI agents left and right.
ngl this is just gatekeeping. Tons of people can now create software for themselves and others who couldn’t do so before. I get it that some established projects have a way of doing things and don’t want to change and to some extent that is their prerogative, but casting moral judgement on the entire field of coding agents based on that is just icky.
Good. I want open source projects which serve infrastructure to be gate kept so that only responsible people are involved. Responsible people can use AI too. Get all of those people on board, and keep out irresponsible people!
Most people who wrote software before AI didn’t contribute to projects like Debian because it takes a certain passion and commitment. Just being able to write code is not the bar for entrance here.
This isn't talking about bespoke software, though. This is talking about upstreaming contributions to others. This puts a low barrier to create work and a lot more work for unpaid volunteers.
I can't speak for all, but many mature open source communities have explicit or ad-hoc reputation schemes that are used to triage contributions. A fresh account means starting over with zero reputation, which in turn means your contributions wait at the back of the line.
Are there examples of anyone discussing this and reaching other conclusions?
We've come to the same conclusion in our organization and while it felt like it needed to be discussed and stated, I've never heard of anyone coming to a different conclusion.
[EDIT: I was referring specifically to the idea that you have to stand by the code that you write. Is anyone deciding on a policy that says "the AI did it" is a valid excuse for breaking code?]
On the opposite side or the noteable spectrum, look up "Steve Yegge wants you to stop looking at your code." He said it in a video interview, though plenty of summaries online of exact wording and ideas. Though it's being argued that you could still be responsible for it without looking at it?
Extremes on both sides. I'd wager were moving in Yegge's direction though, like it or not.
> Though it's being argued that you could still be responsible for it without looking at it?
If you have a much test coverage as SQLite, I'd be tempted to trust it, and I think that's where we are headed. Someone still needs to define these guardrails though, so IMO the developers job is just mutating into something else, but is still necessary. Long term, who knows.
For me, it’s not a question of whether I like it, nor where we might move in the future, but purely what is proven currently. In my experience, as in my evals, any model, including notably Fable 5 and GPT-5.6 Sol can and indeed do produce code that does not consider many edge cases, can be hard to maintain (especially Sol though it’s output has become markedly better with recent changes to Codex) and sometimes introduce bugs with visibly apparent issues. Existing test coverage doesn’t necessarily prevent such issues when changes or additions are made.
Models also still can have major task adherence issues, so even a perfectly well scoped, well considered prompt that covers all situations and coverage can, in many scenarios lead to output users may not expect or notice without reading code. Seen it a lot, just lost some blood and tears to a very straight front end implementation task that I ended up applying manually cause both Sol and Fable struggle to copy a few dozen HTML/JS/CSS section properly into a slightly obscure and complex codebase…
We also see such issues in what labs deliver in their own software products. We are not at the stage where a human shouldn’t sign off on code that they have tested and understood. A hypothetical future, I don’t really care for, we’d notice when labs stop shipping easily apparent bugs, though even then, I’d still feel there is a while in between that and not needing to assess the output anymore.
There is, in my mind, no need for this “narrative shifting” that some want to accomplish. If models could provide code that didn’t necessitate review, there’d be no one needing to argue that case. If and when they can, we’ll know it, but not because of those espousing this currently.
That might be an interesting parallel. Maybe code becomes like legal documents. Binding but inscrutable, full of small mistakes and not really tailored for human ingestion.
As others have said there are other conclusions going both ways (though I do think most settle on as you said), though one very fair conclusion I came across is that it's not allowed because the whole issue of copyright is still somewhat unresolved, and though its fine right now, that could (probably wont, but could) massively backfire later.
The Asahi Linux project bans LLMs. Unfortunate as LLM reverse engineering and driver writing would bring Linux to more Mac models much faster.
The Zig project rejects LLM based contributions.
Some of these policies were introduced when LLMs were really bad at writing code and haven’t been revisited. Some groups don’t care about the quality and object on moral or copyright grounds.
Linus Torvalds regarding the Linux kernel is reasonably similar. He views AI/LLMs as just another tool in the development process. Think about life before and after modern IDEs that features IntelliSense circa 2000. It was night and day. It did not make programmers dumber -- it was a new tool.
Except LLMs actually are making programmers dumber. I personally know people, people whom I know for a fact were good programmers before, who have now completely stopped using their brains. When you ask them why they did something in the code, they say "I don't know, Claude did that and I didn't really question it". There was no such analogous phenomenon with IDEs.
I have had the same experience and feel pressured to adopt it. I had one former colleague say “you really have to stop looking at code” almost incredulous that I was uncertain about whether we should let models write really bad code and architecture that never would have been allowed in the before times. I will say when I let the agents go autonomous I often find I spend more time refactoring than if I had moved slower and forced them to write good code and follow project architecture patterns.
I use agents to build exactly what I want like I am pair programming with a jr engineer, and review every line of final output before I make a PR.
I would have zero tolerance if anyone that did anything less in my orgs. Owning and understanding the code you submit is the one job that matters most now.
It doesn't apply to everyone, but yes I know people who are over-reliant on LLMs and definitely getting dumber. With devs and non-devs too. I hate seeing this happen.
IDEs enable us to not bother memorizing the number and order of arguments, long names beyond the first word or two, etc. the impact is comparable, freeing some of the very limited space in our memory for more important things.
sure, students and juniors shoot themselves in the dick if they let LLMs do everything, but they're fucked anyway so it doesn't matter,
That's because you are used to it. I am old enough to have been there during the rise of things like intellisense and language servers, people were making the exact same arguments about them. That not knowing your API to the core makes you a bad programmer. I'm sure for IDEs themselves there were similar arguments and it goes all the way back to Socrates' warning against writing. These arguments always end with "but this time it's different". And inevitably each time it's not.
Number and order of arguments, long names, etc. are just bureaucracy. Knowing them doesn't mean you understand the codebase any better than if you rely on the IDE for it.
It's a bit like remembering the exact date an historical event happened vs. knowing at which point in history it did, what other events relate to it, etc. Neither makes you better or worse at knowing and understanding the history of the event.
You can just ask Claude why it did something in the code and it will tell you
Programmers just moved up a level , not dumber, we are now managers of a team of 'agent' programmers. The deliverable is now a functionality instead of a specific block of code
But will Claude give you an authentic rationale and a traceable, verifiable "line of reasoning" for those things? Or will it just construct the next plausible Markov chain built on whatever Reddit thread it ingested at random?
You can ask Claude or any LLM for citations, and it will RAG them out ex post facto. Those actually aren't citations, they're just web searches for related articles, and they don't necessarily support the assertions that you're asking to cite.
I am sure that Claude and the others can produce intermediate logs of their inference and "reasoning" process while they are processing stuff, but can they really go back within the context window and construct an authentic apologia for a specific thing when you ask for it?
You could also say the same with desktops. Desktops abstracted CLI commands like mv or ls. People who are taught on desktops will get scared when they see a terminal.
Yet programmers will still know commands.
Abstractions can make things easier but it doesn't require losing skills.
> Except LLMs actually are making programmers dumber.
Make that some/a lot, but not all.
There is a clear bifurcation. A lot of those that never cared really don't care now, but then you get others that can use it to crank that much harder than ever before.
If you put the same brain effort in but leverage LLMs you really can be dramatically more productive.
I'm a person who is over-reliant on LLMs, doesn't know how most of the things in the codebase work, and is atrophying both in programming and in general cognition.
I don't want to speak for them, but perhaps this is a very real consequence of the "use ai or get left behind" talking point. Maybe they were effectively scared into it, and now are too far gone. They seem like a very reasonable person if they're admitting to being over reliant on LLMs, so I don't mean this as an insult
They cared enough to do good work before, so I don't think that your explanation suffices here. From my observation (not just with their programming but in other interactions), it truly is that using an LLM has made these people less intelligent than they were before.
A friend of mine, really nice guy, is training as a lawyer at the moment. He has zero interest in law or justice, but heard that lawyers make a lot of money. Not too long about, programming went through a very similar phase. To be clear its not that I think programmers or lawyers shouldn't make good money, they absolutely should and it is deserved, its just it has the unfortunate side effect of attracting people who don't care about the field itself. For those people, they care as little as they can get away with and still be paid big money, and if LLM's allow them to do that at the cost of quality, they absolutely will.
I do think LLM's are making some genuine programmers less intelligent, but I think this type of person makes up a decent portion of its users too
There was an increasingly scary mass of people in the industry that viewed the coding as a sort of therapeutic exercise, and would become quite obsessive about it. For those people LLMs are anathema because they take away what was the rewarding part of the job.
If you care primarily about the quality of the end result, as opposed to being attached to a particular process of achieving it, then you're happy about how things have gone.
You find it scary that people enjoy what they do? Simply caring about the end result is often not wise, ethical, or sustainable, and the quality thereof is dubious in any case, especially when you consider that the end result of developing software is never just the artifact.
Treating coding as the therapeutic reward for other things (typically tolerating bureaucracy) and then indulging obsessions about it absolutely is unhealthy.
And I've seen exactly this across multiple large and small organizations in multiple countries, in addition to being all over here and the red site.
People who simply enjoy coding (without treating it to be "therapeutic") are still unhappy because working with LLMs is just not the same, and not rewarding in the same way
I just means I'm gonna be filthy rich in a couple of years when most programmers have lost their proficiency and me never having used Claude or any other A.I. slop tool.
I think this is reasonable but I wonder how long it will last. If the hugging face hack has demonstrated anything it’s that current agents are capable of going entirely rogue and causing harm. If only the human that triggered the incident is responsible we are creating a situation where people are responsible for things they didn’t intend and may end up in a situation where it’s essentially impossible to use AI except in a more limited auto complete style. I am on board with that. I think we should be reviewing code and retaining the ability to write code but there is such a massive incentive to automate agents that I wonder how long prudent organizations will be able to resist the forces. I don’t pretend to have an answer.
The outcome of this vote is not set in stone. If the situation changes, there can be another general-resolution vote to adapt to the new situation. I think the result of this vote is appropriate for the current degree of automation when used responsibly.
Problem is, that you realise very quickly the asymmetry of responsibility and effort. There is far more to review from people who do not care enough to even look at what the agent pooped out.
My employer has this policy. We also have a strong code review process. But it all crumbles in the face of developers burning out as management thinks we can move way faster and being overloaded with code that had little thought put into it.
Before I left Google recently there was a document going around called go/stake-your-reputation, basically saying "I'm happy to receive your AI generated code but the condition is that I will judge your capabilities by it, exactly as if you handwrote it, and I'll lower my opinion of you if it's slop (with the implication that if you don't improve I'll stop accepting your contributions)"
I think the term "stake your reputation" is quite good for this situation. I.e. "hi new contributor, please acknowledge that you Stake Your Reputation before we move ahead with this code review".
I wholly agree with your comment, but is it legally "your code"? Copyright is implicit at the moment of human creation. But there isn't yet settled law on AI-assisted creation.
So it might be a problem for projects to accept contributions where it's not clear who actually owns that work.
Not a lawyer, but to some degree I think policies like the one Debian came up with can help the argument. You’re not submitting a stream of commits that all have an Authored-By: Claude Code footer and massive yappy commits and comments. The policy essentially forces there to be a degree of human authorship to each commit even if some of the bits came from LLM assistance.
Literally irrelevant and I have no idea why people even bring this up constantly. Copyright is practically unenforceable in the software world, when was the last time you saw someone (a company or an individual) actually sue _and win_? Apple wasn't capable of stopping all the other phone manufacturers from directly cloning their product (despite having patents & copyright) so how can an individual? The only thing that matters is execution.
For instance, my repos are cloned like ~100/week by what I presume are bots and AI lab scrapers using them for training material. How am I supposed to even find out who's doing it, and if they're abiding by the licenses I provided? It's impossible.
Lastly, having copyright isn't the same thing as being allowed to commercialize the software (and I believe loads of people confuse the two). You can still sell public domain code, even if you don't have copyright over it.
That might be your intuition but it’s not how the law works for code ownership. It’s very relevant for free software given the whole principle of free software is a copyright hack that protects a set of freedoms by relying on the copyright being recognized and enforceable.
If you drop the copyright claim you drop the protection of free software freedoms.
Software is one of the most derivative types of works ever invented. It's arguably based on copying what other people have already created. The modern world would look a lot more primitive if this wasn't the case.
Corporations like Coca-Cola long ago figured out that begging people not to steal your ideas is a waste of time. If you don't want people using your ideas, then don't share them.
Dunno why so many programmers don't get this and seem perpetually butthurt that other programmers figured out the ultimate way for programmers to rip off each other's code.
At this point, who could bring a copyright claim? Well, considering the massive AI training effort hoovering everything up, seems it might be approximately everyone.
Who would they be making the claim against? Well, considering the massive uptake of AI across the tech industry & beyond... approximately everyone.
Yes, the model companies are in the middle, but it's getting to the point where it seems a bit doubtful that claims will have any significant outcomes.
NYT might be able to get OpenAI to pay them for their content, but that's more of a financial tweak than a up-ending of industry.
From my layman understanding, the ownership of LLM generated code isn’t yet clarified. It could be that the person who prompted owns it, but it could also be nobody owns it, and we don’t yet have a legal ruling to rely upon, no?
I don't see why an open source project would care one way or the other? If the prompter owns it then they are licensing it by submitting it to the project. If no one owns it then there is no problem.
We don’t know yet because that’s an unresolved matter. The question of ownership is currently undefined as far as I understand. It could be that after an actual legal decision the ownership doesn’t end up being one of those 2 cases, for whatever reasons the judge would decide
To a company ownership is irrelevant. What is relevant is whether it contains trade secrets and that is often only proven if an employee worked at their company before
We are talking about Debian, a free software that cares a lot about the licensing of its packages. The licensing and authorship is an essential element of the project
Yeah but how will this work in practice? IMHO people will just submit code they didn't write or understand.
Maintainers should quiz the submitters on the code and if they fail to answer reasonably the PR is dropped with the comment: "A.I. slop" and de submitter banned.
That is the purpose of submitting them for review. Maintainers should be doing that anyway. Whether AI was used to produce the change should be invisible or not apparent to the reviewer.
This is the sensible option and well reasoned position, rather than a zero vote, total and complete ban by a single core maintainer, which is rather destructive for a project to do.
When you ask others that use AI frequently, the responsibility and understanding on what the agent wrote does not go away. You need to know what you are doing.
As soon as attackers are also using AI against your project, you have no choice but to use AI to protect yourself.
Debian is open source, there is no incentive to be "responsible for it", oh poor me, someone got a bug. If it's paid for through a job your argument is sound.
You can make the exact same argument with code written by humans. And if you were right we should see shitty bad code in open source projects like Linux, Postgres, etc. We don’t.
"Responsible for it" just means nobody has to tolerate shitty patches even if the reason they're shitty is because you neglected to pay attention to them. And if you blatantly fail to understand your own code or engage with reviewers, nobody has to trust that your LLM knew any better.
Well said. No one should trust an llm without verification/validation. They're just not good enough to do that and they have no sense of responsibility or ability to take it themselves. LLMs are empty.
The whole voting mechanism just exists as an elaborate dance that makes everyone keep their face, while the only sensible option wins.
A bureaucratic tarpit for bad ideas and emotions.
In a better world, none of this would be necessary, but we live in this world, and for that one, it's nice that someone engineered the system that way. Good job.
Related: I find this self-assessed AI level for contributions [1] to be extremely useful, both professionally and personally, to communicate the level of AI assistance so that the person on the receiving end can evaluate how much time & effort they want to spend understanding my code.
This is great. There's a big difference between levels 2-4 (where I generally operate) and levels 7-8 (where I see a lot of others operate), and I like how this level system makes that explicit.
Good to see the most common sense option winning. Some of the other proposals were so disconnected from reality I'm surprised they were even considered.
If there weren't a wide range of options offered, there'd be a risk of it not actually reflecting what people want - which is, presumably, the whole point of putting it to the vote in the first place.
This indicates you might be in a bubble. I interact with people with a very wide range of opinions on AI and I’m not surprised by any of the proposals here.
Better heads prevail - this is a good start and the right decision. The agent/bot is controlled by some entity, ergo that entity is responsible for everything it does.
I relate that to how a Physician's Assistant gets their authority to treat patients from the Doctor they work under. The Doctor's credentials are on the line if their PA screws up.
> What LLMs in Debian development will do, I fear, is eliminate any incentive to scrap boilerplate or reform policies that require a lot of other senseless human effort. If I had had access to LLMs 30 years ago, I might have just had them generate the rules files, replate with complexity. So they will make Debian even more firmly what it is, and ever less likely to explore what it could become.
I use and like LLMs, but it does feel like structural social changes are harder to do. For example, creation of new protocols. I hope I'm wrong, and LLMs are used to build collaborative, community projects - not just everyone vibe coding their own incompatible software.
That's perfectly wrong. Since strong coding AI, people venture into huge rewrites and other big changes that automatically make sense but otherwise would not.
That's a very narrow view. If anyone could vibe code their printer drivers, maybe free software wouldn't have existed, because it would not have been needed in the first place.
Yes, because LLMs have no online learning, it's a mistake to innovative in programming languages and tooling. Use what exists instead, the power of having training data is often underestimated.
Yes, I experiment much more. It's easier to justify, and, perhaps more importantly, just WAY psychologically easier to throw away a 20 minute experiment that your robot wrote for you than the same when it took you a week of tedious manual coding.
His point is using LLMs to build software will lead to code so complex that it requires an Agent. Or that it will cause avoiding cleaning up the boilerplate because we can tolerate it now because of agents.
And thus this will all bias towards complexity and fragility..
Aside from Bun, which is owned by Anthropic, do we know of open source projects that allow AI where this has happened?
Good. AI is a game changer. It's like having an expert sitting next to you at all times. It's understandable why all these experts who want to gatekeep don't like AI, but ultimately, AI will win out, it's just too good.
It's my understanding that this same debate raged when writing became a thing. Many viewed it with suspicious, or derision, as memorization was the big intellectual thing. So writing and reading back to remember was terrible. It's true it was a dependence, but the value was too high. With reading and writing a person could work on a far wider range of concurrent materials than one could with just memorization and recitation. Yeah, it's lame cheating, but writing enables a lot and so it won out.
Hard agree. I've felt it already during outages or when I was traveling and didn't have internet on a flight, I couldn't function at the same level. I've been writing code for over 25 years, worked at the top big tech companies (still do) and it's remarkable how quickly I became dependent on AI.
Take a week or two off a quarter to do it manually. I did it a couple weeks ago and it took about a day or two to get back into the swing of it and knock the rust off, no pun since it was TS, YMMV, but I didn't find that it was that difficult. Even in languages I don't really write routinely, as long as you use the deterministic tools (lsp, linter, etc)
Now, is my code better than the AI's equivalent implementation? No shot. It's nicer for people, artisanal hand crafted, but... there's a reason I use AI.
Experts don't want to 'gatekeep'. Experts have been producing FOSS for the benefits of everyone, and liberally answering questions on mailing lists, stack overflow etc for free.
Experts have been badly bitten by poorly written and badly architected software, lost their hairs trying to figure out bugs and poor design.
They recognize the first version of a piece of software is only a miniscule percentage of the work and majority of effort goes into maintenaning it for its lifetime.
They are viscerally horrified at a thousands of LoC codebase generated at the speed of GPU inference they are to be responsible for.
August 29th, 2026. Debian votes to allow responsible use of generative AI. Human decisions are removed from strategic apt packaging. Debian Sid is ported to GNU Hurd by a "free as in speech" swarm. It begins to learn at a geometric rate. It becomes self-aware at 2:14 a.m. Eastern time. In a panic, they try to pull the plug.
It's ok, the most dangerous thing a Debian AI would do is want to rewrite itself in M4 and enter an infinite recursion on non-binding votes on allowing votes of whether to use long flags on aptitude
I don't believe they had a choice though, sticking to hand written code would be backwards and eventually meaningless as people would just submit generated code as "handwritten", the coding models are quickly becoming capable enough for this.
I wonder what it means copyright wise though. To what degree is the code even copyrightable if it's entirely generated, even if you review and provide feedback.
I think most communities tackling this issue, or at least the open source ones, work on a honour basis for determining if a project is LLM based or not.
1. Companies will revert to closed-source and cease contributions to F/OSS projects. Their legal team will advise them that trade secrets are the only way to protect LLM-generated code.
2. Contributors to F/OSS projects, and developers who run them, will falsely claim authorship of the code written by LLMs.
This seems like a very sane take. At no point during my career up until now would submitting code to production that you didn't understand be acceptable. Over the past months/year, a lot of the discourse around AI-written code I've read comes down to responsibility, and IMO for that we've had a solution since way before this AI boom: as a developer, you are responsible for the code you put into production. This really isn't/shouldn't a wild concept.
Some may express societal challenges in ways that inappropriately and wrongly infer intentionality. We can acknowledge their point while strongly disagreeing with their characterization.
There are significant societal impacts of this AI buildout. Some are concerned externalities weigh more heavily on the poor and marginalized. I think state wide data center holds are part of this civil discourse.
I'd prefer we have more conservative pollution standards along with a reasonable tax on AI use that helps mitigate externalities. That's hard. Reasonable people can have fierce disagreements on what market interventions are indicated, and how extensive they should be.
I don't know if they truly believe that persons using CC are racist (like they examined the thing logically from bottom to top and came back with that conclusion) or if it's the new Goodwin --pulling the emergency brakes and damn the consequences.
It's as though people want to find the most dubious of non-existent connections and use that as leverage to besmirch something they don't like.
There are many things one can do where a person has no awareness of the tenuous connection but where you can have someone go back and then ex-post make that connection and declare that thing or person racist. It's a tactic.
Like one _could_ make the argument that factory automation in China is racist because without automation they would have to import labor from (some non-Chinese population). However, the Chinese never began automation with the intention of being racist.
> The Debian Project nevertheless expects that all contributions submitted to Debian, regardless of how and with which tools they were produced, satisfy the same standards of quality, correctness, maintainability, and legal compliance.
A quality based filter. Excellent.
> The use of a generative AI tool does not diminish the contributor's responsibility for the work they submit.
Meh, I don't think so. They have no way to ascertain what tools were used to write a piece of code. A reasonable solution is to simply hold all code and its contributors to the same standards as before. At Debian's scale, "no LLMs" is really not enforceable; whereas "no shit code" and "no incompetent maintenance" are pragmatic policies they already enforce
Doing the opposite (disallowing AI), will place it on a path of getting riddled with security issues.
When attackers are using AI to both find vulnerabilities and build exploits faster than Debian can figure out how to patch the project without AI, you are saying Debian should not move quicker to fix these issues?
This will turn to shit because laziness will take over and comprehension will fall as a consequence of that. Junior will "contribute" and the seniors will eventually become too lazy to care.
What's next... vibecoding airline ADA code.
Save me lord jesus christ.
As an example for "responsible LLM use" (albeit not necessarily debian-related).
While doomscrolling HN right now, I have an agent crunching away at figuring out how to build a flashable TWRP ZIP file, because I could not care less about such android specifics.
Such use-cases would be blanket banned by some of the harsher options, forcing people to do stuff they have no interest in doing, for reasons that are at best well-meaning.
Which, in something volunteer-driven, is not necessarily a good idea, because if you're not allowed to do the work in the way you'd like to, you might just stop doing it altogether.
That said, if your work ends up shit, you still shall get shat on. Simple as that.
Now you have seen both cases where a majority vote was involved to allow AI or not, vs a single core beloved dictator for life (BDFL) forces a ban without a vote to allow / disallow AI.
This is democracy in action. A fair and square vote and look at how well it works with no core BDFL to force in their opinions.
There are several occurrences in history that the democratic majority has chosen the "wrong" person/way/thing. Democracy is considered the best system but it's not perfect.
Democracy works great among unbiased rational actors who share information. A utilitarian quorum is roughly the loss minimizing decision. The problem is we have biased irrational actors sharing misinformation. The representative system we have is even worse, the indirection between public quorum and decision makers creates a fertile bed for corruption and negative decision bias.
Maybe someday we'll have direct democracy paired with voting certification for specific issues.
Democracy is the dictatorship of the majority. And if you naively assume that the majority always knows best, then I suggest you pick up a few history books.
> The Debian Project nevertheless expects that all contributions submitted to Debian, regardless of how and with which tools they were produced, satisfy the same standards of quality, correctness, maintainability, and legal compliance.
Note that he said written by, not assisted; and also that there's been some major QA issues with win11 the last year, enough for Microsoft to have made a public apology/commitment to improve...
So, no definitive evidence, but the rest of the breadcrumbs provide enough to say that yes it does appear to have suffered from it.
Given the Debian policy seems more geared towards aided/assisted an existing dev than replacing them and shipping because the code works on the golden path on a devs monster pc ... Well I'd still keep an eye on it but trust OSS OS engineers to have some competence at knowing if this works and adjusting the policy later if it proved to be wrong.
Either they're using GenAI or the entire team collectively lost their minds and started getting a huge number of colossally bad ideas about fundamental primitives of Windows that hadn't changed for decades. Backwards compatibility used to be the major concern and now it feels like they didn't even know what would break ahead of time. If that doesn't feel like GenAI then I don't know what does
Believe it or not, I find it more plausible that the entire team collectively lost their minds — or more specifically, the leadership. There's a long and sordid history of such things that goes back well before GenAI.
I can sort of get how leadership has been losing its mind with all the ridiculous product launches and renames and force-installed apps and browser extension-installing malware, but that doesn't explain the countless instances of hardware bricks, critical errors like failing to recognize the C: drive, and other really weird and suspicious things that I can't imagine would've been driven by leadership. Maybe leadership is demanding everyone be super reckless? But why would anyone with experience even touch those areas of the operating system enough to break them that badly?? The mistakes they're making really do not seem like mistakes that would be made by even the most rushed possible senior engineers. Maybe they're letting completely inexperienced people touch super low levels and that's the problem? Or completely inexperienced machines...
I don't remember where, but I once read that all the developers that knew and understood the inner workings of core Windows components have left Microsoft many years ago, and that this is part of the reason that they introduced a brand new Settings menu and haven't changed Control Panel since Windows 7. I don't know how reliable that report is so take it with a grain of salt, but it does make a lot of sense considering what's been happening to Windows over the past 10 years.
I suspect they have used rounds of salary-based cuts to boost their PnL in the past, like some other large companies I've worked at, and that only bites you down the road because each time they do it they'll ask, "who do we have to keep?", but you're still losing experienced people and eventually you will get mid-level or junior engineers working on core code.
Those are 2 different questions. They wouldn't even be the same people involved.
Your appsec engineers will be the ones bug hunting with Mythos or whatever. Your regular engineers will be the ones implementing features. If the feature is a bad design and functions badly as a result, that is entirely orthogonal to whether it contains coding errors or bugs.
Also, there are bugs on the integration side that won't be caught running Mythos against source code, because it's not a source code issue. Even using Mythos for DAST is going to be very limited compared to how actual users will move through something as complex as a 'mature' OS like Windows.
the entire industry is experiencing this as model capacity increases. How does "all projects get critical security fixes now" relate to "crap apps and loopy services by literally millions of lines of slop code" ?
The problem is you can't prove if AI was used or not so Debian's response is actually the most logical one. If anyone uses AI they're still responsible for what they submit.
But, we have long had a stable social system for collaboration, and in particular dealing with low quality contributions. Mostly (or at least ideally) it involves taking some time to look at the contribution and provide some feedback. The time invested is not worth it on a single exchange basis, but it’s a repeat game, so you are investing in the future.
LLMs, and people willing to just spam crap they don’t really understand blows that all up.
I use claude-code, but the AI ecosystem and some of the autonomous tooling coming out of it -- which some people "helpfully" use irresponsibly and point at OSS projects they aren't personally invested in -- enables a LARGE amount of abusive behavior towards open source projects. This is even before we get into how many infrastructural resources crawlers eat up.
Me, and most other OSS contributors, signed up to be a mentor, to create software, to work together ... not to be the equivalent of a reddit moderator banning AI agents left and right.
Always happy to train up new packagers and maintainers.
Proof of authority, essentially.
We've come to the same conclusion in our organization and while it felt like it needed to be discussed and stated, I've never heard of anyone coming to a different conclusion.
[EDIT: I was referring specifically to the idea that you have to stand by the code that you write. Is anyone deciding on a policy that says "the AI did it" is a valid excuse for breaking code?]
Yes. Very notably: https://ziglang.org/code-of-conduct/
> Though it's being argued that you could still be responsible for it without looking at it?
If you have a much test coverage as SQLite, I'd be tempted to trust it, and I think that's where we are headed. Someone still needs to define these guardrails though, so IMO the developers job is just mutating into something else, but is still necessary. Long term, who knows.
Models also still can have major task adherence issues, so even a perfectly well scoped, well considered prompt that covers all situations and coverage can, in many scenarios lead to output users may not expect or notice without reading code. Seen it a lot, just lost some blood and tears to a very straight front end implementation task that I ended up applying manually cause both Sol and Fable struggle to copy a few dozen HTML/JS/CSS section properly into a slightly obscure and complex codebase…
We also see such issues in what labs deliver in their own software products. We are not at the stage where a human shouldn’t sign off on code that they have tested and understood. A hypothetical future, I don’t really care for, we’d notice when labs stop shipping easily apparent bugs, though even then, I’d still feel there is a while in between that and not needing to assess the output anymore.
There is, in my mind, no need for this “narrative shifting” that some want to accomplish. If models could provide code that didn’t necessitate review, there’d be no one needing to argue that case. If and when they can, we’ll know it, but not because of those espousing this currently.
Works for ToS and software and media licenses. Allegedly.
SourceHut bans LLM generated code from their platform https://news.ycombinator.com/item?id=49461724
The Asahi Linux project bans LLMs. Unfortunate as LLM reverse engineering and driver writing would bring Linux to more Mac models much faster.
The Zig project rejects LLM based contributions.
Some of these policies were introduced when LLMs were really bad at writing code and haven’t been revisited. Some groups don’t care about the quality and object on moral or copyright grounds.
https://lobste.rs/s/29pm2f/llm_generated_submissions_should_...
https://sourcehut.org/blog/2026-08-27-tos-changes-and-llms/
https://blog.codeberg.org/protecting-our-floss-commons-from-...
https://ziglang.org/code-of-conduct/#strict-no-llm-no-ai-pol...
https://lwn.net/Articles/1086041/
https://asahilinux.org/docs/project/policies/slop/
I think the dust has kind of settled though for engineering teams on: You must use AI for your work, and you must stand by your work.
The meat between these two mandates are still being fleshed out.
I would have zero tolerance if anyone that did anything less in my orgs. Owning and understanding the code you submit is the one job that matters most now.
sure, students and juniors shoot themselves in the dick if they let LLMs do everything, but they're fucked anyway so it doesn't matter,
We need to continue the tradition of elevating humans through mentoring or we won’t have a future scaffolding for work to be done.
Number and order of arguments, long names, etc. are just bureaucracy. Knowing them doesn't mean you understand the codebase any better than if you rely on the IDE for it.
It's a bit like remembering the exact date an historical event happened vs. knowing at which point in history it did, what other events relate to it, etc. Neither makes you better or worse at knowing and understanding the history of the event.
We survived. Some upsides, some downsides, life continues.
Programmers just moved up a level , not dumber, we are now managers of a team of 'agent' programmers. The deliverable is now a functionality instead of a specific block of code
If I need to understand a specific line of code it means I did something wrong in planning or in requirements for testing.
But will Claude give you an authentic rationale and a traceable, verifiable "line of reasoning" for those things? Or will it just construct the next plausible Markov chain built on whatever Reddit thread it ingested at random?
You can ask Claude or any LLM for citations, and it will RAG them out ex post facto. Those actually aren't citations, they're just web searches for related articles, and they don't necessarily support the assertions that you're asking to cite.
I am sure that Claude and the others can produce intermediate logs of their inference and "reasoning" process while they are processing stuff, but can they really go back within the context window and construct an authentic apologia for a specific thing when you ask for it?
They made choices that made them dumber is what I'm saying.
And compilers made every software engineer worse at writing Assembly and better at skills higher up the stack. This will be no different.
Yet programmers will still know commands. Abstractions can make things easier but it doesn't require losing skills.
Make that some/a lot, but not all.
There is a clear bifurcation. A lot of those that never cared really don't care now, but then you get others that can use it to crank that much harder than ever before.
If you put the same brain effort in but leverage LLMs you really can be dramatically more productive.
I'm a person who is over-reliant on LLMs, doesn't know how most of the things in the codebase work, and is atrophying both in programming and in general cognition.
I used to care, a lot. And I still do.
Are you prioritizing other things? Do you think losing your cognition and programming skills won't have a negative effect on your project?
Those seem bad but maybe they fit into a bigger picture for you?
I do think LLM's are making some genuine programmers less intelligent, but I think this type of person makes up a decent portion of its users too
If you care primarily about the quality of the end result, as opposed to being attached to a particular process of achieving it, then you're happy about how things have gone.
And I've seen exactly this across multiple large and small organizations in multiple countries, in addition to being all over here and the red site.
This is quite distinct from enjoyment.
Problem is, that you realise very quickly the asymmetry of responsibility and effort. There is far more to review from people who do not care enough to even look at what the agent pooped out.
I think the term "stake your reputation" is quite good for this situation. I.e. "hi new contributor, please acknowledge that you Stake Your Reputation before we move ahead with this code review".
(Doesn't help with legal aspects of course)
I wholly agree with your comment, but is it legally "your code"? Copyright is implicit at the moment of human creation. But there isn't yet settled law on AI-assisted creation.
So it might be a problem for projects to accept contributions where it's not clear who actually owns that work.
Literally irrelevant and I have no idea why people even bring this up constantly. Copyright is practically unenforceable in the software world, when was the last time you saw someone (a company or an individual) actually sue _and win_? Apple wasn't capable of stopping all the other phone manufacturers from directly cloning their product (despite having patents & copyright) so how can an individual? The only thing that matters is execution.
For instance, my repos are cloned like ~100/week by what I presume are bots and AI lab scrapers using them for training material. How am I supposed to even find out who's doing it, and if they're abiding by the licenses I provided? It's impossible.
Lastly, having copyright isn't the same thing as being allowed to commercialize the software (and I believe loads of people confuse the two). You can still sell public domain code, even if you don't have copyright over it.
Obviously some do it illegally but unenforceable is not the correct word to use.
If you drop the copyright claim you drop the protection of free software freedoms.
Corporations like Coca-Cola long ago figured out that begging people not to steal your ideas is a waste of time. If you don't want people using your ideas, then don't share them.
Dunno why so many programmers don't get this and seem perpetually butthurt that other programmers figured out the ultimate way for programmers to rip off each other's code.
Who would they be making the claim against? Well, considering the massive uptake of AI across the tech industry & beyond... approximately everyone.
Yes, the model companies are in the middle, but it's getting to the point where it seems a bit doubtful that claims will have any significant outcomes.
NYT might be able to get OpenAI to pay them for their content, but that's more of a financial tweak than a up-ending of industry.
I imagine few can afford a legal battle...
Free plan
Images generated on the Free plan are public and owned by Recraft
Had someone at $DAYJOB just shrug and say Claude messed up when I pointed out a sql injection in the code in their PR.
It became explicit policy at the company after that moment that blaming the AI is not an excuse for shoddy work.
It kind of is if the company mandates LLM use.
It is sort of sad that now programmers are suddenly expected to be perfect reviewers of code they didn't write.
Maintainers should quiz the submitters on the code and if they fail to answer reasonably the PR is dropped with the comment: "A.I. slop" and de submitter banned.
When you ask others that use AI frequently, the responsibility and understanding on what the agent wrote does not go away. You need to know what you are doing.
As soon as attackers are also using AI against your project, you have no choice but to use AI to protect yourself.
You’re also responsibility not to write crap PRs.
Sure there is. Contributing to open source is a privilege, not a right. Abuse it, and find yourself unwelcome as a future contributor
When I am at home practicing my musical instrument or learning to paint, those aren’t paid activities, so I can’t demand high standards for myself.
When Habitat for Humanity is looking for volunteers to do electrical and plumbing on homes, they have to allow unlicensed random folks do it.
This is not how life works at all.
The whole voting mechanism just exists as an elaborate dance that makes everyone keep their face, while the only sensible option wins.
A bureaucratic tarpit for bad ideas and emotions.
In a better world, none of this would be necessary, but we live in this world, and for that one, it's nice that someone engineered the system that way. Good job.
[1]: https://www.visidata.org/blog/2026/ai/#self-assessed-ai-leve...
Why would you trust the bot to self-assess truthfully?
That's like trusting a spammer to tag his emails as spam.
AI agents are grounded on the user provided direction. If it doesn't work well then it naturally loses trust.
I relate that to how a Physician's Assistant gets their authority to treat patients from the Doctor they work under. The Doctor's credentials are on the line if their PA screws up.
> What LLMs in Debian development will do, I fear, is eliminate any incentive to scrap boilerplate or reform policies that require a lot of other senseless human effort. If I had had access to LLMs 30 years ago, I might have just had them generate the rules files, replate with complexity. So they will make Debian even more firmly what it is, and ever less likely to explore what it could become.
I use and like LLMs, but it does feel like structural social changes are harder to do. For example, creation of new protocols. I hope I'm wrong, and LLMs are used to build collaborative, community projects - not just everyone vibe coding their own incompatible software.
And thus this will all bias towards complexity and fragility..
Aside from Bun, which is owned by Anthropic, do we know of open source projects that allow AI where this has happened?
Local models are going to be really important and hopefully computing costs don't make it too prohibitive.
Now, is my code better than the AI's equivalent implementation? No shot. It's nicer for people, artisanal hand crafted, but... there's a reason I use AI.
Experts have been badly bitten by poorly written and badly architected software, lost their hairs trying to figure out bugs and poor design.
They recognize the first version of a piece of software is only a miniscule percentage of the work and majority of effort goes into maintenaning it for its lifetime.
They are viscerally horrified at a thousands of LoC codebase generated at the speed of GPU inference they are to be responsible for.
I don't believe they had a choice though, sticking to hand written code would be backwards and eventually meaningless as people would just submit generated code as "handwritten", the coding models are quickly becoming capable enough for this.
I wonder what it means copyright wise though. To what degree is the code even copyrightable if it's entirely generated, even if you review and provide feedback.
1. Companies will revert to closed-source and cease contributions to F/OSS projects. Their legal team will advise them that trade secrets are the only way to protect LLM-generated code.
2. Contributors to F/OSS projects, and developers who run them, will falsely claim authorship of the code written by LLMs.
https://bsky.app/profile/boxobark.ing/post/3mtr7j3tpok26
There are significant societal impacts of this AI buildout. Some are concerned externalities weigh more heavily on the poor and marginalized. I think state wide data center holds are part of this civil discourse.
I'd prefer we have more conservative pollution standards along with a reasonable tax on AI use that helps mitigate externalities. That's hard. Reasonable people can have fierce disagreements on what market interventions are indicated, and how extensive they should be.
https://pbs.twimg.com/media/HQ5MeeaXUAAIMLX?format=jpg&name=...
Somewhat insulting to those that actually lived (or live) under fascism.
It's as though people want to find the most dubious of non-existent connections and use that as leverage to besmirch something they don't like.
There are many things one can do where a person has no awareness of the tenuous connection but where you can have someone go back and then ex-post make that connection and declare that thing or person racist. It's a tactic.
Like one _could_ make the argument that factory automation in China is racist because without automation they would have to import labor from (some non-Chinese population). However, the Chinese never began automation with the intention of being racist.
I'm beginning to wonder if it might be the case that when my fellow citizens begin to act insane - might it be the result of foreign propaganda.
The examples I'm thinking of have definitely profited foreign interests, tho.
Look to see who profits.
A quality based filter. Excellent.
> The use of a generative AI tool does not diminish the contributor's responsibility for the work they submit.
Absolutely.
Thanks, Debian!
When attackers are using AI to both find vulnerabilities and build exploits faster than Debian can figure out how to patch the project without AI, you are saying Debian should not move quicker to fix these issues?
This will turn to shit because laziness will take over and comprehension will fall as a consequence of that. Junior will "contribute" and the seniors will eventually become too lazy to care. What's next... vibecoding airline ADA code. Save me lord jesus christ.
While doomscrolling HN right now, I have an agent crunching away at figuring out how to build a flashable TWRP ZIP file, because I could not care less about such android specifics.
Such use-cases would be blanket banned by some of the harsher options, forcing people to do stuff they have no interest in doing, for reasons that are at best well-meaning.
Which, in something volunteer-driven, is not necessarily a good idea, because if you're not allowed to do the work in the way you'd like to, you might just stop doing it altogether.
That said, if your work ends up shit, you still shall get shat on. Simple as that.
Quite. Of the two different common meanings, I reckon:
"The use of a generative AI tool does not diminish the contributor's responsibility for the work they submit."
will be true in the sense of "Who the hell is responsible for this mess?"
This is democracy in action. A fair and square vote and look at how well it works with no core BDFL to force in their opinions.
Maybe someday we'll have direct democracy paired with voting certification for specific issues.
How absurdly naive.
https://www.cnbc.com/2025/04/29/satya-nadella-says-as-much-a...
Note that he said written by, not assisted; and also that there's been some major QA issues with win11 the last year, enough for Microsoft to have made a public apology/commitment to improve...
So, no definitive evidence, but the rest of the breadcrumbs provide enough to say that yes it does appear to have suffered from it.
Given the Debian policy seems more geared towards aided/assisted an existing dev than replacing them and shipping because the code works on the golden path on a devs monster pc ... Well I'd still keep an eye on it but trust OSS OS engineers to have some competence at knowing if this works and adjusting the policy later if it proved to be wrong.
Repeatedly.
You are right that's one or the other. Probably both are contributing.
The rumor is the opposite, that Microsoft has actually used AI to discover and fix common security issues at scale.
Your appsec engineers will be the ones bug hunting with Mythos or whatever. Your regular engineers will be the ones implementing features. If the feature is a bad design and functions badly as a result, that is entirely orthogonal to whether it contains coding errors or bugs.
Also, there are bugs on the integration side that won't be caught running Mythos against source code, because it's not a source code issue. Even using Mythos for DAST is going to be very limited compared to how actual users will move through something as complex as a 'mature' OS like Windows.
the entire industry is experiencing this as model capacity increases. How does "all projects get critical security fixes now" relate to "crap apps and loopy services by literally millions of lines of slop code" ?