Re: Ballot option: Debian is created by humans

Gard Spreemann <[email protected]> Wed, 12 Aug 2026 00:44:01 +0200
Newsgroups	gmane.linux.debian.devel.vote
Message-ID	<87ldacnuq6.fsf@moose>
"Theodore Tso" <[email protected]> writes:

> On Tue, Aug 11, 2026 at 04:10:00PM -0500, Gard Spreemann wrote:
>> The proposal deals with *direct* contributions to Debian, including, but
>> not limited to:
>> 
>> * Debian packaging
>> * Submissions (messages, bug reports, patches, etc.) to the BTS, Salsa,
>>   mailing lists and other Debian platforms 
>> * Debian project software
>> * Debian infrastructure
>> * Debian web resources
>
> What is meant by "Debian infrastructure" or "Debian web resources".

I meant computers run by the project, and web services run by the
project.

> Does Apache or the Linux Kernel considered part of the Debian
> infrastructure or Debian web resource?  These terms aren't explicitly
> defined, so this could lead to confusion.

Just their Debian packaging. Not their upstream parts.

>> With this principle in mind, the
>> proposal does not affect the use of generative AI as an assisitive tool
>> to explore, research, analyze, critique, etc., when contributing.
>
> If the Generative AI discoveres that there is a mising unlock in an
> error return path, does that count as an assistive tool?

Absolutely.

> What if it creates a patch which adds the missing mutex unlock?  Does
> that count as an assistive tool, or "generated code"?

That counts as generated code. Now, if the patch literally just adds an
unlock, then it's highly unlikely that you would write it differently
from the AI. So there is no way for anyone to distinguish between
AI-generated code and human-made code. And then, to me at least, the
whole question becomes moot under this proposal.

> And if we apply that patch on a Debian web server, would that be
> prohibited by this proposal?  Even if it prevents a high severity,
> actively exploited vulnerabity?

Since the patch is indistinguishable from human code, I don't think it's
where our discussion energy should go – if we assume good faith from
people using generative AI in an assistive capacity. I try to think
about it the way we think about generated code in a more traditional
sense. At some small size extreme, also (clasically, by say a build
script) generated code becomes so trivial that we probably wouldn't care
about discussing whether it's generated or not, no?

I agree that it's a weakness in my proposal that "trivial" (in size)
contributions – contributions that really can't end up very differently
whether written by an AI or a human – aren't addressed explicitly.

>
> "Humans create Debian" is a nice tagline, but it doesn't particularly
> well defined.  

That's true. But I also think it's true for most GRs that go beyond
purely technical things.

> After all humans are tool-using animals, including compilers and
> LLM's.

… and yet we frown upon compiled code in packaging contributions.


 Best,
 Gard
signature.asc (application/pgp-signature, 857 B)