At first I was afraid that they would allow for an irresponsible use. But no, they explicitly say “responsible”, so that danger is no more. I’m very much relieved.
Also they explicitly mention that humans will remain accountable. Not Nature, or Fate, or the gods; mark that. Good thinking there!
Problems solved.
They basically pass the buck to the individual developer without taking any responsibility themselves.
Debian acknowledges that the legal status of material produced by generative AI systems remains the subject of ongoing discussion in many jurisdictions, including questions relating to copyright, authorship, licensing, and potential reproduction of training material.
The responsibility for every contribution rests with the contributor who submits it, who remains accountable for its technical quality, legal acceptability, and suitability for inclusion in Debian.
“It may be illegal or against FOSS, but that’s up to you to decide, good luck I guess”
The only question I have is why. Genuinely.
Debian exists. It has existed for decades. It works. “Oh but AI makes it faster” so fucking what? We didn’t need “faster” for years whilst it worked fine, it’s not a product on a deadline.
That’s true. Nonetheless the maintainers seem to see AI as a valid way to reduce their workload.
i’m actually a little surprised, given their history about being so hardcore about dfsg compliance.
This email from 2016 by jwz springs to mind.
I guess you want Debian to be the kind of operation that uses the work of others while blatantly and explicitly ignoring the wishes of the person who did the actual creative work.
I am increasingly of the opinion that all software developers and adjacent people are fucking scum unless proven otherwise.
as a dev I second this opinion.
I was surprised by how many were Trump supporters.
then I was surprised at how many were anti-vax.
now I’m not even surprised.
boooo
Dammit. Need to find a new OS.
I love Debian. An ol’ rock ballad from the 90s
AI may be the one thing in life I find hard to boycott lmao.
This is good news; Debian is still the way to go for me:
Debian acknowledges that the legal status of material produced by generative AI systems remains the subject of ongoing discussion in many jurisdictions, including questions relating to copyright, authorship, licensing, and potential reproduction of training material. The Project does not seek to resolve these unsettled legal questions through this General Resolution, nor does it adopt a position on whether AI-generated output is, in whole or in part, copyrightable or derived from copyrighted works.
Responsible use of llms can’t be achieved. Can you verify that all of your training data are square with its creators? If not, how is that responsible?
It can if you control the training data, or if the data is public domain.
But I get your point. You can say all the Diamonds you use are conflict free, but out of the thousands you have, how do you know some have not slipped in.
At what point do you say you did a good enough job, and at what point is it too contaminated?
Like many things, it difficult to draw a line, so its up to communities to set a reasonable standard.
how about making an effort in the first place? to at least make an effort to list all repository thats being used as training data.
Can you verify that it didn’t reproduce any code that’s proprietary or has more restrictive licenses than your own?
That’s the main issue for FOSS.
The complement/ reverse is true for companies that produce proprietary software (but they won’t care, sure.)
Code should’ve never been copyrightable from the start. It’s basically the compute equivalent of a recipe. That aside, almost all modern transformer models are trained on generated data by this point, how would we even apply traditional copyright to that? Whole thing needs tossed and retooled. Entire economic system with it tbh, just slows innovation, and despite what you might believe it doesn’t protect the little guy, it just allows massive corporate conglomerates to buy up everything and control for what will be pretty much the extent of your lifetime.
algorithms and processes are not copyrightable. Code is an expression of algorithms, and thus is copyrightable. If anything, that’s the stance that the entire movements of Free Software and Open Source are going with to function, so this sounds not a good idea even if it is a good ideal.
They’re moving to this as it’s the only defense against oppression, but copy left was intentionally designed to combat copyright because the core founders of open source disagreed with it and the oppression it was causing in the software development community. Imagine if a recipe for Chilli dogs was copyrightable, but not the concept of Chilli dogs. That’s downright silly.
A more fair comparison would be written works being copyright-able, which code is a written work, a large, expressive, written work
I disagree. I would say both are incomplete comparisons because code is special, it has limitations, it relies on underlying hardware support, and it’s implementing, generally, functionality not anything creative. I don’t have to present a good solution though in order to point out something is broken, I leave that for those more intelligent than I, but copyright is objectively a poor answer to code and is not comparable to an expressive artistic written work.
Coding is a creative task, there are many many many solutions to any problem, and some problems are a lot more abstract to where even the problem can be different for different people. Like if there’s a problem with the users interacting with part of the software, you could try to make it easier to interact with, have a little tutorial, decorate it, make it look good, you know, a form of art, you could also try to make it more intuitive, also a form of art. It’s not typically what you’d think about, but coding is a rather creative task and everyone has different ways to go about problems, and those different ways are the different styles of programming people have.
Coding isn’t creative though. There’s an optimum solution to every problem, the layer above the code may be some form of art that needs protected but the code itself is just a recipe.
Code is rather expressive, it’s copyright-able for good reason, you can often tell who wrote what via the style and the way the code was written, and the methods used.
I disagree entirely. I grew up when the conversation around if code should even be copyrightable was happening, and at the time to an extent it made some sense, but the entire copy left movement was intended to combat the copyright of code in the name of open source because copy righting code is both stupid and baseless. Imagine if for loops were copyrighted? That’s what you’re essentially arguing unless there’s some sort of vague subjective measure you’re using to determine when something is copyrightable. The entire thing is just oppressive and does not help the people involved that actually deserve benefit and protection. I’m not saying to cut lose and allow rampant theft but copyright as currently designed and implemented is objectively broken and untooled to the tasks of today, stifling innovation and protecting corporate interests above creators and actual developers.
Copyleft is a form of copyright, if you’re against copyright that’s MIT/BSD 0 clause. Also languages aren’t typically copyrighted, it’s works created within those languages. Although I do agree copyright is kinda very broken, but creators of code do deserve protections, as code is very expressive. I am also a FOSS dev who loves copyleft, which only functions under copyright.
In a nutshell, it looks like AI disclosures are encouraged, but not required, and AI usage is encouraged to be human reviewed, but not required. They have also stated they will not allow the use of online AI services for security reasons (but how this will be enforced I’m not sure, since they are relying on the judgement of contributors)
No online services? So you can use AI to generate code, but only garbage local AIs (assuming you don’t have a ton of RAM)?
This seems like the weakest possible decision they could’ve made.
It’s open source software. I’m not saying security isn’t a concern, but this is just stupid.
If you’re not going to ban AI then you should at least take advantage of models that are more reliable and produce higher quality output.
I mean the best local models are only a few months behind the the best proprietary cloud models. Just look at Qwen 3.8 Flash or 27B. Imo local models are more than sufficient if you’re going to use AI for programming. Who cares if the small model can’t oneshot the whole patch, you shouldn’t be submitting raw LLM code to public repos anyway. Imo the only acceptable use of LLMs for coding is as a way of rapidly prototyping ideas that you will later mostly/entirely rewrite by hand, or as an extra static analysis tool for finding potential security holes.
And as someone who frankly doesn’t give a shit about intellectual property over code, my main ethical issue with LLMs is the monstrous resource consumption of hyperscale datacenters, so local models are strongly preferable. Also for privacy reasons.
They’re getting better fast
https://www.xda-developers.com/qwen-3-8-27b-reverse-engineering-job-frontier-model/
Still unreliable for tasks which aren’t easy to validate in code, though
It looks like their point is that they don’t want Debian’s codebase to be used to train corporate AI models, and almost all the proposals seem to agree on that at the very least. I feel like a required AI disclosure would have been better, but what do I know, I’m not a Debian contributor
You are not supposed to use online LLMs for undisclosed security stuff; there is no general ban of online services if you can take responsibility for the stuff it produces for the contributor. At least, this is how I read the general resolution.
This is one more reason, that using Debian as my main distro was a good choice.
Ah my bad, that makes more sense.
This is like saying “Responsible use of highly infectious diseases.”
Like… In research for vaccines?
Ohh you mean like the prize winning Folding project that google just shut down so that they could reassign all the staff to work on Gemini instead?
The project that reached its goals and is the basis for new projects? Yeah
Lmfao
This bro doesn’t understand AI, protein folding, or code at all but speaks as an authority on it all.
Great example. It’s good for that, it must be good universally, so let’s use it for everything. Let’s force people to use it for everything, because it has one legitimate and specific use case scenario.
Yeah, let’s use infectious diseases for socialising with people.
Cough on the face of the person you want to say hello to… Wait… People already do that.
Yikes, rest in peace Deb users. I just hope it never happens to my distro.
if your distro uses the linux kernel then its already happened.
This vote was not about upstream projects included in the Debian distro, it was about the Debian project itself.
i didnt say it was. the guy i was responding too wasnt talking abput debian but whatever distro he uses. implying it was free of any ai assisted code.
Thankfully, Arch based distros allow you to install any of a variety of supported kernels and even has instructions on many unofficial kernels, as Linus stated: “if you don’t like it you can fork it”.
Also, your response comes off as pretty sloppy and defeatist.
What is the AI policy of Arch? I ask because I was unable to find any explicit policy for the project
its not defeatist, i just dont give a shit.
I ain’t shook up about it. There’s not really a surefire way to detect tool-assisted code gen anyway, so IMO the acceptance criteria should be the same as it’s always been, tool-assisted or otherwise. Which is ultimately the path they chose to take.
Obvious slop should be immediate permanently banworthy, sloppers can just keep burning new accounts (as long as they have access to new IP addresses) while real developers deserving of praise and reputation thrive.
sloppers can just keep burning new accounts (as long as they have access to new IP addresses) while real developers deserving of praise and reputation thrive.
Becoming a Debian developer requires you to meet an existing Debian developer in person and have your public key signed by them. It’s not possible to keep burning new accounts unless you go and meet a different Debian developer each time and there’s a limited number of them in each region and they usually meet together, so more than one person will see your face.
Yep. I’m not familiar with Debian’s strategy specifically, but generally, I think any new contributor to a project should be subject to heightened scrutiny. My policy is that new contributors should start small and develop a rapport with the maintainers before submitting more ambitious (and for the maintainers, more costly to review) large and/or critical path PRs. It was a good policy before LLMs and I think it remains a pretty robust method of weeding out irresponsible devs without wasting a ton of maintainer time. There are simply more slop PRs to reject sight unseen these days, which is admittedly very annoying, but the process is much the same as it’s always been.
I’ll admit I don’t maintain any projects anywhere near the popularity or volume of the Debian project, so I’m not really sure what the view is from their vantage point.
I still think that’s not good enough, that treating them fairly is a stupid waste of time and resources and unfair to everyone else.
Just make the rule “any slop” and give the idiots a checkbox so they can ban themselves for reasons which will never be revealed to them (sloppers don’t read documents, it’ll take them a while to figure out). Also start banning people when evidence surfaces of them admitting to slopping.
I don’t like this concept that a slopper can potentially produce decent code, the data shows this simply isn’t true: sloppers produce vast amounts more and worse bugs and vulnerabilities. It’s better for the health of the project to ban it in every scenario.
How is treating one contributor fairly unfair to another contributor? If you want to add a “check this box to get your PR dumpster’d” checkbox I guess go nuts, but I’m unconvinced that’s a good long-term solution. I find it easier to ask “Do I know this contributor, or did they follow the new contributor guidelines and submit a small, single-issue PR?”, and if the answer is “no” then the PR gets ignored or, if I’m feeling gregarious and have the time, rejected with change requests. It’s a pretty easy rubric.
Humans have been perfectly capable of generating huge volumes of trash code, and code that looks good at first glance but has tricky bugs or vulnerabilities, since long before LLMs were a thing. The only real change now is the pace at which shitty code can be ripped out. IMO the solution is just: don’t accept more code than you can review and test. If that means rejecting 10x or 100x more LoC than you did five years ago, then… ok. It is more busy work, and it is annoying. But I don’t think trusting contributors to self-declare LLM use is an answer to the problem. There are better ways of rate-limiting eager beavers, regardless of what tools they use.
How is treating one contributor fairly unfair to another contributor?
Because sloppers do not actually do the work and in the vast majority of cases are not even capable of doing so. A slopper can produce 10 worthless products in the time a person can produce 1 good product.
for fuck sakes; stop pretending the csam generating machine is useful.
Imagine calling AI “the csam generating machine” but not cameras.
Just because you could not find a use for it, does not mean millions of other people have not.
Just like any technology. you can use it responsibly or irresponsibly.
There is no way (in this world that we have created) to use AI “responsibly”. No matter what you choose, you are building on the base of wage theft, human suffering, environmental destruction and empowerment of the oligarchies.
AI is not “like any other technology”. That’s techbro acceleracionist slopaganda.
Would you say the same of electricity? There is no way to use it responsibly because its all based on exploitative resource extraction?
Please, try at least some modicum of intellectual discourse. Electricity is quite a physical phenomenon of nature, like rain, we can not impart moral judgment on them.
All that said, there are ways to use electricity without “exploitative resource extraction”, for example with a potato.
You need to divorce your thinking of AI as a current prominent manifestation of the capitalistic black hole and the technology itself. Before that is was Crypto. Before that it was cloud, before that it was property derivatives. Capitalism will just hijack anything where they can extract value from the quickest.
AI as a technology is very much real and very much physical, it follows the same physical rules that everything else is. Denying that is like saying steam power is not real because you can’t see the force pushing.
AI has been around for 50 years now. Its driven much of engineering progress in the 70s and 80s, our chemical and biological research in the 90s and physics in the 2000s.
The current large language learning models are just a next progression of this technological trend.
Remember absolutism is toxic.
if people are finding use for a csam generating machine, i hope they get a visit from the fbi
I take it you think the only use for a microwave is to cook babies?
