Geiger’s proposal cites four main concerns: copyright, technical quality, impact on Debian’s volunteer community, and broader ethical issues related to generative AI.
I do not envy their position. Either way they are going to get irate comments.
I lean more towards Nussbaum’s position. Allow it only when the submitting person can explain the changes. That would at least put completely vibe-coded submissions out of Debian.
That being said, I would ban fully automated submissions from bots and agents. A human still needs to have a part in it, in my opinion.
Yeah, I agree. In practice it’s difficult to tell whether or not someone used AI to help them code something (especially if they didn’t just tell the LLM to do everything lmao), so it makes more sense to check whether they actually understand the code they’re trying to commit. That’ll keep out the slop while still letting people use coding LLM agents as a static analysis tool for finding bugs or something.
I think I’d be okey with semi automated submissions if they are managed by the maintainer themselves. There were a couple of security incident of long existing vulnerabilities recently. I think its fine if maintainers have a bot running making security audits to find and fix them before somebody else can use them. Of course if some human going over potential PRs.
the most basic rule of thumb that should ALWAYS be held to is that a human has to take responsibility for the actions of a tool, computers cannot be held accountable.
I do not envy their position. Either way they are going to get irate comments.
I lean more towards Nussbaum’s position. Allow it only when the submitting person can explain the changes. That would at least put completely vibe-coded submissions out of Debian.
That being said, I would ban fully automated submissions from bots and agents. A human still needs to have a part in it, in my opinion.
Yeah, I agree. In practice it’s difficult to tell whether or not someone used AI to help them code something (especially if they didn’t just tell the LLM to do everything lmao), so it makes more sense to check whether they actually understand the code they’re trying to commit. That’ll keep out the slop while still letting people use coding LLM agents as a static analysis tool for finding bugs or something.
I think I’d be okey with semi automated submissions if they are managed by the maintainer themselves. There were a couple of security incident of long existing vulnerabilities recently. I think its fine if maintainers have a bot running making security audits to find and fix them before somebody else can use them. Of course if some human going over potential PRs.
the most basic rule of thumb that should ALWAYS be held to is that a human has to take responsibility for the actions of a tool, computers cannot be held accountable.
“Written” by AI agents, no less.