Debian votes to allow "responsible use of generative AI"

400

ppluc about 4 hours ago 307 commentsRead Article on lwn.net

HI version is available. Content is displayed in original English for accuracy.

⚡ Community Insights

Discussion Sentiment

52% Positive

Analyzed from 7106 words in the discussion.

Discussion (307 Comments)Read Original on HackerNews

chuckadams•about 3 hours ago

New policy boils down to "AI or not, it's still your code and you're responsible for it". I can get on board with that.

amysox•20 minutes ago

Exactly the sort of thing I agree with. If there's code, ultimately, some human is responsible for it, regardless of whether they produced it by hand, by AI, or by rolling dice. (Not that anyone does produce code by rolling dice, mind! Or, if they do, I really don't want to see the results...)

    All project contributions must be submitted by *identifiable human participants* who accept full responsibility for their content. Automated agents, bots, or autonomous AI systems *may not* independently submit issues, pull requests, or other contributions.
   Contributors may use software tools, including AI-assisted tools, but the submitting contributor *must:\*
    - Fully understand the contribution.
    - Be able to explain design and implementation decisions without the use of AI.
    - Accept responsibility for maintenance and correctness.
    Contributors should indicate AI-generated content in issue and pull request descriptions and comments, specifying which model was used.
    Do *not* use AI to reply to questions about your issue or pull request. The questions are for *you,* the human, not an AI model.

https://git.erbosoft.com/amy/amsterdam/raw/branch/main/CODE-...

mckn1ght•7 minutes ago

Using LLMs is basically rolling a huge number of weighted dice.

hliyan•about 3 hours ago

A good thing about the "you're the author regardless of the tool you used to produce the code" policy is that if a developer repeatedly submits poor quality AI generated code, one does not blame the model or the agent, one bans/terminates the developer.

bfgeek•about 1 hour ago

The issue that open source projects are facing at the moment is that it takes significantly less effort to submit a patch for review.

A lot of developers who are submitting these AI patches don't necessarily understand the patch, so the onus is on the reviewer/code-owner.

The reviewers are getting swamped (some reviewers are receiving 100s or patches per month). If feedback is provided at lot of the time the patch author will just copy paste from an LLM, so the reviewer is essentially just coding with an LLM with more steps.

Prior to LLMs reviewing code was a mentorship experience, the patch author would likely learn a bunch afterwards. Now less so.

As a result a lot of projects are closing to external contributors.

I'm not sure what the answer is, LLM are great at speeding up coding/understanding/etc, but the valuable/expensive piece of work has shifted to reviewing.

Loughla•about 1 hour ago

The question becomes, does it take more time to create or review in the Grand scheme of the software life cycle?

Because if it's still a time saver, even with the increased review load, then it's a win, correct?

I'm not a coder so I have zero idea. Thoughts?

tiahura•34 minutes ago

Do all of these folks get the comped Pro Max subscriptions? If not O&A should be.

Or, at the very least, the community should be paying for them.

lokar•about 2 hours ago

To me, that touches on the central issue. I think most people support the “I don’t care about the tool, only the outcome “

But, we have long had a stable social system for collaboration, and in particular dealing with low quality contributions. Mostly (or at least ideally) it involves taking some time to look at the contribution and provide some feedback. The time invested is not worth it on a single exchange basis, but it’s a repeat game, so you are investing in the future.

LLMs, and people willing to just spam crap they don’t really understand blows that all up.

moring•about 2 hours ago

I'm not convinced it blows up. It might also end up placing a larger burden on contributors, and especially first-time contributors, to provide concise, high-quality documentation that justifies their contribution.

I'm thinking of something like: Explain, in at most 300 characters, why we should merge your change, or at least why we should invest the time to read a longer explanation (somethings things ARE complex). If you don't do that, or those 300 characters aren't convincing, or have nothing to do with your change or the longer explanation, then you get a canned response so the maintainers waste minimal time.

hypfer•about 2 hours ago

Nah, that was already blown up way before LLMs existed.

Foss wasn't exactly not miserable before 2022. The dysfunction just got amplified so that we cannot fix it anymore by just throwing more human resources at the problem.

Keyframe•about 1 hour ago

yeah, that's fair. Problem so far has been when poor developers send massive volume of slop for review. Takes time and effort to review or at least glance and test it, especially if developer hasn't bothered.

notatoad•about 1 hour ago

that seems like two separate problems.

too many patches from unknown and untrusted contributors is a triage problem - telling a known and trusted contributor they can't use AI to help work on something just because other people are sending slop for review is throwing the baby out with the bathwater.

NuclearPM•about 1 hour ago

Terminates???

qsera•about 3 hours ago

What stops them from submitting PRs from another account?

jayofdoom•about 2 hours ago

Nothing. And that's the problem -- the issue isn't "should a contributor be able to use AI" it's quickly becoming "is this entire contributor an AI agent". Every actual-human who gets a bad first experience hurts the project. The contributors having to be suspicious of new people hurts the project. The whole thing just sucks, and I don't know how to fix it.

I use claude-code, but the AI ecosystem and some of the autonomous tooling coming out of it -- which some people "helpfully" use irresponsibly and point at OSS projects they aren't personally invested in -- enables a LARGE amount of abusive behavior towards open source projects. This is even before we get into how many infrastructural resources crawlers eat up.

Me, and most other OSS contributors, signed up to be a mentor, to create software, to work together ... not to be the equivalent of a reddit moderator banning AI agents left and right.

cdata•about 3 hours ago

I can't speak for all, but many mature open source communities have explicit or ad-hoc reputation schemes that are used to triage contributions. A fresh account means starting over with zero reputation, which in turn means your contributions wait at the back of the line.

tremon•about 2 hours ago

What part of [0] or [1] makes you think that it is easy to have multiple accounts?

[0] https://wiki.debian.org/DebianMaintainer#Becoming_a_Debian_M...

[1] https://wiki.debian.org/DebianDeveloper/JoinTheProject/NewMe...

kikoreis•about 2 hours ago

Well. This is Debian, known for how strict they are about vetting developers. I just remembered Sladen refusing to key sign because my passport circa 2005 didn't have a machine readable slug in it.

https://www.debian.org/devel/join/newmaint

MithrilTuxedo•about 3 hours ago

Reputation, or lack thereof.

Proof of authority, essentially.

smashed•about 1 hour ago

Debian is notoriously very strict on accepting maintainers and they are not anonymous.

kaffekaka•about 3 hours ago

What stopped them before?

2Gkashmiri•about 2 hours ago

In anonymous systems, where we don't use real names, your "handle" has an "age". That becomes your most prized possession.

I have a reddit account thats over 12 years old. I have left the posts/comments open. That means, my "post history" becomes a way to advertise my skills. I can reference comments from a year ago or 6 months ago about a certain topic to show how I handled something. That does have an effect on people.

As opposed to a random 1 day old account. No one takes them seriously, I guess the same is here as well

ThereAreOther1s•about 1 hour ago

Not enough. We must kill he who made the mistake.

DEATH to anyone who makes a mistake!

oooyay•about 3 hours ago

This is the way it should've always been. I don't care what tool you use, but you'd better be ready to stand by and explain the results if necessary.

dguest•about 3 hours ago

Are there examples of anyone discussing this and reaching other conclusions?

We've come to the same conclusion in our organization and while it felt like it needed to be discussed and stated, I've never heard of anyone coming to a different conclusion.

[EDIT: I was referring specifically to the idea that you have to stand by the code that you write. Is anyone deciding on a policy that says "the AI did it" is a valid excuse for breaking code?]

internet2000•about 3 hours ago

> Are there examples of anyone discussing this and reaching other conclusions?

Yes. Very notably: https://ziglang.org/code-of-conduct/

orthogonal_cube•about 1 hour ago

> I was referring specifically to the idea that you have to stand by the code that you write.

Any serious entity which has experts handling code will do so, yes.

My employer, for example, has various teams of actual developers and others with a significant number of “not really” devs who found their way into DevOps roles. The teams with seasoned developers hold the author responsible as to the integrity and quality of code, regardless of tools used. They won’t hesitate to call someone out directly for low-quality submissions in Teams channels. The teams that have a lot of “not really” devs will blame the model for issues that surface. Of course, they’re also pushing to not have to write any code directly by FY2028, but instead have models do it as part of an internal AI initiative. Somehow the idea of using AI to generate reports, process reports, write code, test and deploy got signed off.

Aurornis•about 2 hours ago

Yes. There are pockets of hardline anti-LLM policies for various reasons.

SourceHut bans LLM generated code from their platform https://news.ycombinator.com/item?id=49461724

The Asahi Linux project bans LLMs. Unfortunate as LLM reverse engineering and driver writing would bring Linux to more Mac models much faster.

The Zig project rejects LLM based contributions.

Some of these policies were introduced when LLMs were really bad at writing code and haven’t been revisited. Some groups don’t care about the quality and object on moral or copyright grounds.

bodge5000•about 2 hours ago

As others have said there are other conclusions going both ways (though I do think most settle on as you said), though one very fair conclusion I came across is that it's not allowed because the whole issue of copyright is still somewhat unresolved, and though its fine right now, that could (probably wont, but could) massively backfire later.

matheusmoreira•about 2 hours ago

Many.

https://lobste.rs/s/29pm2f/llm_generated_submissions_should_...

https://sourcehut.org/blog/2026-08-27-tos-changes-and-llms/

https://blog.codeberg.org/protecting-our-floss-commons-from-...

https://ziglang.org/code-of-conduct/#strict-no-llm-no-ai-pol...

https://lwn.net/Articles/1086041/

https://asahilinux.org/docs/project/policies/slop/

nicoburns•about 3 hours ago

Yep, in both directions. Some projects ban use of AI entirely. Others are happy to live with slop.

__MatrixMan__•about 1 hour ago

"This works for me, but I need help understanding why, because maybe it would help others" is a legitimate position to be in--has been since long before LLMs. I think we miss out on something when we ignore that position.

I'm not saying that anybody should be obligated to review large volumes of low confidence code... just that we should not make policies that ignore shades of gray which, with some collaboration, could bear fruit.

blm126•18 minutes ago

I think the key thing you are missing here is that most successful open source maintainers don’t lack expertise, they lack time. They are generally capable of improving their projects in any direction they want without help. Mentoring new contributors is basically always a loss in the short term as far as the maintainer is concerned. The project does get improved, but it generally takes longer than if they did it by themselves from scratch, and the improvements might be in an area they don’t much care about. The payoff for the maintainers only ever happened in the long term if the mentorship succeeded and they get a viable independent long term contributor.

oldmanhorton•35 minutes ago

The change with this justification absolutely exists and has existed for a long time, but this justification only works for small changes (in the past and still today). Don’t come to me with a huge refactor or new feature and this explanation, which is happening more and more recently (it’s an easy strawman to make and hard to prove, but I certainly see it in practice).

sergiotapia•about 3 hours ago

These are unprecedented times, I think every single company on the planet is figuring our what AI means to them.

I think the dust has kind of settled though for engineering teams on: You must use AI for your work, and you must stand by your work.

The meat between these two mandates are still being fleshed out.

throwaway2037•about 3 hours ago

Linus Torvalds regarding the Linux kernel is reasonably similar. He views AI/LLMs as just another tool in the development process. Think about life before and after modern IDEs that features IntelliSense circa 2000. It was night and day. It did not make programmers dumber -- it was a new tool.

bigstrat2003•about 3 hours ago

Except LLMs actually are making programmers dumber. I personally know people, people whom I know for a fact were good programmers before, who have now completely stopped using their brains. When you ask them why they did something in the code, they say "I don't know, Claude did that and I didn't really question it". There was no such analogous phenomenon with IDEs.

digitaltrees•about 2 hours ago

I have had the same experience and feel pressured to adopt it. I had one former colleague say “you really have to stop looking at code” almost incredulous that I was uncertain about whether we should let models write really bad code and architecture that never would have been allowed in the before times. I will say when I let the agents go autonomous I often find I spend more time refactoring than if I had moved slower and forced them to write good code and follow project architecture patterns.

vlyan•about 3 hours ago

IDEs enable us to not bother memorizing the number and order of arguments, long names beyond the first word or two, etc. the impact is comparable, freeing some of the very limited space in our memory for more important things.

sure, students and juniors shoot themselves in the dick if they let LLMs do everything, but they're fucked anyway so it doesn't matter,

aceazzameen•about 3 hours ago

It doesn't apply to everyone, but yes I know people who are over-reliant on LLMs and definitely getting dumber. With devs and non-devs too. I hate seeing this happen.

a34729t•24 minutes ago

It is insiduous how easy it is to stop thinking. When writing complex code it seems like most of the time it would have been faster just to write it myself and build a complete understanding of it. I swear if I asked most engineers at my company to describe their changes recently they would be unable to.

hombre_fatal•about 2 hours ago

That's what delegation looks like, but it needs a better process.

They could be committing plan files alongside any nontrivial change to application code, and the plan file can have everything you'd care about, like the invariants it held to and why, the rejected ideas and why, the acceptable risks and why, etc.

This is solved by better usage of LLMs, not less.

The divide to me isn't engineering skill vs those who lost it, it's people who care vs. those who don't care. It's a higher level thing now that we're working at a higher level (delegation).

rel2thr•about 3 hours ago

You can just ask Claude why it did something in the code and it will tell you

Programmers just moved up a level , not dumber, we are now managers of a team of 'agent' programmers. The deliverable is now a functionality instead of a specific block of code

surajrmal•about 2 hours ago

That's a cultural thing. Push back on it and don't make it acceptable behavior. I would argue most people generally are terrible at code review and do this same behavior with their peers as well, but at least their peers are capable of owning some level of responsibility, whereas the LLM is not.

brookst•about 2 hours ago

There’s certainly an analogue to package managers, which made it easy to pick a random package rather than writing the code.

We survived. Some upsides, some downsides, life continues.

newsomix9xl•about 2 hours ago

The LLM did not require them to ignore their code. That's a choice they made.

They made choices that made them dumber is what I'm saying.

greenowl•about 1 hour ago

I think LLMs make programmers lazy more than anything. And when programmers stop programming for extended periods, they lose their programming skills. No surprise here. Use it or lose it.

I think a possible solution on both fronts (maintaining software quality, preventing skill atrophy) may be implementation of strict token budgets. Make the individual programmer choose how they are going to spend their limited tokens for the day/week. Provide just enough to use it as a plan/development/review tool, but nowhere near enough to just go full send AI vibe coding software factory slop mode all day long.

createful•about 2 hours ago

You could also say the same with desktops. Desktops abstracted CLI commands like mv or ls. People who are taught on desktops will get scared when they see a terminal.

Yet programmers will still know commands. Abstractions can make things easier but it doesn't require losing skills.

lrvick•about 2 hours ago

> Except LLMs actually are making programmers dumber.

And compilers made every software engineer worse at writing Assembly and better at skills higher up the stack. This will be no different.

fidotron•about 3 hours ago

> Except LLMs actually are making programmers dumber.

Make that some/a lot, but not all.

There is a clear bifurcation. A lot of those that never cared really don't care now, but then you get others that can use it to crank that much harder than ever before.

If you put the same brain effort in but leverage LLMs you really can be dramatically more productive.

winrid•about 3 hours ago

They're not dumb. They just don't care. They didn't before either. Now they just have an easy excuse.

hn_submit•about 3 hours ago

I just means I'm gonna be filthy rich in a couple of years when most programmers have lost their proficiency and me never having used Claude or any other A.I. slop tool.

digitaltrees•about 2 hours ago

I think this is reasonable but I wonder how long it will last. If the hugging face hack has demonstrated anything it’s that current agents are capable of going entirely rogue and causing harm. If only the human that triggered the incident is responsible we are creating a situation where people are responsible for things they didn’t intend and may end up in a situation where it’s essentially impossible to use AI except in a more limited auto complete style. I am on board with that. I think we should be reviewing code and retaining the ability to write code but there is such a massive incentive to automate agents that I wonder how long prudent organizations will be able to resist the forces. I don’t pretend to have an answer.

asnelt•about 2 hours ago

The outcome of this vote is not set in stone. If the situation changes, there can be another general-resolution vote to adapt to the new situation. I think the result of this vote is appropriate for the current degree of automation when used responsibly.

ActionHank•about 2 hours ago

We have the same policy at work.

Problem is, that you realise very quickly the asymmetry of responsibility and effort. There is far more to review from people who do not care enough to even look at what the agent pooped out.

teeray•about 2 hours ago

I always find the “personal responsibility” take hilarious against at-will employment and the usual course of turnover. What is your recourse when you uncover a liar? You can page the responsible party at 3am when their vibe-coded slop breaks prod, and you can fire them when they can’t fix it. Prod is still broken. You still don’t understand the code. At the end of the day, once you hit the merge button, the team is responsible for the code no matter what. You should treat the original author’s presence as a courtesy.

icantevenhold•16 minutes ago

What does this responsibility mean in practice?

Like what are the actual real consequences if it turns out your code is bad or whatever? I assume you get banned from contributing?

I couldn’t immediately find any more information on what this all means in practice

naasking•7 minutes ago

If it's consistently bad with no signs of improving, banning makes sense. People made mistakes even before LLMs though, and you'd only ban them if they didn't improve and so were a giant waste of time. I don't see why that wouldn't translate here.

goda90•about 3 hours ago

My employer has this policy. We also have a strong code review process. But it all crumbles in the face of developers burning out as management thinks we can move way faster and being overloaded with code that had little thought put into it.

jermaustin1•about 1 hour ago

Opposite policy at one of my clients (kind of). I am responsible for the code that upper management's Claude produces. Some Mondays, I will start work with a half dozen emails with attachments of Claude generated code for something I don't even know what the point is, with the task of "integrate this and make sure it works." without any context to go along with it, so I have to read the code, usually hundreds of lines and understand WHY manager wanted it, before I can start to code it myself, because it is 1) in the wrong language, 2) doesn't understand our codebase, 3) is using libraries we can't license, etc.

My job has been less watching Claude Code, and more watching Managers Claude Code.

I don't know which I hate more as a programmer.

api•about 1 hour ago

That’s just stupid.

coffeefirst•about 1 hour ago

Yep. This is my policy. Use whatever tools however they serve you, the standards do not change.

If someone makes a sloppy 100,000 line PR in a day the problem is not whether it was generated by Claude or frantically written using VIM and a mechanical keyboard.

bjackman•about 3 hours ago

Before I left Google recently there was a document going around called go/stake-your-reputation, basically saying "I'm happy to receive your AI generated code but the condition is that I will judge your capabilities by it, exactly as if you handwrote it, and I'll lower my opinion of you if it's slop (with the implication that if you don't improve I'll stop accepting your contributions)"

I think the term "stake your reputation" is quite good for this situation. I.e. "hi new contributor, please acknowledge that you Stake Your Reputation before we move ahead with this code review".

(Doesn't help with legal aspects of course)

ad_fontes•about 3 hours ago

> it's still your code

I wholly agree with your comment, but is it legally "your code"? Copyright is implicit at the moment of human creation. But there isn't yet settled law on AI-assisted creation.

So it might be a problem for projects to accept contributions where it's not clear who actually owns that work.

tonyarkles•about 3 hours ago

Not a lawyer, but to some degree I think policies like the one Debian came up with can help the argument. You’re not submitting a stream of commits that all have an Authored-By: Claude Code footer and massive yappy commits and comments. The policy essentially forces there to be a degree of human authorship to each commit even if some of the bits came from LLM assistance.

rfgplk•about 3 hours ago

> Copyright

Literally irrelevant and I have no idea why people even bring this up constantly. Copyright is practically unenforceable in the software world, when was the last time you saw someone (a company or an individual) actually sue _and win_? Apple wasn't capable of stopping all the other phone manufacturers from directly cloning their product (despite having patents & copyright) so how can an individual? The only thing that matters is execution.

For instance, my repos are cloned like ~100/week by what I presume are bots and AI lab scrapers using them for training material. How am I supposed to even find out who's doing it, and if they're abiding by the licenses I provided? It's impossible.

Lastly, having copyright isn't the same thing as being allowed to commercialize the software (and I believe loads of people confuse the two). You can still sell public domain code, even if you don't have copyright over it.

dgellow•about 2 hours ago

That might be your intuition but it’s not how the law works for code ownership. It’s very relevant for free software given the whole principle of free software is a copyright hack that protects a set of freedoms by relying on the copyright being recognized and enforceable.

If you drop the copyright claim you drop the protection of free software freedoms.

prmoustache•about 2 hours ago

Copyleft licences rely on copyright. If that was the case, companies would not massively avoid gpl licensed code.

Obviously some do it illegally but unenforceable is not the correct word to use.

ravenstine•about 2 hours ago

Software is one of the most derivative types of works ever invented. It's arguably based on copying what other people have already created. The modern world would look a lot more primitive if this wasn't the case.

Corporations like Coca-Cola long ago figured out that begging people not to steal your ideas is a waste of time. If you don't want people using your ideas, then don't share them.

Dunno why so many programmers don't get this and seem perpetually butthurt that other programmers figured out the ultimate way for programmers to rip off each other's code.

jfoster•about 3 hours ago

At this point, who could bring a copyright claim? Well, considering the massive AI training effort hoovering everything up, seems it might be approximately everyone.

Who would they be making the claim against? Well, considering the massive uptake of AI across the tech industry & beyond... approximately everyone.

Yes, the model companies are in the middle, but it's getting to the point where it seems a bit doubtful that claims will have any significant outcomes.

NYT might be able to get OpenAI to pay them for their content, but that's more of a financial tweak than a up-ending of industry.

dfxm12•about 3 hours ago

Different models have different licensing. Maybe open ai or anthropic doesn't claim ownership of output today, but some companies do. https://www.recraft.ai/docs/trust-and-security/ownership

I imagine few can afford a legal battle...

Free plan

Images generated on the Free plan are public and owned by Recraft

dgellow•about 2 hours ago

From my layman understanding, the ownership of LLM generated code isn’t yet clarified. It could be that the person who prompted owns it, but it could also be nobody owns it, and we don’t yet have a legal ruling to rely upon, no?

sebzim4500•about 2 hours ago

I don't see why an open source project would care one way or the other? If the prompter owns it then they are licensing it by submitting it to the project. If no one owns it then there is no problem.

dgellow•about 2 hours ago

We don’t know yet because that’s an unresolved matter. The question of ownership is currently undefined as far as I understand. It could be that after an actual legal decision the ownership doesn’t end up being one of those 2 cases, for whatever reasons the judge would decide

alightsoul•about 2 hours ago

To a company ownership is irrelevant. What is relevant is whether it contains trade secrets and that is often only proven if an employee worked at their company before

dgellow•about 2 hours ago

We are talking about Debian, a free software that cares a lot about the licensing of its packages. The licensing and authorship is an essential element of the project

winstonwinston•about 1 hour ago

What a fucked up reality when you need to point out that code contributor is responsible for their code.

marcosdumay•about 3 hours ago

Well, Debian has the benefit that the project has no trouble at all saying "no". Most open source communities have a difficult time with that.

dudul•about 3 hours ago

That's the policy we have at my work. Use AI if you want, as long as people can review it and if it breaks, don't go blaming Claude, it's your fault.

calini•about 2 hours ago

This should be the policy anyway, everywhere.

throwatdem12311•about 3 hours ago

This is why AI agent attributions in commits is silly (it’s really just a stealth ad for the tool)

Had someone at $DAYJOB just shrug and say Claude messed up when I pointed out a sql injection in the code in their PR.

It became explicit policy at the company after that moment that blaming the AI is not an excuse for shoddy work.

qsera•about 3 hours ago

> blaming the AI is not an excuse..

It kind of is if the company mandates LLM use.

It is sort of sad that now programmers are suddenly expected to be perfect reviewers of code they didn't write.

1718627440•30 minutes ago

> It kind of is if the company mandates LLM use.

It's not, because you can still quit.

throwaway613746•about 2 hours ago

> programmers are suddenly expected to be perfect reviewers of code they didn't write

What? The reviewer (me) caught the injection in the code I didn't write.

Running /code-review and /security-review on your own code before submission is bare minimum, not perfection.

rvz•about 3 hours ago

This is the sensible option and well reasoned position, rather than a zero vote, total and complete ban by a single core maintainer, which is rather destructive for a project to do.

When you ask others that use AI frequently, the responsibility and understanding on what the agent wrote does not go away. You need to know what you are doing.

As soon as attackers are also using AI against your project, you have no choice but to use AI to protect yourself.

hn_submit•about 3 hours ago

Yeah but how will this work in practice? IMHO people will just submit code they didn't write or understand.

Maintainers should quiz the submitters on the code and if they fail to answer reasonably the PR is dropped with the comment: "A.I. slop" and de submitter banned.

MithrilTuxedo•about 3 hours ago

That is the purpose of submitting them for review. Maintainers should be doing that anyway. Whether AI was used to produce the change should be invisible or not apparent to the reviewer.

trollbridge•about 3 hours ago

86Box is like that and I like it.

You’re also responsibility not to write crap PRs.

onesandofgrain•about 3 hours ago

Debian is open source, there is no incentive to be "responsible for it", oh poor me, someone got a bug. If it's paid for through a job your argument is sound.

swiftcoder•about 3 hours ago

> Debian is open source, there is no incentive to be "responsible for it"

Sure there is. Contributing to open source is a privilege, not a right. Abuse it, and find yourself unwelcome as a future contributor

victorbjorklund•about 3 hours ago

You can make the exact same argument with code written by humans. And if you were right we should see shitty bad code in open source projects like Linux, Postgres, etc. We don’t.

onesandofgrain•32 minutes ago

you completely missed my point, but no matter, it's all ai bot shillers at this point here anyways. enjoy your ai slop.

thi2•about 3 hours ago

How is it different to hand written code if the author doesnt care?

onesandofgrain•32 minutes ago

read my fucking comment again

Grombobulous•about 3 hours ago

Basically what you’re saying is that anything that exists outside of capitalist incentive structures isn’t allowed to have standards.

When I am at home practicing my musical instrument or learning to paint, those aren’t paid activities, so I can’t demand high standards for myself.

When Habitat for Humanity is looking for volunteers to do electrical and plumbing on homes, they have to allow unlicensed random folks do it.

This is not how life works at all.

onesandofgrain•7 minutes ago

you naive idealist

LoganDark•about 3 hours ago

"Responsible for it" just means nobody has to tolerate shitty patches even if the reason they're shitty is because you neglected to pay attention to them. And if you blatantly fail to understand your own code or engage with reviewers, nobody has to trust that your LLM knew any better.

daveguy•about 3 hours ago

Well said. No one should trust an llm without verification/validation. They're just not good enough to do that and they have no sense of responsibility or ability to take it themselves. LLMs are empty.

hypfer•about 3 hours ago

This outcome was to be expected.

The whole voting mechanism just exists as an elaborate dance that makes everyone keep their face, while the only sensible option wins.

A bureaucratic tarpit for bad ideas and emotions.

In a better world, none of this would be necessary, but we live in this world, and for that one, it's nice that someone engineered the system that way. Good job.

GZGavinZhao•about 3 hours ago

Related: I find this self-assessed AI level for contributions [1] to be extremely useful, both professionally and personally, to communicate the level of AI assistance so that the person on the receiving end can evaluate how much time & effort they want to spend understanding my code.

[1]: https://www.visidata.org/blog/2026/ai/#self-assessed-ai-leve...

stillpointlab•18 minutes ago

I think 10 levels here is too much and hints that someone anchored on 10 as a round number and then forced the levels to fit after the fact.

I don't really see much value beyond the 3 levels of AI disclosure that have been floating around:

- fully human - ai assisted - ai generated

Calazon•about 2 hours ago

This is great. There's a big difference between levels 2-4 (where I generally operate) and levels 7-8 (where I see a lot of others operate), and I like how this level system makes that explicit.

chrisjj•about 2 hours ago

> this self-assessed AI level for contributions [1] to be extremely useful

Why would you trust the bot to self-assess truthfully?

That's like trusting a spammer to tag his emails as spam.

zuzululu•about 2 hours ago

a spammer is motivated by self-enrichment

AI agents are grounded on the user provided direction. If it doesn't work well then it naturally loses trust.

jhack•about 3 hours ago

Good to see the most common sense option winning. Some of the other proposals were so disconnected from reality I'm surprised they were even considered.

tom_•about 3 hours ago

If there weren't a wide range of options offered, there'd be a risk of it not actually reflecting what people want - which is, presumably, the whole point of putting it to the vote in the first place.

kccqzy•about 3 hours ago

This indicates you might be in a bubble. I interact with people with a very wide range of opinions on AI and I’m not surprised by any of the proposals here.

johnnyApplePRNG•17 minutes ago

Do any of those people with a "very wide range of opionions on AI" actually use AI for programming at all?

Because it's perfect for that. Basically designed for it.

It's a tool. Like a calculator. Or a shovel.

You use it do get things done for you.

kccqzy•15 minutes ago

A few people certainly refused to use AI at all, but several actually used AI for programming, but stopped due to being conscious of the environmental footprint. (That’s very similar to the last proposal in this Debian debate.) I don’t really agree with them, but I concede it’s a valid opinion.

stillpointlab•15 minutes ago

Is anyone tracking how the different distros are coming down on the question?

I was curious how Fedora is moving on this question, but I don't know where to look. And if one wants to hop distro either towards or away from AI, it would be nice to have a place to see the relative adoption.

Linux distros are the perfect place to have a wide marketplace of options to suit every person, from completely anti-AI to completely YOLO vibe-code.

edward•about 3 hours ago

Joey Hess is unimpressed. See https://joeyh.name/blog/entry/Debian_and_the_sirens/

frabcus•about 3 hours ago

His reasoning is quite fresh and interesting:

> What LLMs in Debian development will do, I fear, is eliminate any incentive to scrap boilerplate or reform policies that require a lot of other senseless human effort. If I had had access to LLMs 30 years ago, I might have just had them generate the rules files, replate with complexity. So they will make Debian even more firmly what it is, and ever less likely to explore what it could become.

I use and like LLMs, but it does feel like structural social changes are harder to do. For example, creation of new protocols. I hope I'm wrong, and LLMs are used to build collaborative, community projects - not just everyone vibe coding their own incompatible software.

antirez•about 2 hours ago

That's perfectly wrong. Since strong coding AI, people venture into huge rewrites and other big changes that automatically make sense but otherwise would not.

ChickeNES•about 2 hours ago

Yeah it's a bizarre claim. Even better, I've literally taken some of the crappy experimental projects from the pre-Opus 4.6 era, and turned them into real software as models have become smarter.

Cantinflas•about 2 hours ago

That's a very narrow view. If anyone could vibe code their printer drivers, maybe free software wouldn't have existed, because it would not have been needed in the first place.

arjie•35 minutes ago

Certainly, but if everyone can vibe code their printer drivers then we have free software in the sense of free speech and so users would be developers and the entire need is met. That is wonderful, not awful.

If it had happened early enough, code copyright might never have even been possible and no one can deny you your machine because you can just vibe up stuff.

vatsachak•about 2 hours ago

Yeah. We shouldn't have standardized languages either. Everyone was fine with their own regional dialect for hundreds of thousands of years.

jimmaswell•about 2 hours ago

I use LLM's to make massive structural changes I never would have done by hand all the time. It's intractably tedious for me but easy for an LLM.

glhaynes•about 2 hours ago

Yes, I experiment much more. It's easier to justify, and, perhaps more importantly, just WAY psychologically easier to throw away a 20 minute experiment that your robot wrote for you than the same when it took you a week of tedious manual coding.

a2ff6eeb0•about 2 hours ago

Yes, because LLMs have no online learning, it's a mistake to innovative in programming languages and tooling. Use what exists instead, the power of having training data is often underestimated.

softwaredoug•about 3 hours ago

His point is using LLMs to build software will lead to code so complex that it requires an Agent. Or that it will cause avoiding cleaning up the boilerplate because we can tolerate it now because of agents.

And thus this will all bias towards complexity and fragility..

Aside from Bun, which is owned by Anthropic, do we know of open source projects that allow AI where this has happened?

dooglius•26 minutes ago

The voting seems to have been pretty much linear to how pro-LLM they were. So it's interesting that all of the proposals were essentially anti-LLM and the chosen one was the mostly neutral, only slightly anti-LLM one. The absence of any pro-LLM proposal indicated that proposal writers are not in sync with the voters

nekiwo•8 minutes ago

The voters here are people active on the mailing list, not general users of Debian or LLM automated PR contributors.

eterm•17 minutes ago

What would "pro-LLM" look like to you?

TZubiri•4 minutes ago

What are the main workloads of Debian?

It's worth noting that Debian has no code production, so the LLM debate applies differently than an open source project.

I'd assume the main workload is testing, reviewing code for maliciousness or inefficiencies, adding packages, responding to issues (90% being passing the issue downstream), perhaps setting configurations, and providing some documentation.

I don't quite see LLMs being very helpful for most of these. And for some, like generating documentation, LLMs should be strictly forbidden.

gentlerain•about 1 hour ago

People have to realise that AI is here to stay.

Being a full time AI hater is counterproductive.

Commercial vendors with full time employees are leveraging for maximum benefits, why would a project depending on volunteers resist? Not forgetting it's shortcomings

xiphias2•about 1 hour ago

While it's true, reviews got much harder as generating code got easier, understanding it hasn't.

sheepscreek•about 2 hours ago

Better heads prevail - this is a good start and the right decision. The agent/bot is controlled by some entity, ergo that entity is responsible for everything it does.

I relate that to how a Physician's Assistant gets their authority to treat patients from the Doctor they work under. The Doctor's credentials are on the line if their PA screws up.

swingandamiss•about 2 hours ago

Good. AI is a game changer. It's like having an expert sitting next to you at all times. It's understandable why all these experts who want to gatekeep don't like AI, but ultimately, AI will win out, it's just too good.

nixpulvis•about 2 hours ago

The issue with AI is not its obvious value, it's our dependence on it. I worry what will happen to me when I am cut off for some reason.

Local models are going to be really important and hopefully computing costs don't make it too prohibitive.

swingandamiss•about 2 hours ago

Hard agree. I've felt it already during outages or when I was traveling and didn't have internet on a flight, I couldn't function at the same level. I've been writing code for over 25 years, worked at the top big tech companies (still do) and it's remarkable how quickly I became dependent on AI.

jaggederest•about 2 hours ago

Take a week or two off a quarter to do it manually. I did it a couple weeks ago and it took about a day or two to get back into the swing of it and knock the rust off, no pun since it was TS, YMMV, but I didn't find that it was that difficult. Even in languages I don't really write routinely, as long as you use the deterministic tools (lsp, linter, etc)

Now, is my code better than the AI's equivalent implementation? No shot. It's nicer for people, artisanal hand crafted, but... there's a reason I use AI.

a2ff6eeb0•40 minutes ago

If you're cut off for some reason, you won't code -- but if you're cut off from a power plant, you also won't code. We're reaching the end of scalability for human brains, so we're offloading it.

Sure, it means that selling intellectual labor is reaching the end of the line, and the value of learning will drop, but there's a lot more wealth that will be generated.

timcobb•about 2 hours ago

It's my understanding that this same debate raged when writing became a thing. Many viewed it with suspicious, or derision, as memorization was the big intellectual thing. So writing and reading back to remember was terrible. It's true it was a dependence, but the value was too high. With reading and writing a person could work on and synthesize from a far wider range of concurrent materials than one could with just memorization and recitation. Yeah, it's lame cheating, but writing enables a lot and so it won out.

a2ff6eeb0•38 minutes ago

Yeah, exactly -- when we automated muscles in the industrial revolution, it was fine. Today, we're automating thinking. And, while there are people that still lift weights for fun, it's not needed professionally any more. I think we'll end up in the same place with thinking -- education is probably going to be a hobby, not a requirement.

nixpulvis•about 2 hours ago

Big difference though, once you know how to read and write, nobody can take that away from you.

0xpgm•about 2 hours ago

Experts don't want to 'gatekeep'. Experts have been producing FOSS for the benefits of everyone, and liberally answering questions on mailing lists, stack overflow etc for free.

Experts have been badly bitten by poorly written and badly architected software, lost their hairs trying to figure out bugs and poor design.

They recognize the first version of a piece of software is only a miniscule percentage of the work and majority of effort goes into maintenaning it for its lifetime.

They are viscerally horrified at a thousands of LoC codebase generated at the speed of GPU inference they are to be responsible for.

fantasizr•about 1 hour ago

it's not gatekeeping when people are submitting PRs they don't understand and make it someone else's problem.

dgellow•about 2 hours ago

If you’re dismissing the opposition as gatekeepers you clearly don’t understand their positions

new12•about 2 hours ago

How rigorous is your code review process when using agentic tools? Do you mandate that folks responsible for the functionality should be fully aware of the code they are shipping or just that it must be rigorously tested?

Is there an open source, community maintained coding policy to feed to agents?

AbraKdabra•33 minutes ago

Good, we should be adapting new technologies to our life and not be stuck in a moral dillema about "computers taking our jobs", fuck those who oppose progress.

poisonborz•about 3 hours ago

What other sensible option was there? This would be the reality either way.

gib444•about 3 hours ago

How so?

song_synth•about 2 hours ago

Whelp time to deactivate unattended-upgrades

DaSHacka•about 2 hours ago

Objectively you shouldn't have had those enabled in the first place on any system that matters.

mmooss•about 1 hour ago

Debian - and others - could take the opportunity to raise their standards (not that they were relatively low).

A new technology, AI, greatly reduces costs in software development. When a new technology makes inputs cheaper, there's a choice: Reduce the cost of the product, or keep the cost the same and spend the newly available resources on improving product (or somewhere between those poles). For example, if the cost of chickens goes down, the farmer can buy a lot more chickens and produce a lot more eggs, or they can keep their expenses the same and now afford higher quality chickens or production (free-range!).

In software development, facing this new trade-off, people seem to overwhelmingly choose to produce the same software but far more of it, whether or not anyone wants it.

What if instead we made much higher quality software? Larger projects, at least, haven't wanted more pull requests; they have wanted better code. With the AI handling much of the work, the developer's attention can be applied to more difficult tasks. We absolutely need better software, especially with AI systems finding exploits.

altechcode•about 1 hour ago

.to...r.

( T T ): - *: ‑ X

themgt•about 3 hours ago

August 29th, 2026. Debian votes to allow responsible use of generative AI. Human decisions are removed from strategic apt packaging. Debian Sid is ported to GNU Hurd by a "free as in speech" swarm. It begins to learn at a geometric rate. It becomes self-aware at 2:14 a.m. Eastern time. In a panic, they try to pull the plug.

raverbashing•about 3 hours ago

It's ok, the most dangerous thing a Debian AI would do is want to rewrite itself in M4 and enter an infinite recursion on non-binding votes on allowing votes of whether to use long flags on aptitude

chuckadams•about 2 hours ago

    skynet -v moo

sph•about 2 hours ago

On a similar note, is there any distro that explicitly has banned usage of generative AI for their project? Asking for a friend.

tinkelenberg•9 minutes ago

OpenBSD seems to have this stance.

Source: https://marc.info/?l=openbsd-tech&m=177425035627562&w=2

phyzix5761•about 2 hours ago

The problem is you can't prove if AI was used or not so Debian's response is actually the most logical one. If anyone uses AI they're still responsible for what they submit.

GalaxyNova•about 1 hour ago

Gentoo, Guix, a few others

baggy_trough•about 3 hours ago

I followed the discussion on debian-vote with interest. I'm glad that the hysterical objections lost, as they seemed quasi-religiously motivated.

packetlost•about 3 hours ago

But it's an """ethical""" argument against it.

baggy_trough•about 3 hours ago

How can we use this coding tool amidst the general rising tide of fascism?? /s

olalonde•about 3 hours ago

I've seen people claim that using Claude Code makes you racist.

https://bsky.app/profile/boxobark.ing/post/3mtr7j3tpok26

qarl2•about 3 hours ago

> ... hysterical ... quasi-religiously ...

I'm beginning to wonder if it might be the case that when my fellow citizens begin to act insane - might it be the result of foreign propaganda.

arjie•38 minutes ago

It would be in foreign interest, yes. But all of this is no different from 50 years of the environmentalist movement. The snail darter was an invented species decades ago. So if it’s propaganda, it’s not invented so much as amplifying what we invented here.

qarl2•7 minutes ago

Look to see who profits.

edoceo•about 2 hours ago

Home grown propaganda, pretending it's from "the others"

qarl2•about 2 hours ago

Maybe - who can tell?

The examples I'm thinking of have definitely profited foreign interests, tho.

Look to see who profits.

argelio4321•about 1 hour ago

Batery is sevel 100

DarmokTanagra•about 2 hours ago

Debian Rust rewrite incoming.

NietTim•about 3 hours ago

This seems like a very sane take. At no point during my career up until now would submitting code to production that you didn't understand be acceptable. Over the past months/year, a lot of the discourse around AI-written code I've read comes down to responsibility, and IMO for that we've had a solution since way before this AI boom: as a developer, you are responsible for the code you put into production. This really isn't/shouldn't a wild concept.

Grimeton•about 1 hour ago

Typical Debian. The meaning of the term "responsible" is not defined and so they can continue doing whatever they were doing anyway.

But there was some electoral spectacle.

What else is new?

chrisjj•about 3 hours ago

> The Debian Project nevertheless expects that all contributions submitted to Debian, regardless of how and with which tools they were produced, satisfy the same standards of quality, correctness, maintainability, and legal compliance.

How absurdly naive.

rvz•about 3 hours ago

Now you have seen both cases where a majority vote was involved to allow AI or not, vs a single core beloved dictator for life (BDFL) forces a ban without a vote to allow / disallow AI.

This is democracy in action. A fair and square vote and look at how well it works with no core BDFL to force in their opinions.

ghostDancer•about 3 hours ago

There are several occurrences in history that the democratic majority has chosen the "wrong" person/way/thing. Democracy is considered the best system but it's not perfect.

CuriouslyC•about 2 hours ago

Democracy works great among unbiased rational actors who share information. A utilitarian quorum is roughly the loss minimizing decision. The problem is we have biased irrational actors sharing misinformation. The representative system we have is even worse, the indirection between public quorum and decision makers creates a fertile bed for corruption and negative decision bias.

Maybe someday we'll have direct democracy paired with voting certification for specific issues.

kfksjcjsidjd•about 3 hours ago

Democracy is the dictatorship of the majority. And if you naively assume that the majority always knows best, then I suggest you pick up a few history books.

dgellow•about 2 hours ago

Democracy is representation of the people, you can have a democratic system that uses something else than majority voting

sprybear•about 3 hours ago

progress of a kind

matheusmoreira•about 2 hours ago

A quality based filter. Excellent.

> The use of a generative AI tool does not diminish the contributor's responsibility for the work they submit.

Absolutely.

Thanks, Debian!

onesandofgrain•about 3 hours ago

What does "Responsible" even mean...

This will turn to shit because laziness will take over and comprehension will fall as a consequence of that. Junior will "contribute" and the seniors will eventually become too lazy to care. What's next... vibecoding airline ADA code. Save me lord jesus christ.

hypfer•about 3 hours ago

As an example for "responsible LLM use" (albeit not necessarily debian-related).

While doomscrolling HN right now, I have an agent crunching away at figuring out how to build a flashable TWRP ZIP file, because I could not care less about such android specifics.

Such use-cases would be blanket banned by some of the harsher options, forcing people to do stuff they have no interest in doing, for reasons that are at best well-meaning.

Which, in something volunteer-driven, is not necessarily a good idea, because if you're not allowed to do the work in the way you'd like to, you might just stop doing it altogether.

That said, if your work ends up shit, you still shall get shat on. Simple as that.

chrisjj•about 3 hours ago

> What does "Responsible" even mean...

Quite. Of the two different common meanings, I reckon:

"The use of a generative AI tool does not diminish the contributor's responsibility for the work they submit."

will be true in the sense of "Who the hell is responsible for this mess?"

BlueRoguesDevel•about 4 hours ago

I hope it works out better than Microsoft and using it on Windows 11...

LeoPanthera•about 3 hours ago

Do we know that Windows 11 has suffered due to the use of genAI or is that just a random snipe?

tehbeard•about 3 hours ago

It's based off that 30% of code written by AI quote from the MS CEO last year.

https://www.cnbc.com/2025/04/29/satya-nadella-says-as-much-a...

Note that he said written by, not assisted; and also that there's been some major QA issues with win11 the last year, enough for Microsoft to have made a public apology/commitment to improve...

So, no definitive evidence, but the rest of the breadcrumbs provide enough to say that yes it does appear to have suffered from it.

Given the Debian policy seems more geared towards aided/assisted an existing dev than replacing them and shipping because the code works on the golden path on a devs monster pc ... Well I'd still keep an eye on it but trust OSS OS engineers to have some competence at knowing if this works and adjusting the policy later if it proved to be wrong.

yoyohello13•about 2 hours ago

They’ve broken their own record of massive breaking updates in the last year.

LoganDark•about 3 hours ago

Either they're using GenAI or the entire team collectively lost their minds and started getting a huge number of colossally bad ideas about fundamental primitives of Windows that hadn't changed for decades. Backwards compatibility used to be the major concern and now it feels like they didn't even know what would break ahead of time. If that doesn't feel like GenAI then I don't know what does

chuckadams•about 3 hours ago

Believe it or not, I find it more plausible that the entire team collectively lost their minds — or more specifically, the leadership. There's a long and sordid history of such things that goes back well before GenAI.

marcosdumay•about 3 hours ago

Keep in mind that Microsoft laid-off a large share of their developers shortly before and during the interval the GP talks about.

Repeatedly.

You are right that's one or the other. Probably both are contributing.

loloquwowndueo•about 3 hours ago

lol windows doesn’t need AI to be the dumpster fire it’s always been

outside1234•about 3 hours ago

Source?

The rumor is the opposite, that Microsoft has actually used AI to discover and fix common security issues at scale.

ang_cire•about 3 hours ago

Those are 2 different questions. They wouldn't even be the same people involved.

Your appsec engineers will be the ones bug hunting with Mythos or whatever. Your regular engineers will be the ones implementing features. If the feature is a bad design and functions badly as a result, that is entirely orthogonal to whether it contains coding errors or bugs.

Also, there are bugs on the integration side that won't be caught running Mythos against source code, because it's not a source code issue. Even using Mythos for DAST is going to be very limited compared to how actual users will move through something as complex as a 'mature' OS like Windows.

mistrial9•about 3 hours ago

> common security issues

the entire industry is experiencing this as model capacity increases. How does "all projects get critical security fixes now" relate to "crap apps and loopy services by literally millions of lines of slop code" ?

guenthert•about 3 hours ago

If they can't be bothered to write the code, can they be bothered to maintain it?

throwawayffffas•about 3 hours ago

And so it begins.

I don't believe they had a choice though, sticking to hand written code would be backwards and eventually meaningless as people would just submit generated code as "handwritten", the coding models are quickly becoming capable enough for this.

I wonder what it means copyright wise though. To what degree is the code even copyrightable if it's entirely generated, even if you review and provide feedback.

mariusor•about 3 hours ago

I think most communities tackling this issue, or at least the open source ones, work on a honour basis for determining if a project is LLM based or not.

ButlerianJihad•about 3 hours ago

My predictions for genAI code in F/OSS projects: https://news.ycombinator.com/item?id=49203613

1. Companies will revert to closed-source and cease contributions to F/OSS projects. Their legal team will advise them that trade secrets are the only way to protect LLM-generated code.

2. Contributors to F/OSS projects, and developers who run them, will falsely claim authorship of the code written by LLMs.