Re: Looking for advice on how to deal with potential slop packages

--=-=-=
Content-Type: text/plain

Morten Linderud <[email protected]> writes:

> A lot of this is probably already a lost cause I think.
>
> Linux accept LLM contributions (look for the `Assisted-by` tags), and there are
> already multiple subsystems that are being developed in-part, or full, by LLM
> agents.

There is a distinction between the chardet case [0] or otherwise
massively-AI driven development introducing instability and bugs, and this.

>
> See the LWN discussion: https://lwn.net/Articles/1026558/
>
> `b4` has also incorperated llm agents for the review workflow.
> https://b4.docs.kernel.org/en/latest/maintainer/review.html#configuration
>
> b4 is also heavily developed by Claude these days.
>
> I don't think we can reasonably argue that Linux is not free software, and I
> don't think we can argue for forking Linux to remove llm generated code.
>
> My take on this is mostly apathy. I don't think we can reasonably challenge the
> use in the FOSS community. The productivity boost of experienced developers
> using these is too appealing when we are looking at overburdened FOSS
> maintainers.

It is of course your right to feel that way and I don't entirely
disagree, but I also think we have some responsibility to our users to
protect them in the way we always have.

I don't think that Linux having some AI-assisted commits means that we
can't discuss or perhaps even have some consensus on handling some packages.

Say, by trying to avoid new chardet and lobbying reverse dependencies to
not require newer versions if they do so, or to port to
charset-normalizer.

I don't think we'd have this response if some software was being made
proprietary. It's the same thing in that it requires some effort to
rebut, just like also if sometihng becomes unmaintained and has a
suitable alternative, or whatever else. We do that all the time.

> We've aleady been repeadetly DDoSed by these companies. Spending hundreds of
> volunteers hours keeping our services running while the companies extract the
> labour to sell back to the FOSS community, using their standing in the Linux
> Foundation to further cement their usage in our communities.
>
> Then the FOSS communities use these models without any care of the ethical considerations.
>
> Is this depressing? Yes.

[0] https://lwn.net/SubscriberLink/1061534/3040c9a3a6271043/

--=-=-=
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQEBBAEWCgCpFiEEJaa7iN2bdkxrVUHCc4QJ9SDfkZAFAmmw2BobFIAAAAAABAAO
bWFudTIsMi41KzEuMTIsMiwyXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25z
Lm9wZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXQyNUE2QkI4OEREOUI3NjRDNkI1NTQx
QzI3Mzg0MDlGNTIwREY5MTkwDxxzYW1AZ2VudG9vLm9yZwAKCRBzhAn1IN+RkHDY
AP9e7FC1SeD7kNXBnWx01JvpZkLwfCTB3ccPqwECCysS9wEA8TgvwaPBDOeHYZiK
9yQUN1c/EsP+jL2iFIu13Weryw0=
=Mwx9
-----END PGP SIGNATURE-----
--=-=-=--