219
Debian Votes To Allow "Responsible Use Of Generative AI" (www.phoronix.com)
submitted 1 month ago by to c/linux@lemmy.ml
103 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 68 points 1 month ago (29 children)

Contributors are expected to understand, review, test, and, where appropriate, modify AI-assisted output before incorporating it into Debian. Blindly accepting or uploading AI-generated material without appropriate human review is inconsistent with Debian's established development practices. We [encourage] our contributors to disclose whether a contribution was made with AI [assistance], but do not require them to do so.

  • permalink
  • fedilink
  • source
  • hideshow 29 child comments
    •
  • [–] 70 points 1 month ago (24 children)

    That last bit is a bad idea

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 24 child comments
    •
  • [–] 37 points 1 month ago* (15 children)

    I agree. Disclosure of A.I. use should be mandatory.

    My main concern with A.I. use is its ability to hide incompetence. If a new agent introduces code that was entirely written by illegal-software that violates copyright law--A.I.--then that should be made clear, even if competent-programmers review the new inclusion and approve of it. Otherwise people are left with the impression that this new agent is a competent programmer. A.I. use--undisclosed--creates false reputations.

    The disclosure being encouraged and not mandatory is purely to protect the egos of programmers currently utilizing A.I. products.

    However I do respect their decision and I maintain projects should be self governing.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 15 child comments
    •
  • [–] 14 points 1 month ago (12 children)

    I disagree. For one, it's unenforceable, just like outright banning it.

    But AI assistance can also mean a lot of different things, from outright vibecoding through autocomplete up to only asking it to so review. It diminishes the human work in the eyes of other people, because a simple disclaimer doesn't distinguish between the work done, and also encourages people to point out to AI as a scapegoat for their mistakes.

    Good code always was and should always be one where a human is fully responsible for it; if you decide to vibecode and happens to end up with perfect code, good; if you write it fully yourself but it's crap it doesn't absolve you that you didn't use AI...

    It's a tool, so use it responsibly like any other tool and stand behind your code no matter what tools you used.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 12 child comments
    •
  • [–] 9 points 1 month ago (5 children)

    I disagree. For one, it's unenforceable, just like outright banning it.

    If people thought "its impossible to catch everyone so why bother trying to catch anyone at all" when making laws, no laws would exist

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 5 points 1 month ago

    But the issue is that in practise, there is no viable way to verify wether or not AI has been used at all. In other words, the disclosure of AI use entirely depends on the person providing the code, wether disclosure is mandated or not.

    If there was enforcment to disclose AI use, it would create a false assumption that code which claims no AI use, is verified to contain mo AI use, which again, cannot be verified by anyone.

    So it's not that it's hard to enforce, it's not that it's impossible to enforce 100%, it's that there currently is no viable way to enforce it at all.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 4 points 1 month ago (2 children)

    There's a difference between "not being able to catch everyone" and having effectively no way to catch anyone.

    And yes, unfortunately there are plenty of laws with the same issue (especially here and in the past decade or two) and it sucks - it only teaches people to ignore rules and a lot of them make you a criminal for no reason.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 6 points 1 month ago (1 child)
  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 4 points 1 month ago

    look at visual studio's Intellisense and compare it to the last version that didn't advertise Ai, there aren't that many functional differences and if you don't keep up with the marketing you could very easily miss that it is Ai powered.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 4 points 1 month ago

    I disagree. For one, it's unenforceable, just like outright banning it.

    Agreed. I an aware a lot of people contributed to the Linux kernel, without disclosing they used ai.

    Good code always was and should always be one where a human is fully responsible for it; if you decide to vibecode and happens to end up with perfect code, good; if you write it fully yourself but it's crap it doesn't absolve you that you didn't use AI...

    Yeah. I do not blame the ai for writing the code, but rather the person to accept and push that code even if they know it is crap.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 0 points 1 month ago (2 children)

    because a simple disclaimer doesn’t distinguish between the work done,

    So just declare how you used the tool?

    and also encourages people to point out to AI as a scapegoat for their mistakes.

    Nonsense. Doing so is clearly abdicating the responsibility that you're saying people need to have, and basically admitting you're a bad developer.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 1 month ago (1 child)

    So just declare how you used the tool?

    That can quickly get complicated, and more importantly noone does that.

    People who want to do it generally. Just call for a "metadata tag" in the commit.

    The thing is, what are you actually trying to achieve with this disclosure? How does it help you?

    If you're going to treat AI assisted code the same way you treat human code (with a ton of scrutiny - which you absolutely should), then what is the point?

    Do you also want to know what IDE was used, which autocomplete engine, or what OS?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 0 points 1 month ago

    GenAI replaces a lot of thinking. It is not on the same scale as those other tools. With an LLM, I can easily submit big chunk of code that does a thing, without understanding anything about how or why it does it. That's not possible with just an IDE. Writing is a form of thinking that gives a much deeper unserstanding than reading and you dont get that with an LLM. That thought-bypass can rapidly become a maintainability issue, and increases the risk of major bugs going undetected.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 7 points 1 month ago

    I do respect their decision and I maintain projects should be self governing.

    Me too, but I also think that governance isn't as simple as "we get to decide what we do", it also interacts with how well the decision-makers understand their domain and their broader it sits in, both of which are potentially reduced as a consequence of relying on AI.

    Also there is the possibility of AI tools dominating workflows and then getting ripped away (either as the corporates raise costs, or the bubble bursts and they collapse), leaving a project overwhelmed with a unmanageably large array of weaknesses. In that scenario self-governance starts to become irrelevant.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 3 points 1 month ago

    My main concern with A.I. use is its ability to hide incompetence.

    You mean like tab-completion in modern IDEs? Shouldn't devs know all the function calls and methods of the standard libraries of the language they're programming in?

  • permalink
  • fedilink
  • source
  • parent
  • [–] 5 points 1 month ago (7 children)

    Not at all, because it's impossible to know for sure if committed code had some form of AI generated parts, AI assisted review, prototyping, etc.

    By making it mandatory you can potentially alienate good developers who may feel their work ethics would be scrutinized negatively (like in these comments).

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 7 child comments
    •
  • [–] 8 points 1 month ago (6 children)

    If you're happy to use AI tools to develop, why would you not be happy to declare your use of those tools?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 1 point 1 month ago (4 children)

    "Happy" is an odd choice of words here.

    An LLM is just a tool. Some iterations have some value in some circumstances. In those cases it's fine. But look around at the comments here and you'll see many people basically accusing Debian of selling out. If a dev sees that reaction then they may not want to disclose their own use of LLMs.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 5 points 1 month ago (1 child)

    Why would you not want to disclose though? Is it because of shame? Because you are unable to defend your choice? If it's "just a tool", is that not enough to defend your choice?

    To be clear: the alternative policy we're talking about isn't "LLMs are bad, don't use them", it's "Let us know when you are using LLMs"

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 7 points 1 month ago (2 children)

    And how are they (Debian) going to to make sure this happens?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 1 month ago

    When people do code review off a pull request and sees it’s slop, it will go back to the developer to fix it. I guess if a person submit too much slop, they will get banned or something similar.

    However, I don’t know the Debian process to have new code submitted, but would guess that it have to be more than one person to go from code to build a package.

  • permalink
  • fedilink
  • source
  • parent