But, we have long had a stable social system for collaboration, and in particular dealing with low quality contributions. Mostly (or at least ideally) it involves taking some time to look at the contribution and provide some feedback. The time invested is not worth it on a single exchange basis, but it’s a repeat game, so you are investing in the future.
LLMs, and people willing to just spam crap they don’t really understand blows that all up.
I use claude-code, but the AI ecosystem and some of the autonomous tooling coming out of it -- which some people "helpfully" use irresponsibly and point at OSS projects they aren't personally invested in -- enables a LARGE amount of abusive behavior towards open source projects. This is even before we get into how many infrastructural resources crawlers eat up.
Me, and most other OSS contributors, signed up to be a mentor, to create software, to work together ... not to be the equivalent of a reddit moderator banning AI agents left and right.
We've come to the same conclusion in our organization and while it felt like it needed to be discussed and stated, I've never heard of anyone coming to a different conclusion.
[EDIT: I was referring specifically to the idea that you have to stand by the code that you write. Is anyone deciding on a policy that says "the AI did it" is a valid excuse for breaking code?]
Yes. Very notably: https://ziglang.org/code-of-conduct/
> Though it's being argued that you could still be responsible for it without looking at it?
If you have a much test coverage as SQLite, I'd be tempted to trust it, and I think that's where we are headed. Someone still needs to define these guardrails though, so IMO the developers job is just mutating into something else, but is still necessary. Long term, who knows.
Models also still can have major task adherence issues, so even a perfectly well scoped, well considered prompt that covers all situations and coverage can, in many scenarios lead to output users may not expect or notice without reading code. Seen it a lot, just lost some blood and tears to a very straight front end implementation task that I ended up applying manually cause both Sol and Fable struggle to copy a few dozen HTML/JS/CSS section properly into a slightly obscure and complex codebase…
We also see such issues in what labs deliver in their own software products. We are not at the stage where a human shouldn’t sign off on code that they have tested and understood. A hypothetical future, I don’t really care for, we’d notice when labs stop shipping easily apparent bugs, though even then, I’d still feel there is a while in between that and not needing to assess the output anymore.
There is, in my mind, no need for this “narrative shifting” that some want to accomplish. If models could provide code that didn’t necessitate review, there’d be no one needing to argue that case. If and when they can, we’ll know it, but not because of those espousing this currently.
Works for ToS and software and media licenses. Allegedly.
SourceHut bans LLM generated code from their platform https://news.ycombinator.com/item?id=49461724
The Asahi Linux project bans LLMs. Unfortunate as LLM reverse engineering and driver writing would bring Linux to more Mac models much faster.
The Zig project rejects LLM based contributions.
Some of these policies were introduced when LLMs were really bad at writing code and haven’t been revisited. Some groups don’t care about the quality and object on moral or copyright grounds.
https://lobste.rs/s/29pm2f/llm_generated_submissions_should_...
https://sourcehut.org/blog/2026-08-27-tos-changes-and-llms/
https://blog.codeberg.org/protecting-our-floss-commons-from-...
https://ziglang.org/code-of-conduct/#strict-no-llm-no-ai-pol...
I think the dust has kind of settled though for engineering teams on: You must use AI for your work, and you must stand by your work.
The meat between these two mandates are still being fleshed out.
I would have zero tolerance if anyone that did anything less in my orgs. Owning and understanding the code you submit is the one job that matters most now.
sure, students and juniors shoot themselves in the dick if they let LLMs do everything, but they're fucked anyway so it doesn't matter,
We need to continue the tradition of elevating humans through mentoring or we won’t have a future scaffolding for work to be done.
Number and order of arguments, long names, etc. are just bureaucracy. Knowing them doesn't mean you understand the codebase any better than if you rely on the IDE for it.
It's a bit like remembering the exact date an historical event happened vs. knowing at which point in history it did, what other events relate to it, etc. Neither makes you better or worse at knowing and understanding the history of the event.
We survived. Some upsides, some downsides, life continues.
Programmers just moved up a level , not dumber, we are now managers of a team of 'agent' programmers. The deliverable is now a functionality instead of a specific block of code
If I need to understand a specific line of code it means I did something wrong in planning or in requirements for testing.
But will Claude give you an authentic rationale and a traceable, verifiable "line of reasoning" for those things? Or will it just construct the next plausible Markov chain built on whatever Reddit thread it ingested at random?
You can ask Claude or any LLM for citations, and it will RAG them out ex post facto. Those actually aren't citations, they're just web searches for related articles, and they don't necessarily support the assertions that you're asking to cite.
I am sure that Claude and the others can produce intermediate logs of their inference and "reasoning" process while they are processing stuff, but can they really go back within the context window and construct an authentic apologia for a specific thing when you ask for it?
And compilers made every software engineer worse at writing Assembly and better at skills higher up the stack. This will be no different.
They made choices that made them dumber is what I'm saying.
Yet programmers will still know commands. Abstractions can make things easier but it doesn't require losing skills.
Make that some/a lot, but not all.
There is a clear bifurcation. A lot of those that never cared really don't care now, but then you get others that can use it to crank that much harder than ever before.
If you put the same brain effort in but leverage LLMs you really can be dramatically more productive.
I'm a person who is over-reliant on LLMs, doesn't know how most of the things in the codebase work, and is atrophying both in programming and in general cognition.
I used to care, a lot. And I still do.
Are you prioritizing other things? Do you think losing your cognition and programming skills won't have a negative effect on your project?
Those seem bad but maybe they fit into a bigger picture for you?
I do think LLM's are making some genuine programmers less intelligent, but I think this type of person makes up a decent portion of its users too
If you care primarily about the quality of the end result, as opposed to being attached to a particular process of achieving it, then you're happy about how things have gone.
And I've seen exactly this across multiple large and small organizations in multiple countries, in addition to being all over here and the red site.
This is quite distinct from enjoyment.
Problem is, that you realise very quickly the asymmetry of responsibility and effort. There is far more to review from people who do not care enough to even look at what the agent pooped out.
I think the term "stake your reputation" is quite good for this situation. I.e. "hi new contributor, please acknowledge that you Stake Your Reputation before we move ahead with this code review".
(Doesn't help with legal aspects of course)
I wholly agree with your comment, but is it legally "your code"? Copyright is implicit at the moment of human creation. But there isn't yet settled law on AI-assisted creation.
So it might be a problem for projects to accept contributions where it's not clear who actually owns that work.
Literally irrelevant and I have no idea why people even bring this up constantly. Copyright is practically unenforceable in the software world, when was the last time you saw someone (a company or an individual) actually sue _and win_? Apple wasn't capable of stopping all the other phone manufacturers from directly cloning their product (despite having patents & copyright) so how can an individual? The only thing that matters is execution.
For instance, my repos are cloned like ~100/week by what I presume are bots and AI lab scrapers using them for training material. How am I supposed to even find out who's doing it, and if they're abiding by the licenses I provided? It's impossible.
Lastly, having copyright isn't the same thing as being allowed to commercialize the software (and I believe loads of people confuse the two). You can still sell public domain code, even if you don't have copyright over it.
Obviously some do it illegally but unenforceable is not the correct word to use.
If you drop the copyright claim you drop the protection of free software freedoms.
Corporations like Coca-Cola long ago figured out that begging people not to steal your ideas is a waste of time. If you don't want people using your ideas, then don't share them.
Dunno why so many programmers don't get this and seem perpetually butthurt that other programmers figured out the ultimate way for programmers to rip off each other's code.
Who would they be making the claim against? Well, considering the massive uptake of AI across the tech industry & beyond... approximately everyone.
Yes, the model companies are in the middle, but it's getting to the point where it seems a bit doubtful that claims will have any significant outcomes.
NYT might be able to get OpenAI to pay them for their content, but that's more of a financial tweak than a up-ending of industry.
I imagine few can afford a legal battle...
Free plan
Images generated on the Free plan are public and owned by Recraft
Had someone at $DAYJOB just shrug and say Claude messed up when I pointed out a sql injection in the code in their PR.
It became explicit policy at the company after that moment that blaming the AI is not an excuse for shoddy work.
It kind of is if the company mandates LLM use.
It is sort of sad that now programmers are suddenly expected to be perfect reviewers of code they didn't write.
Maintainers should quiz the submitters on the code and if they fail to answer reasonably the PR is dropped with the comment: "A.I. slop" and de submitter banned.
When you ask others that use AI frequently, the responsibility and understanding on what the agent wrote does not go away. You need to know what you are doing.
As soon as attackers are also using AI against your project, you have no choice but to use AI to protect yourself.
You’re also responsibility not to write crap PRs.
Sure there is. Contributing to open source is a privilege, not a right. Abuse it, and find yourself unwelcome as a future contributor
When I am at home practicing my musical instrument or learning to paint, those aren’t paid activities, so I can’t demand high standards for myself.
When Habitat for Humanity is looking for volunteers to do electrical and plumbing on homes, they have to allow unlicensed random folks do it.
This is not how life works at all.
The whole voting mechanism just exists as an elaborate dance that makes everyone keep their face, while the only sensible option wins.
A bureaucratic tarpit for bad ideas and emotions.
In a better world, none of this would be necessary, but we live in this world, and for that one, it's nice that someone engineered the system that way. Good job.
[1]: https://www.visidata.org/blog/2026/ai/#self-assessed-ai-leve...
Why would you trust the bot to self-assess truthfully?
That's like trusting a spammer to tag his emails as spam.
AI agents are grounded on the user provided direction. If it doesn't work well then it naturally loses trust.
I relate that to how a Physician's Assistant gets their authority to treat patients from the Doctor they work under. The Doctor's credentials are on the line if their PA screws up.
> What LLMs in Debian development will do, I fear, is eliminate any incentive to scrap boilerplate or reform policies that require a lot of other senseless human effort. If I had had access to LLMs 30 years ago, I might have just had them generate the rules files, replate with complexity. So they will make Debian even more firmly what it is, and ever less likely to explore what it could become.
I use and like LLMs, but it does feel like structural social changes are harder to do. For example, creation of new protocols. I hope I'm wrong, and LLMs are used to build collaborative, community projects - not just everyone vibe coding their own incompatible software.
And thus this will all bias towards complexity and fragility..
Aside from Bun, which is owned by Anthropic, do we know of open source projects that allow AI where this has happened?
Local models are going to be really important and hopefully computing costs don't make it too prohibitive.
Experts have been badly bitten by poorly written and badly architected software, lost their hairs trying to figure out bugs and poor design.
They recognize the first version of a piece of software is only a miniscule percentage of the work and majority of effort goes into maintenaning it for its lifetime.
They are viscerally horrified at a thousands of LoC codebase generated at the speed of GPU inference they are to be responsible for.
I don't believe they had a choice though, sticking to hand written code would be backwards and eventually meaningless as people would just submit generated code as "handwritten", the coding models are quickly becoming capable enough for this.
I wonder what it means copyright wise though. To what degree is the code even copyrightable if it's entirely generated, even if you review and provide feedback.
1. Companies will revert to closed-source and cease contributions to F/OSS projects. Their legal team will advise them that trade secrets are the only way to protect LLM-generated code.
2. Contributors to F/OSS projects, and developers who run them, will falsely claim authorship of the code written by LLMs.
There are significant societal impacts of this AI buildout. Some are concerned externalities weigh more heavily on the poor and marginalized. I think state wide data center holds are part of this civil discourse.
I'd prefer we have more conservative pollution standards along with a reasonable tax on AI use that helps mitigate externalities. That's hard. Reasonable people can have fierce disagreements on what market interventions are indicated, and how extensive they should be.
https://pbs.twimg.com/media/HQ5MeeaXUAAIMLX?format=jpg&name=...
Somewhat insulting to those that actually lived (or live) under fascism.
It's as though people want to find the most dubious of non-existent connections and use that as leverage to besmirch something they don't like.
There are many things one can do where a person has no awareness of the tenuous connection but where you can have someone go back and then ex-post make that connection and declare that thing or person racist. It's a tactic.
Like one _could_ make the argument that factory automation in China is racist because without automation they would have to import labor from (some non-Chinese population). However, the Chinese never began automation with the intention of being racist.
I'm beginning to wonder if it might be the case that when my fellow citizens begin to act insane - might it be the result of foreign propaganda.
When attackers are using AI to both find vulnerabilities and build exploits faster than Debian can figure out how to patch the project without AI, you are saying Debian should not move quicker to fix these issues?
This will turn to shit because laziness will take over and comprehension will fall as a consequence of that. Junior will "contribute" and the seniors will eventually become too lazy to care. What's next... vibecoding airline ADA code. Save me lord jesus christ.
While doomscrolling HN right now, I have an agent crunching away at figuring out how to build a flashable TWRP ZIP file, because I could not care less about such android specifics.
Such use-cases would be blanket banned by some of the harsher options, forcing people to do stuff they have no interest in doing, for reasons that are at best well-meaning.
Which, in something volunteer-driven, is not necessarily a good idea, because if you're not allowed to do the work in the way you'd like to, you might just stop doing it altogether.
That said, if your work ends up shit, you still shall get shat on. Simple as that.
Quite. Of the two different common meanings, I reckon:
"The use of a generative AI tool does not diminish the contributor's responsibility for the work they submit."
will be true in the sense of "Who the hell is responsible for this mess?"
This is democracy in action. A fair and square vote and look at how well it works with no core BDFL to force in their opinions.
Maybe someday we'll have direct democracy paired with voting certification for specific issues.
How absurdly naive.
https://www.cnbc.com/2025/04/29/satya-nadella-says-as-much-a...
Note that he said written by, not assisted; and also that there's been some major QA issues with win11 the last year, enough for Microsoft to have made a public apology/commitment to improve...
So, no definitive evidence, but the rest of the breadcrumbs provide enough to say that yes it does appear to have suffered from it.
Given the Debian policy seems more geared towards aided/assisted an existing dev than replacing them and shipping because the code works on the golden path on a devs monster pc ... Well I'd still keep an eye on it but trust OSS OS engineers to have some competence at knowing if this works and adjusting the policy later if it proved to be wrong.
Repeatedly.
You are right that's one or the other. Probably both are contributing.
The rumor is the opposite, that Microsoft has actually used AI to discover and fix common security issues at scale.
Your appsec engineers will be the ones bug hunting with Mythos or whatever. Your regular engineers will be the ones implementing features. If the feature is a bad design and functions badly as a result, that is entirely orthogonal to whether it contains coding errors or bugs.
Also, there are bugs on the integration side that won't be caught running Mythos against source code, because it's not a source code issue. Even using Mythos for DAST is going to be very limited compared to how actual users will move through something as complex as a 'mature' OS like Windows.
the entire industry is experiencing this as model capacity increases. How does "all projects get critical security fixes now" relate to "crap apps and loopy services by literally millions of lines of slop code" ?