Re: Looking for advice on how to deal with potential slop packages

--=-=-=
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

Micha=C5=82 G=C3=B3rny <[email protected]> writes:

> Hello, everyone.
>
> Seeing more and more packages embracing LLM-driven development (to the
> point of "vibe coding" or slopware), I'm looking for your ideas on how
> distributions should deal with that.  I'm basically torn between three
> things:
>
> 1. My duty towards the users to deliver up-to-date versions of software.
>
> 2. My duty towards the users to deliver *good* and *secure* software.
>
> 3. My ethical concerns, both directly related to LLM use, and to what
> people are using them for.
>
>
> As you may recall, Gentoo has already a strong policy prohibiting "AI"
> contributions [1].  However, this policy applies merely to contributions
> to the Gentoo projects themselves, and it does not affect the software
> we package.  In fact, compared to binary distributions, Gentoo has had
> rather relaxed approach to what's acceptable, that could be summarized
> as "as long as it's not outright malicious and somebody is going to
> maintain the package".  But over time, I'm having more and more concerns
> about the state of FLOSS in general.
>
>
> The first really doubtful case I've hit was the autobahn project.  I've
> learned that it started using LLM-backend coding after it had a series
> of releases with *really weird* issues (like "how that could even
> happen?!" kind of issues) [2,3,4], and my bug reports were met with lots
> of AI slop generated replies, and pull requests that were also complete
> slop.  I've eventually called the problem out, and upstream pretty much
> lashed at me [5].  Since then, I haven't pushed any new autobahn
> versions.  While the issues I've hit were largely related to packaging,
> I have no reason to believe that the actual code is any better.  So this
> is a case of rejecting slop on basis of low quality.
>
> The second big issue which you probably heard of is one of the
> maintainers of chardet using an LLM to rewrite the code while erasing
> the original autorship and changing the license, and then being an
> asshole about it [6] (you don't want to read that thread, it's complete
> shitshow with almost everyone cosplaying lawyers).  Here the primary
> concern is copyright and ethics, but it also makes you wonder what the
> actual code quality is.
>
> Of course there are just two examples.  There is a lot of projects using
> LLMs to various degree, and raising different concerns.  On the other
> hand, I feel like a lot of these concerns existed before already, and it
> is just that we previously didn't pay attention that much.  I mean, it's
> easier to say "they're using an LLM, it must be slop" than actually
> inspect the code and say "it's really bad quality".  And people were
> being assholes long before LLMs.
>
>
> What are your experiences, thoughts and ideas how to deal with this?  I
> mean, staying on old software versions and hoping people will change
> their minds (or more precisely, LLMs will stop being subsidized and
> people will have to start paying serious money for their usage) is not
> exactly a good idea.  Going around and telling people "please switch
> from dependency X to Y because X is slop (and Y isn't yet)" doesn't
> sound like the best use of our time either.  And forking?  With the
> depressing state of FLOSS these days, I can't even find energy to
> maintain my own projects, let alone take anything else.
>
>
> [1] https://wiki.gentoo.org/wiki/Project:Council/AI_policy
> [2] https://github.com/crossbario/autobahn-python/issues/1716
> [3] https://github.com/crossbario/autobahn-python/issues/1735
> [4] https://github.com/crossbario/autobahn-python/issues/1782
> [5] https://github.com/crossbario/autobahn-python/discussions/1818
> [6] https://github.com/chardet/chardet/issues/327
>
> --=20
> Best regards,
> Micha=C5=82 G=C3=B3rny

Hi Micha=C5=82,

Contributor for GNU Guix here. This same topic is bringing up a lot of
dicussion too.

In my point of view, an easier starting point is to know if
LLM-generated code can be free software or not.

If one can conclusively say that LLM-generated code is not free
software, then we can relegate these projects to the nonfree channels
where they can live their best slop-life with their proprietary friends.

For me, that would be the best outcome.

This is also important community-wise, so that existing free software
projects don=E2=80=99t start using slop libraries, at which point it will be
harder and harder to maintain a completely free system.

I also imagine that LLM-generated software will break compatibility very qu=
ickly
with older versions so it will be pretty hard to keep previously free libra=
ries.

Good day,
No=C3=A9

--=-=-=
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQHGBAEBCAAwFiEEXVTPJVeyOOiNwYCiLSIyQQq3QEMFAmmsFRMSHG5vZUB4bi0t
bm8tY2phLmV1AAoJEC0iMkEKt0BDAlML/1HrsXgdlLaNzRwFpJ0klGydIh7nOX0W
bJnS0S/1FzUVDAXu0cWOzeUns0HFotU5jvCKwrt3ZQVf12o8DGyK0q3LTx0PrXVe
5pSXAMgTLQPqJfipC8atCxe4hJ0TjXaCw8l07MpX/fdo2m+KeFIuBFHxQjCVxrUr
JRny7GqW+6ksILZMEd/Vjm+kv7WtRrtqVMf4JxyjGbWYTg31jx//+X7Q8SD8fUCR
dS4HWQyCLv0p8FtyiO5UIVE0gRHPazvkShjNfb00k9/0myK+CF1jvcbqPEnQuqIx
DwCAciMTQFbbd8s1RPSa0qmWTCdNLFidHrC2kgIJAnDUgrPU9rfL0Xw0gYCABOaA
hbbveUPJHHU8N7dahwnQ7YLY0Gp4g/v9H9//XdznZ7cOaCCC+oEf9TFw0pBmrBdG
fwUKMiEtejSStdRQsII8INzIsC5k/xrG1x9L5fKYXna8LgCKxOwXBB1YeVjr5LcS
4a6gnNftmm7OEst8Rx+hylLwNzEQu5MMVQ==
=bvz3
-----END PGP SIGNATURE-----
--=-=-=--