Contributors are expected to understand, review, test, and, where appropriate, modify AI-assisted output before incorporating it into Debian. Blindly accepting or uploading AI-generated material without appropriate human review is inconsistent with Debian’s established development practices. We [encourage] our contributors to disclose whether a contribution was made with AI [assistance], but do not require them to do so.
Not at all, because it’s impossible to know for sure if committed code had some form of AI generated parts, AI assisted review, prototyping, etc.
By making it mandatory you can potentially alienate good developers who may feel their work ethics would be scrutinized negatively (like in these comments).
An LLM is just a tool. Some iterations have some value in some circumstances. In those cases it’s fine. But look around at the comments here and you’ll see many people basically accusing Debian of selling out. If a dev sees that reaction then they may not want to disclose their own use of LLMs.
Why would you not want to disclose though? Is it because of shame? Because you are unable to defend your choice? If it’s “just a tool”, is that not enough to defend your choice?
To be clear: the alternative policy we’re talking about isn’t “LLMs are bad, don’t use them”, it’s “Let us know when you are using LLMs”
I agree. Disclosure of A.I. use should be mandatory.
My main concern with A.I. use is its ability to hide incompetence. If a new agent introduces code that was entirely written by illegal-software that violates copyright law–A.I.–then that should be made clear, even if competent-programmers review the new inclusion and approve of it. Otherwise people are left with the impression that this new agent is a competent programmer. A.I. use–undisclosed–creates false reputations.
The disclosure being encouraged and not mandatory is purely to protect the egos of programmers currently utilizing A.I. products.
However I do respect their decision and I maintain projects should be self governing.
I disagree. For one, it’s unenforceable, just like outright banning it.
But AI assistance can also mean a lot of different things, from outright vibecoding through autocomplete up to only asking it to so review. It diminishes the human work in the eyes of other people, because a simple disclaimer doesn’t distinguish between the work done, and also encourages people to point out to AI as a scapegoat for their mistakes.
Good code always was and should always be one where a human is fully responsible for it; if you decide to vibecode and happens to end up with perfect code, good; if you write it fully yourself but it’s crap it doesn’t absolve you that you didn’t use AI…
It’s a tool, so use it responsibly like any other tool and stand behind your code no matter what tools you used.
But the issue is that in practise, there is no viable way to verify wether or not AI has been used at all. In other words, the disclosure of AI use entirely depends on the person providing the code, wether disclosure is mandated or not.
If there was enforcment to disclose AI use, it would create a false assumption that code which claims no AI use, is verified to contain mo AI use, which again, cannot be verified by anyone.
So it’s not that it’s hard to enforce, it’s not that it’s impossible to enforce 100%, it’s that there currently is no viable way to enforce it at all.
look at visual studio’s Intellisense and compare it to the last version that didn’t advertise Ai, there aren’t that many functional differences and if you don’t keep up with the marketing you could very easily miss that it is Ai powered.
I disagree. For one, it’s unenforceable, just like outright banning it.
Agreed. I an aware a lot of people contributed to the Linux kernel, without disclosing they used ai.
Good code always was and should always be one where a human is fully responsible for it; if you decide to vibecode and happens to end up with perfect code, good; if you write it fully yourself but it’s crap it doesn’t absolve you that you didn’t use AI…
Yeah. I do not blame the ai for writing the code, but rather the person to accept and push that code even if they know it is crap.
I do respect their decision and I maintain projects should be self governing.
Me too, but I also think that governance isn’t as simple as “we get to decide what we do”, it also interacts with how well the decision-makers understand their domain and their broader it sits in, both of which are potentially reduced as a consequence of relying on AI.
Also there is the possibility of AI tools dominating workflows and then getting ripped away (either as the corporates raise costs, or the bubble bursts and they collapse), leaving a project overwhelmed with a unmanageably large array of weaknesses. In that scenario self-governance starts to become irrelevant.
When people do code review off a pull request and sees it’s slop, it will go back to the developer to fix it. I guess if a person submit too much slop, they will get banned or something similar.
However, I don’t know the Debian process to have new code submitted, but would guess that it have to be more than one person to go from code to build a package.
Oh it definitely should be disclosed
That last bit is a bad idea
Not at all, because it’s impossible to know for sure if committed code had some form of AI generated parts, AI assisted review, prototyping, etc.
By making it mandatory you can potentially alienate good developers who may feel their work ethics would be scrutinized negatively (like in these comments).
If you’re happy to use AI tools to develop, why would you not be happy to declare your use of those tools?
“Happy” is an odd choice of words here.
An LLM is just a tool. Some iterations have some value in some circumstances. In those cases it’s fine. But look around at the comments here and you’ll see many people basically accusing Debian of selling out. If a dev sees that reaction then they may not want to disclose their own use of LLMs.
Why would you not want to disclose though? Is it because of shame? Because you are unable to defend your choice? If it’s “just a tool”, is that not enough to defend your choice?
To be clear: the alternative policy we’re talking about isn’t “LLMs are bad, don’t use them”, it’s “Let us know when you are using LLMs”
I agree. Disclosure of A.I. use should be mandatory.
My main concern with A.I. use is its ability to hide incompetence. If a new agent introduces code that was entirely written by illegal-software that violates copyright law–A.I.–then that should be made clear, even if competent-programmers review the new inclusion and approve of it. Otherwise people are left with the impression that this new agent is a competent programmer. A.I. use–undisclosed–creates false reputations.
The disclosure being encouraged and not mandatory is purely to protect the egos of programmers currently utilizing A.I. products.
However I do respect their decision and I maintain projects should be self governing.
I disagree. For one, it’s unenforceable, just like outright banning it.
But AI assistance can also mean a lot of different things, from outright vibecoding through autocomplete up to only asking it to so review. It diminishes the human work in the eyes of other people, because a simple disclaimer doesn’t distinguish between the work done, and also encourages people to point out to AI as a scapegoat for their mistakes.
Good code always was and should always be one where a human is fully responsible for it; if you decide to vibecode and happens to end up with perfect code, good; if you write it fully yourself but it’s crap it doesn’t absolve you that you didn’t use AI…
It’s a tool, so use it responsibly like any other tool and stand behind your code no matter what tools you used.
So just declare how you used the tool?
Nonsense. Doing so is clearly abdicating the responsibility that you’re saying people need to have, and basically admitting you’re a bad developer.
If people thought “its impossible to catch everyone so why bother trying to catch anyone at all” when making laws, no laws would exist
But the issue is that in practise, there is no viable way to verify wether or not AI has been used at all. In other words, the disclosure of AI use entirely depends on the person providing the code, wether disclosure is mandated or not.
If there was enforcment to disclose AI use, it would create a false assumption that code which claims no AI use, is verified to contain mo AI use, which again, cannot be verified by anyone.
So it’s not that it’s hard to enforce, it’s not that it’s impossible to enforce 100%, it’s that there currently is no viable way to enforce it at all.
THIS, THIS, THIS
Basically, a nirvana fallacy/perfect solution fallacy.
https://deadsimpletech.com/blog/no-such-thing-as-just-a-tool
look at visual studio’s Intellisense and compare it to the last version that didn’t advertise Ai, there aren’t that many functional differences and if you don’t keep up with the marketing you could very easily miss that it is Ai powered.
Agreed. I an aware a lot of people contributed to the Linux kernel, without disclosing they used ai.
Yeah. I do not blame the ai for writing the code, but rather the person to accept and push that code even if they know it is crap.
Me too, but I also think that governance isn’t as simple as “we get to decide what we do”, it also interacts with how well the decision-makers understand their domain and their broader it sits in, both of which are potentially reduced as a consequence of relying on AI.
Also there is the possibility of AI tools dominating workflows and then getting ripped away (either as the corporates raise costs, or the bubble bursts and they collapse), leaving a project overwhelmed with a unmanageably large array of weaknesses. In that scenario self-governance starts to become irrelevant.
And how are they (Debian) going to to make sure this happens?
There’s no way to know for sure regardless. Having a policy allows them to take action when they do find it.
When people do code review off a pull request and sees it’s slop, it will go back to the developer to fix it. I guess if a person submit too much slop, they will get banned or something similar.
However, I don’t know the Debian process to have new code submitted, but would guess that it have to be more than one person to go from code to build a package.