There is no such thing as “responsible use of GenAI”. That said, I understand the decision in the face of even Linus Torvalds allowing AI-generated code into the kernel. If Debian would have banned AI code entirely they would have had to fork every single thing they include in their distro, wipe the AI code from it, and then work to develop it further themselves. It would be too gargantuan a task.
None of the proposals would have banned AI usage in upstream projects, but banning AI usage in the context of the Debian project was on the table
At first I was afraid that they would allow for an irresponsible use. But no, they explicitly say “responsible”, so that danger is no more. I’m very much relieved.
Also they explicitly mention that humans will remain accountable. Not Nature, or Fate, or the gods; mark that. Good thinking there!
Problems solved.
They basically pass the buck to the individual developer without taking any responsibility themselves.
Debian acknowledges that the legal status of material produced by generative AI systems remains the subject of ongoing discussion in many jurisdictions, including questions relating to copyright, authorship, licensing, and potential reproduction of training material.
The responsibility for every contribution rests with the contributor who submits it, who remains accountable for its technical quality, legal acceptability, and suitability for inclusion in Debian.
“It may be illegal or against FOSS, but that’s up to you to decide, good luck I guess”
The only question I have is why. Genuinely.
Debian exists. It has existed for decades. It works. “Oh but AI makes it faster” so fucking what? We didn’t need “faster” for years whilst it worked fine, it’s not a product on a deadline.
No community distro has the capacity to fork thousands of packages and maintain them. That’s what a true no Ai policy would require. I also have to add that the Linux kernel itself would need to be forked and then maintained. Just the latter point alone is enough to make all this moot.
No this was for Debian only.
Completely missing the point.
That’s true. Nonetheless the maintainers seem to see AI as a valid way to reduce their workload.
As someone who has done package management for a distro at one point in my life… after the initial push, it is so incredibly boring.
I think AI should do all of it. I’m entirely certain that things would be better, not worse, if we did. 99% of problems related to that stuff is because it’s so fucking boring that humans just simply cannot pay the kind of attention it requires to be safe.
Current AI is still like that incredibly knowledgeable senior dev with a drug problem. Everything done by AI still needs to be checked by a human in case the AI just hallucinated the wildest shit even though it did the same thing just right ten times before.
Right now, AI is a great tool. It will probably become reliable enough to replace human maintainers. But no one knows when that happens.
Good thing I don’t use debian.
This email from 2016 by jwz springs to mind.
I guess you want Debian to be the kind of operation that uses the work of others while blatantly and explicitly ignoring the wishes of the person who did the actual creative work.
I am increasingly of the opinion that all software developers and adjacent people are fucking scum unless proven otherwise.
Oh no, the people creating free shit for you to use that’s not monetized in any way, want to reduce their workloads. Scum!
You mean the work that that nobody is forcing them to do? The one they do by their own choice while not asking consent and respecting the wishes of others? Yep those devs sound pretty fucking scummy to me.
as a dev I second this opinion.
I was surprised by how many were Trump supporters.
then I was surprised at how many were anti-vax.
now I’m not even surprised.
This is good news; Debian is still the way to go for me:
Debian acknowledges that the legal status of material produced by generative AI systems remains the subject of ongoing discussion in many jurisdictions, including questions relating to copyright, authorship, licensing, and potential reproduction of training material. The Project does not seek to resolve these unsettled legal questions through this General Resolution, nor does it adopt a position on whether AI-generated output is, in whole or in part, copyrightable or derived from copyrighted works.
In a nutshell, it looks like AI disclosures are encouraged, but not required, and AI usage is encouraged to be human reviewed, but not required. They have also stated they will not allow the use of online AI services for security reasons (but how this will be enforced I’m not sure, since they are relying on the judgement of contributors)
No online services? So you can use AI to generate code, but only garbage local AIs (assuming you don’t have a ton of RAM)?
This seems like the weakest possible decision they could’ve made.
It’s open source software. I’m not saying security isn’t a concern, but this is just stupid.
If you’re not going to ban AI then you should at least take advantage of models that are more reliable and produce higher quality output.
It looks like their point is that they don’t want Debian’s codebase to be used to train corporate AI models, and almost all the proposals seem to agree on that at the very least. I feel like a required AI disclosure would have been better, but what do I know, I’m not a Debian contributor
I mean the best local models are only a few months behind the the best proprietary cloud models. Just look at Qwen 3.8 Flash or 27B. Imo local models are more than sufficient if you’re going to use AI for programming. Who cares if the small model can’t oneshot the whole patch, you shouldn’t be submitting raw LLM code to public repos anyway. Imo the only acceptable use of LLMs for coding is as a way of rapidly prototyping ideas that you will later mostly/entirely rewrite by hand, or as an extra static analysis tool for finding potential security holes.
And as someone who frankly doesn’t give a shit about intellectual property over code, my main ethical issue with LLMs is the monstrous resource consumption of hyperscale datacenters, so local models are strongly preferable. Also for privacy reasons.
You are not supposed to use online LLMs for undisclosed security stuff; there is no general ban of online services if you can take responsibility for the stuff it produces for the contributor. At least, this is how I read the general resolution.
This is one more reason, that using Debian as my main distro was a good choice.
Ah my bad, that makes more sense.
They’re getting better fast
https://www.xda-developers.com/qwen-3-8-27b-reverse-engineering-job-frontier-model/
Still unreliable for tasks which aren’t easy to validate in code, though
boooo
I love Debian. An ol’ rock ballad from the 90s
Dammit. Need to find a new OS.
Linus Torvalds has stated a similar policy for the Linux kernel. If you’re really serious about avoiding the power loom, you have to change the kernel too.
If you want to avoid ai assisted code your only chance is to build a new OS with a new kernel yourself.
True. I’m really not happy with the avalanche of dogshit produced by “AI” though. Maybe I need to find a new hobby.
AI may be the one thing in life I find hard to boycott lmao.
This is like saying “Responsible use of highly infectious diseases.”
Like… In research for vaccines?
Ohh you mean like the prize winning Folding project that google just shut down so that they could reassign all the staff to work on Gemini instead?
The project that reached its goals and is the basis for new projects? Yeah
Lmfao
This bro doesn’t understand AI, protein folding, or code at all but speaks as an authority on it all.
Their model for folding proteins worked, is complete and access is given freely to researchers for use. I’m not sure what you think they should be working on now, are the people who made it supposed to just never move on to new projects?
Notice how they’ve provided access to 200 million protein predictions in the human proteome and various plants?
Does that sound like it has completed prediction for proteomes of all life on earth?
Does it ever say it is complete even if only for humans?
Does it ever say the workers on the project had verified the validity of even a fraction of the predictions or discovered application of the findings?
It wasn’t “finished”, it was shut down and the employees reassigned to work on a project that produvesw nothing but worthless slop images and texts, buggy code, and occasionally deletes a database.
Great example. It’s good for that, it must be good universally, so let’s use it for everything. Let’s force people to use it for everything, because it has one legitimate and specific use case scenario.
Yeah, let’s use infectious diseases for socialising with people.
Cough on the face of the person you want to say hello to… Wait… People already do that.
Sanity won imo. We can argue all day about what responsible Ai use is, but distro projects without allowing AI use at all and are serious about it are dead in the water. What were they supposed to d do? Disconnect with upstream?
What were they supposed to d do? Disconnect with upstream?
Use non-slopified alternatives. There are lists such as Open Slopware that document where to get alternatives.
Or just fork the last non-slopified version and work from there. For already-mature software, should not make that much difference in the short term for a distro that seeks out stable long-term behaviour (things would be vastly different if this was Arch).
Yep. There is a middle ground with generative AI and they’ve struck the right balance.
Nooo, you see chosing utilitarian position is a sin.
There are more kernel forks every day, fuck the sloppers. From where I’m sitting the slop distros which allow or even rely on AI are sick with a cancer and doomed.
None of the proposals would have banned AI usage in upstream projects:
It’s not like the Debian policy teams have the power do that to remote dev teams anyway tho. At best they can discard an upstream done with AI.
“wah, they dead in the water if they ban the slop theft machine!”
I don’t fundamentally disagree with the sentiment, but local models are mostly benign as long as you actually understand the code you’re submitting and rewrite it to remove the slop portions. Plus prohibiting it entirely just means people will lie about using LLMs. I do think Debian should have mandated people disclose whether/how AI was used for any given commit tho
What about prohibiting people from looking at the leaked windows source code? It just encourages people to lie about it.
I don’t care if people look at the leaked Windows source code, frankly they should lie about doing so to avoid being sued. I don’t understand what your point is supposed to be.
Should wine ban it though, it just encourages people to lie 3:
Responsible use of llms can’t be achieved. Can you verify that all of your training data are square with its creators? If not, how is that responsible?
Can you verify that it didn’t reproduce any code that’s proprietary or has more restrictive licenses than your own?
That’s the main issue for FOSS.
The complement/ reverse is true for companies that produce proprietary software (but they won’t care, sure.)
It can if you control the training data, or if the data is public domain.
But I get your point. You can say all the Diamonds you use are conflict free, but out of the thousands you have, how do you know some have not slipped in.
At what point do you say you did a good enough job, and at what point is it too contaminated?
Like many things, it difficult to draw a line, so its up to communities to set a reasonable standard.
I think the question can be summarized as “do companies have an obligation of mean or an obligation of result in searching for similar code.”
I unless you have a search engine that can search all code across all repository, public or not, it is pretty hard to ask for an obligation of result.
Moreover, in many countries you cannot copyright the code itself, but you can copyright complete algorithm (RSA would be a good example, but not the code implementation itself), or a specific feature (minigames during loading time).
Note that I do not say itis right to do so, I’m all for opensource softwares, but I take into account that some people make a living from their inventions, so I’m generally in favor of limited copyright protection (in terms of both duration and scope).An invention property, a software engineer code, or anything like that, should be shared by both the inventor (for inventing it in the firstplace), and the one financing it (for paying for it), at least until it pays back the money invested.
how about making an effort in the first place? to at least make an effort to list all repository thats being used as training data.
Thats a good one. Sounds like a good start for some legislation.
You can’t verify that with humans either. Someone who has seen licensed code, whether proprietary or GPL, will accidentally reproduce snippets of it to accomplish similar tasks in the future.
The problem isnt the fact snippets exist in a codebase. The problem is, the entire fucking website is scraped clean of every codebase that has ever existed without paying a dime to their owner, notifying of their usage, and being transparent of their datasets.
How can it be verifiably responsible if their activity is handwaved under the guise of “business secret”? Its literally people using other peoples work without fair compensation, which means stealing, which means someone has to pay.
Code should’ve never been copyrightable from the start. It’s basically the compute equivalent of a recipe. That aside, almost all modern transformer models are trained on generated data by this point, how would we even apply traditional copyright to that? Whole thing needs tossed and retooled. Entire economic system with it tbh, just slows innovation, and despite what you might believe it doesn’t protect the little guy, it just allows massive corporate conglomerates to buy up everything and control for what will be pretty much the extent of your lifetime.
algorithms and processes are not copyrightable. Code is an expression of algorithms, and thus is copyrightable. If anything, that’s the stance that the entire movements of Free Software and Open Source are going with to function, so this sounds not a good idea even if it is a good ideal.
They’re moving to this as it’s the only defense against oppression, but copy left was intentionally designed to combat copyright because the core founders of open source disagreed with it and the oppression it was causing in the software development community. Imagine if a recipe for Chilli dogs was copyrightable, but not the concept of Chilli dogs. That’s downright silly.
A more fair comparison would be written works being copyright-able, which code is a written work, a large, expressive, written work
I disagree. I would say both are incomplete comparisons because code is special, it has limitations, it relies on underlying hardware support, and it’s implementing, generally, functionality not anything creative. I don’t have to present a good solution though in order to point out something is broken, I leave that for those more intelligent than I, but copyright is objectively a poor answer to code and is not comparable to an expressive artistic written work.
It’s honestly a bit of both. Creativity can be expressed in the intermediate steps in order to provide a subjectively superior approach (durably optimal until someone identifies a better approach), but fundamentally the design goal is “achieve X with minimal risk and waste”. That’s the part where I agree with you: gatekeeping an outcome is dumb. That said, the expressions of those intermediate steps genuinely land in the territory of creativity. That’s how we end up with new algorithms. Creativity is how we arrive at the optimal algorithms.
Even so, gatekeeping those intermediate techniques is bad for the same reasons as gatekeeping the end state. If they can be independently arrived at (like flourishes that personalize a recipe or alter it for particular food pairings), the end result is still stifling innovation and closing access to the tools everyone has access to.
Edit: Ultimately I think this means everyone should have access, unequivocally. The problem is that LLMs are financially gatekept and implemented at environmentally predatory scales, with unregulated supply chain bottlenecks that choke out the more environmentally friendly and consumer accessible tech that was in the pipeline.
Coding is a creative task, there are many many many solutions to any problem, and some problems are a lot more abstract to where even the problem can be different for different people. Like if there’s a problem with the users interacting with part of the software, you could try to make it easier to interact with, have a little tutorial, decorate it, make it look good, you know, a form of art, you could also try to make it more intuitive, also a form of art. It’s not typically what you’d think about, but coding is a rather creative task and everyone has different ways to go about problems, and those different ways are the different styles of programming people have.
Coding isn’t creative though. There’s an optimum solution to every problem, the layer above the code may be some form of art that needs protected but the code itself is just a recipe.
Code is rather expressive, it’s copyright-able for good reason, you can often tell who wrote what via the style and the way the code was written, and the methods used.
I disagree entirely. I grew up when the conversation around if code should even be copyrightable was happening, and at the time to an extent it made some sense, but the entire copy left movement was intended to combat the copyright of code in the name of open source because copy righting code is both stupid and baseless. Imagine if for loops were copyrighted? That’s what you’re essentially arguing unless there’s some sort of vague subjective measure you’re using to determine when something is copyrightable. The entire thing is just oppressive and does not help the people involved that actually deserve benefit and protection. I’m not saying to cut lose and allow rampant theft but copyright as currently designed and implemented is objectively broken and untooled to the tasks of today, stifling innovation and protecting corporate interests above creators and actual developers.
Copyleft is a form of copyright, if you’re against copyright that’s MIT/BSD 0 clause. Also languages aren’t typically copyrighted, it’s works created within those languages. Although I do agree copyright is kinda very broken, but creators of code do deserve protections, as code is very expressive. I am also a FOSS dev who loves copyleft, which only functions under copyright.
