IMO one of the major problems with LLm code generation is that it has the capacity to overwhelm human capacity to review code and properly understand the codebase.

From that perspective, a prohibitive policy doesn't have to be 100% effective to be useful, it just needs to slow things down enough to keep the manageable and maintainable (and fun to work on).

Some people will absolutely lie, but I suspect most contributors will respect the rules, and ultimately cut down on AI PRs overall, as those AI contributors switch to projects who are pro-AI.

There's no need to excise anything unless you specifically let an agent create a commit. No need for pre-push hooks.

I think KDEs policy is quite rational, it's a compromise and still clearly anti-vibe coding. IMO the problems are overstated

The issue for now is LLM generation of code, not code auditing.

And no, I don't give a fuck whether some genius in theory could paint s new Mona Lisa with it. The issue us how it is used in practice, most of the time, today. At $WORK, I have a severely ai-pilled Senior Embedded Software Architect which hasnt managed in one and a half year to set up a working driver for a RS232-controlled stepper motor, from a port of previously working code. A thing that should take a week at most. I had to educate him that in C++ drivers, you need to use locks or mutexes to access variables that are concurrently changed and read from several threads. AI enables catastrophic levels of incompetence.

And FOSS projects need to protect themselves against that.

Have to think about this in an open source context. You have an open ended population ready to submit to your project if they think they can be useful

Now, thanks to GenAI, a bunch of people who aren't good at various things now thinks they are good at various things. Whether it's coding, making comics, making videos, what have you. Try to do nuance even if it strictly makes sense, and you are stuck with the slop problem if your project is sufficiently popular.

In terms of more directly on your points, if someone does GenAI to do a security analysis, ok, but I'd want them to do the tedium of trying to identify the false positives and then re-report it in their words of actual understanding. It can catch things, but along the way makes a haystack of sillyness to go through. Same for code review, legitimate issues, but lots of missing (I spent a non trivial amount of time yesterday because a GenAI code review insisted a variable would be unitialized when referenced, when I see an uncoditional assignment just a few lines above, trying to think if there was some catch I wasn't seeing). So indirectly using it and only subjecting the developer/maintainer to that which you know makes sense.

Problem being is that people have used Claude and have forwarded to me saying "I don't understand this well enough to judge, but forwarding to you just in case". I have the same tools doing the same things as you, I don't need meat proxies that just pass through the stuff without understanding.

As a retired senior programmer, I would have loved to use LLMs in the past for very specific things. I wouldn't use it every day, but like every couple of months I had to do a massive refactor that took weeks to complete. I usually ended up writing codemod and just painfully changing tens of thousands of lines of code. Would be cool to just say "hey LLM, see how I did this one? Do the same thing everywhere else you find it. If you encounter anything that's too different from my template just leave it for me to review"

If it turns out that it gets ruled as copyright violations, you can bet your ass they're going to reform copyright law instead of rolling everything back.

I don't disagree that it is a risk, and I am trying to move toward projects that do have err on the side of avoiding that risk. I have NetBSD on my laptop, and when I get a little more comfortable with it, I intend to convert the other Linux installations I maintain.

BUT, I believe the BSDs already went through a situation where some of their source was possibly under restrictive copyright and rather than "rolling back", they "simply" identified the possibly infringing code and re-wrote those sections to have the same function (which can't be copyrighted) without sharing any creative expression (which is). So, even the projects that are taking the risk that an LLM (or other generative AI) generates infringing code might not have quite as much cleanup / lost effort as you describe.

Also, LLM out isn't automatically a derivative work of the training data. I'd have to dig through some other messages to find an exact quote from their documents, but I believe they (EDIT: the U.S. copyright office) said only output that is "significantly similar" to training data is potentially infringing. That does further limit the risk.

I still think it's too high of a risk because well-meaning contributors might incorrectly introduce infringing code, since for models that don't disclose their training data (Claude, Copilot, Gemini, etc.) even dedicated contributors don't have the information they need to discover the output is infringing. In that past, that result (introducing infringing code) was generally limited to the acts of malicious actors that are submitting code they know to be infringing to poison a project and open it to legal action.

But, I can't ask that someone (i.e. a project maintainer) substitute my risk/reward judgement for theirs, and I have no experience maintaining a large project. All of my code contributions are to either projects others maintain, or my own hobby projects that I doubt have any users other than myself (and I don't even use all the published/available ones anymore).

Even if you don't disclose it it's immediately obvious to anyone with a brain that you haven't worked at all on it.

Me interrogating the linux source code: "Describe in single words only the good things that come into your mind about... your mother."

Cosmic supports both Tiling and Floating modes. The floating mode is normal, and the Tiling is slightly less customisable than pure tiling window managers but it's pretty good while staying accessible which is what matters.

I don't begrudge Cosmic or anything, it's just not what I want. I'm glad it exists.

KDE 4 was the TRULY bad release, if I recall correctly. It was a massive change from 3 and reduction in features and stability. I actually noped back over to Windows for a while as a result. I remember 5 being a welcome return to form comparatively.

EDIT: From the wikipedia Article on KDE4, oof:

KDE 4.0 was released in January 2008. Linux.com described the reaction from users as a "revolt", writing that the backlash KDE 4.0 received was on a scale that was unprecedented for a FOSS project. Although it was a developer's release, several distributions made the KDE 4.0 desktop environment available to their users without specifying that it was an experimental option. openSUSE released a more polished KDE 4 option while other distributions "released packages that simply [didn't] work," according to project leader Aaron Seigo. As a result, many users complained about the loss of features and stability. A number of KDE developers, including project leader Aaron Seigo, were targeted for abuse by outlets like Linux Hater's Blog. Several KDE developers stepped back from the public scrutiny.[36]

they released the first non-testing version of their new DE too soon.

This was the only issue I had with Cosmic. I don't know what the current state of the DE is these days, but surely they've fleshed out some bugs by now.

Also, cosmic-text is an amazing gift to the world, for what that's worth. Doesn't really justify using the DE, but that library is amazing.