I noticed there are a lot of open source projects that are adding policies for AI-generated (automatic or not) contributions or outright banning its use. I can understand the why, and I think that realistically the core problem is heavily rooted in accountability and people learning how to use tools/technology properly, maybe even with consideration of how it would impact others.
I’m curious to hear what others think about this trend. Also wondering what people think a reasonable solution would be, as it seems there’s sufficient noise that GitHub has a discussion open about it.
Policies or articles I found (not complete, certain there are more):
llama-cpp adds section in Agents.md file a clever move in my opinion
As of today, I do not think there is a solid solution beyond an outright ban on it being used for direct submissions. I see no problem with an experienced dev using it. But allowing end users or corporations to step into the process by spamming AI slop will only bog down the open-source development process.
This will really come down to the individual maintainers though and each will need to come to solution that fits their process/needs. I would not want it directly involved with the process as an unpaid volunteer as it just seems like it would create unnecessary and pointless work.
I’ve been there, even before “vibe coding” was a thing, and yeah it’s not fun. I’ve even seen contributors get upset that no one is reviewing their pull request with 3k line changes, which is just
I’ve actually had to push back on more experienced devs using it at my work, as they sometimes tend to make giant PRs. There was someone who did this and had over 6k lines of code changes/additions. It was odd for me, as the most junior person, to have to call this out as a terrible practice. That PR took weeks to review, and I think all and all, there were 1700+ comments. Despite that horrific event, there are still massive PRs getting opened up by senior devs, and subsequently getting stalled for weeks b/c no one can or wants to review them. All that to say, even someone experienced seems to have challenges with properly wielding these tools (in the open-source space or otherwise).
The bottom-line is always going to centre around enforcing what your LLVM link states as “The contributor is always the author and is fully accountable for their contributions”.
Right now we’re in a place where people are randomly doing daft stuff like fully automating AI agents to just spin through repos and fire off PRs. I wouldn’t blame any large project for just closing the door on that noise. Hopefully culture and tooling will catch up and give projects the ability to filter more effectively.
For dev in general the “giant PR” problem just seems like a situation where dev culture and processes will have to change. Pre-AI, I’ve been in situations where a giant changeset was required (for example patching up a legacy codebase where an insecure pattern was used in hundreds of files). It was obvious that you don’t just dump that on a reviewer like it’s a normal Tuesday so people were warned, plans made and agreements reached about how the change would be handled.
Post-AI, we’re in a world where it’s possible for every dev to drop that amount of code every Tuesday and every other day of the week. Dev practices are going to have to work out how to ensure that we aren’t generating thousands of lines of worthless garbage and then how to deal with that amount of code if it represents worthwhile features. If AI delivers on productivity claims then there’s just going to be a ton of code to review, whether in small chunks or large chunks.
Folks need to stop pretending that AI code quality is actually “good”. It’s not “good”. The overwhelming majority is, at best, “barely passable”. If it was submitted to a teacher for grading, it would get a C- and no more. Any developer that thinks C- contributions should be enthusiastically received by OSS projects needs their head read.
If you’d rather whip up a prompt then head to a café for smashed avocado on toast and a soy latte, rather than actually put in the time and effort to write decent quality code, then you are a perfect cultural and talent fit for the likes of Microsoft, Google, Meta and so-on.
In its current state, I don’t think there’s any place for AI contributions in the OSS world at all. High speed and volume AI slop just drowns projects, reduces code quality, sabotages maintainability, and increases the chance of project abandonment. AI contributions are literally a poison pill.
The ONLY valid use I see for AI in OSS is to help diagnose problems like “Why is this code failing the unit test?” … “Because you are missing a semi-colon here … because the logic on this line is flawed … because the exit conditions for this loop can not be achieved … because the scope and value of this variable is ambiguous at this point …” AI shouldn’t be used to create code. It should be used to help debug code.
Linus’s Law: “Given enough eyeballs, all bugs are shallow.” Use AI as extra eyeballs, not to avoid using your own brain.
I’m a big fan of Gentoo’s policy that makes you certify that “this contribution has not been created with the assistance of Natural Language Processing artificial intelligence tools.”
We’ve seen how the “AI revolution” has been treating Microsoft:
Agreed, the traditional practices have not been updated yet to figure out how to deal with this. Definitely some sorting out there in the OSS realm and businesses. OSS has to manage a larger surface area, so makes sense they put up guardrails or even blocks to mitigate the burden(s) that AI development has brought with it.
My first thought, not that I feel it’s the best or even good idea, was for OSS projects to push these contributors to fork the project if they’re so dire to add features. I know it could splinter the community, which is not what the maintainers would want. I also know it’s unlikely that many of the contributors these projects are trying to curb would be passionate or driven enough to publish and manage a fork of the project (a little bit of the point). Any who did, might learn first hand the pains of maintaining an OSS project…maybe
My understanding is that the majority of people with a reasonable background in development, feel AI code is “good enough” meaning good enough to provide the intended functionality. Inexperienced people may think it’s “good” because it’s better than what they can do, which is either very little or nothing.
Businesses love it, which I think you elude to, because it’s a way to deliver results faster and more efficiently. Again, no claims about “good” here, just good enough, and even then…likely terrible cough cought Microsoft.
I would push back on this in a minor way. If someone wants to build and maintain an OSS project themselves using AI, or are okay with their OSS project accepting AI contributions, I don’t think there’s any reason they shouldn’t, given they’re upfront about it. There might be a lot of hard lessons for the maintainer to learn in the future. Sure, the project could actually do damage to users of using the project, but they are opting in to use it and if the maintainer of the project is open about their use, then they should be aware of that.
Where do I agree with you, is that AI code shouldn’t be forced onto any OSS project from external sources or involuntarily. That’s just blatant disregard or disrespect of others’ time.
I think a complete ban on AI generated code is necessary. Multiple reasons why I think this, but I think the main reason is people vastly overestimate the capabilities of LLM’s to generate code.
Most of the LLM’s are trained on the internet which contains a lot of garbage, meaning in turn the output will be garbage.
Most of the context windows for these LLM’s are too small, meaning for larger code bases it will not be capable of correctly solving a problem in the codebase.
Another thing is that the less training data you have, the worse it’s going to be. I’ve been programming in Zig for a little while now and all the AI’s cannot generate compileable Zig code to save their life.
So if you don’t plan to use Python or Javascript, you are cursed with lower quality output.
We need a AI that can actually reason, as in it’s actually thinking like humans do for a AI tool to me more useful for code-gen then a glorified type completion tool
Until the AI crowd realize LLM’s are already obsolete then the Ban must remain in effect.
A little bit of extreme opinion perhaps, but if you actually use these tools, you realize how limiting they actually are.
Honestly I believe that’s part of the fascination from the engineering and research side. I’m certainly biased, because that’s my personal perspective. Given the limitations of the tools, figuring out how can I make it workable for me is honestly a bit fun and interesting.
That said, I don’t like foisting my experiments on others. I’ll subject myself, because I’m a willing participant, but I won’t do it to others. In all honesty, I think that limited personal use is where AI code can have the most benefit. There are times when I want to get something done, and I know I could write it, but I need it for something once, I’ll have an LLM generate the code and refine it, while I work on something else. Once it becomes something I want to reuse or share, then it’s time to roll up the sleeves and get to work.
My hot take on the genesis of LLMs, is that they’re a product of an extended and overemphasis on “producing results as quickly as possible” as opposed to “building systems that nurture success.” The former enacting ‘the ends justify the means’ as a policy, whereas the latter is focused on sustainable deliveries and improvements.
The projects don’t need university kids spamming half assed patches written by LLM’s, and frankly I wouldn’t spend the time to workout if they are human either.
I think it really comes down to the scope and complexity of the project.
For low level libraries I think it is reasonable to say that there should be no LLM contributions allowed period. You need someone with a deep understanding of the project to look at the code, and LLMs are just not that. For low level libraries there’s just too much on the line when it comes to security and stability, and to an extent maintainability.
Another example is also OBS Studio outright banning any and all LLM contributions. There have been a bunch of obviously AI generated PRs in the past and they make wildly inaccurate assumptions about how OBS works internally, or how it uses external libraries. OBS is a highly complex project that even human contributors tend to have a hard time getting into, so it’s not exactly surprising that LLMs have no clue what’s going on under the hood.
For small and simple projects I don’t think it’s that big of a deal, so maybe™ fine.
But there’s also another side to the coin, which is the users of the software. I like to look at release notes for some of the stuff I use and when they link to the PR where the description is just AI slop that doesn’t tell me what the hell was actually changed, it’s annoying. This is just an example:
This is like 5 pages of LLMs talking to themselves and as a user I have no idea what the fuck is going on.
When I skim through those comments, 90% is just irrelevant bullshit. The summary is barely legible, and all 3 of the bullet points are the same thing in different words. And the “comments” just restate the same thing over again as well. And also they explain the code side which… I mean if I wanted to look at the code, I would… oh I don’t know look at the code maybe. I cannot imagine anyone is actually looking at this and saying “ah yeah OK I wanted this feature”.
How hard would it have been to write 2 sentences about what the feature is and does and maybe add a screenshot?
I think I have a rough idea of what this is supposed to do, but I much prefer a clear description of the motivation and context of a change. Example:
Yes this probably took a half hour to type up, but future maintainers will be able to look at this and say “OK yeah that makes sense now”, and even I as a user can understand what this is about.
Every time you call them, AI, you are endorsing the claim that they are intelligence and they’re not. So, let’s refuse to do that. I’ve come up with the term ‘pretend intelligence.’
RMS - Seven Years After, Stallman Is Still Stallman - FOSS Force
The banning seems reasonable to me. Between the dubious quality and the dubious copyright, I just don’t see any giant benefits.
Business/commercial/professional software development is very different so the extensive embrace of pretend intelligence there isn’t much of an indicator in itself that it’s a good idea for FOSS . It can be highly performative, politics is central, and in today’s environment your job is a fickle thing. You might be fired tomorrow, or your project might be axed, or your company might be acquired, or run out of runway. Thus your personal long term investment in the code bases should not be too high. So if the CEO wants slop, well…Slop it is!
Yeah, good point. Quality is subjective. Your “good enough” is equivalent to my “barely passable”. Barely passable (C-) is still passable, however. It does (technically) work. An inexperienced developer probably wouldn’t get fired by Micro$lop for submitting such code. An experienced developer, however, understands that “good enough” (C-) quality submissions are actually going to cause problems down the track, which is why “good enough/barely passable” is not actually good enough for an OS project you have invested a good chunk of your life into and care about. Good enough for corporate/government projects, though.
Oh, absolutely. If it’s AI “all the way” then folks should feel free to go nuts. I’ll just stand well back and watch while they crash and burn.
Seriously, though… We actually NEED folks to keep working on this. AI’s ability to generate code will get better — I’m sure. The only way that’s going to happen, however, is if folks who want to be at the bleeding edge are happy to get cut. Good on 'em. They’re taking one for the team.
Since corporations like Google are (ab)using browser+search monopolies and AI to screw over us poor peasants, I was quite amused, about a week ago, to read about a project where someone was trying to use AI to build a web browser! I forget the name of the project, and AI slop is drowning out the results when I search for “ai created web browser”, but I’m sure it’s a real thing. Having spent all that money and effort creating a browser so complex that it is impossible for Open Source developers to come up with a non-malware-infested competitor with feature parity, it would be so ironic if AI could be used against Google to create such a browser and break the monopoly. “Ouroboros” anyone?
Given my newness to software development and the fact that I don’t deal with low-level code (basically at all), this is an extremely salient point that I wasn’t even aware that I missed. It’s kind of obvious in retrospect of course, and I 100% agree that trying to use LLM generated tools here has to have surgical grade precision (or better).
Agreed. I despise the auto-generated replies by users (of any kind). For some users, I will concede that they may copy-paste LLM translated text, which I give a pass, I would prefer they stated so directly however. End users using auto-replying LLMs isn’t helpful and just generates noise. Organizations that use the same, for whatever purpose, that don’t label the account as a bot (mimic accounts) is the worst in my opinion; I’m still not crazy about auto-bot replies that are from accounts labeled as such when they don’t have an opt out mechanism.
The
Yeah, it’s definitely annoying, however I will admit I use the builtin Copilot description generation for PRs often. The difference for me might be that I end up trying to cut out 70% of what it generated to get to the meat of what’s important, and often find myself re-wording what was written or adding some additional context that was missed. I’m of the opinion that the fluff should get cut and these should just get to the point.
The thing about that though is that at the end of it all you spent more time reading and cutting through the BS then it would have taken you to write it from scratch to begin with. I just don’t see the utility in it. If I need to proofread and correct what it’s spitting out, I might as well just type it up as I go.
It also helps to just have reasonable commit messages to begin with. Because then when you rebase and/or squash you already have everything you did and just need to put it in somewhat coherent sentences (or leave it as bullet points, whatever you prefer).
I agree with you, and I hadn’t heard that comment before, so thanks for sharing. FWIW, the only reason I brought up businesses, is b/c there are some that have FOSS projects, or their products are built on/around one. Since there is some overlap, it seemed salient to point out where some OSS projects are owned/maintained by an organization with a for-profit business component. These projects, I suspect, will take a softer stance on contributions with LLM code, since the maintainers will likely be using LLM generated code as well. I didn’t specifically draw out that point earlier, but I’ve mulling this over more, and realized that it’s one aspect I think will be interesting to observe over time.
If I were consistent enough to write things out as I did them, I believe you’re correct. Good commit messages definitely help and I do my best to be specific with the details of each commit. The reason that I use the generate and edit path is b/c it usually saves me some time. Often b/c I don’t remember everything by the time I open a PR (my memory is notoriously selective), which good commit messages help with, but I suspect that’s a shortcut the LLM uses as well.
Perhaps there’s a better/quicker way to approach writing PR descriptions, but I haven’t found one yet that works better/faster for me. Since most of what I do with the edits is delete what I consider fluff, it’s reasonably quick. The re-wording things is mostly so it reads better to me, so it doesn’t take long.
