The without disclosure part tells everything you need to know here. If it’s such a benign and maybe even beneficial thing to do then why are you hiding it? What possible reason could you have not to label that? In an open source Community shouldn’t everything like that be known?
There are so many levels of LLM involvement and once you make this distinction you actually have to devote some of your limited resources to define and enforce it. So I think it might not be strictly beneficial, but possibly also have downsides.
Where would you draw the line at which point it counts as LLM involvement? Having one run as some sort of spell/syntax checker? Doing some research (and being influenced by it) before hand coding something? Having it create a working prototype and then reimplementing it by hand? If you use code from somewhere else to solve a problem and ai use has not been disclosed for this code, do you automatically have to assume LLM usage was involved or is there plausible deniability?
I think in the end you’d have to use too many resources check it and debate where the line is drawn, when the real question is how you retain human knowledge and engagement within your community.
I wonder what’s the reason to make it optional? I think I’ve seen this approach with other projects as well. Isn’t transparency and accountability a good thing? Also, this kind of information helps immensely when reading pull requests or silly bug reports. And Debian acknowledge there might be licensing issues. So it might become some sort of liability to them once it taints everything and we can’t even tell?! So why? What’s the upside? Adorn oneself with borrowed plumes and not being forced to disclose the fact? Or too much bookkeeping?
I think that’s a commendable effort. Usually I do it the same way. Just feels massively unfair to me towards human contributors. I’ve seen the AI pull requests and bugreports come in. And it’s very time consuming to deal with them. They’re long, convoluted, touch a lot of code… There’s frequently a good amount of “hallucinations” in them, because they’re sent in autonomously or by people who don’t know what they’re doing. There might be dozens of them in quick succession as with the larger projects. They eat up time and effort which is now missing to deal with human contributions or wishes. My own opinion is: Transparency would help a lot to prioritize stuff. I mean AI isn’t sentient, and as long as that holds true, I’d rather treat people with respect and the amount of attention they deserve… (In contrast to a level playing field between human and machine… Because the machines will easily beat us by sheer volume.)
True, but I think the kind of people who send those monster PRs either already have AIs cosign it or they aren’t reading the policy anyway. There have also been a number of studies that show LLMs usually ignore this kind of instruction.
Hmmh. Sure. People also deliberately instruct their agents not to reveal the fact. I can empathize with that, because there’s all these people out there yelling at you, and launching shit storms.
I believe the uptake in “co-authored by …” is due to some companies making it the default setting in their frameworks. It’s to some degree Microsoft being nice to us, not necessarily benevolence of the people sending in those PRs. Doesn’t really matter to me though. It’s enough to make me happy if that’s attached to some commit or PR. I don’t care how it got there, as long as it fits the purpose.
Edit: And thanks for your comment. I don’t think I agree. Nonetheless this might be the answer to my question.
There are ways to enforce it.
Yeah, you won’t be able to make everyone follow the rule, but it’s the same with any law and any public policy and they’re still valuable.
You don’t make campaigns against DUI because you expect everyone to stop doing it, as that’s a nirvana fallacy, you make them because you expect them to reduce DUI.
Not really worth discussing - it’s not benign, and it can be made purposefully not benign by a third party without notification or knowledge. A third party who has already demonstrated a penchant for world domination, both technologically and physically.
I should hope that open source developers are exclusively using open source models that are trained on open source projects.
I mean, I would think, at least. It seems to me that most of the people in charge of big projects are usually FOSS purists.
That’s part of the reason why AI scrapers are breaking the small web. FOSS purists really have no significant defense against it aside from Anubis.
Real DoS protection comes from capacity, which costs serious dollars, especially in this day and age where botfarms can be hired by the hour for rather cheap and record-breaking attacks seem to happen like monthly.
The alternative is using a CDN, but there are none that align with FOSS ideals. And for CDNs to be really effective, you need them to break open TLS and handle the decrypted traffic, which raises privacy concerns on top.
But anyways…most license agreements would make it a requirement that if you’re using an open-source model, that it be properly attributed, right?
I should hope that open source developers are exclusively using open source models that are trained on open source projects.
Most developers who use these tools (even FLOSS developers) appear to be using the corporate owned models that were definitely trained on both proprietary source code and code that is incompatible with the GPL license. Some EU courts have also already judged that LLM code cannot be copyrighted, which also means it cannot be licensed as GPL.
Currently, all code generated with an LLM has a 3 to 10% chance of unknowingly plagiarizing the copyrighted code it was trained on, and any FLOSS project that uses it is making a huge gamble that their codebase won’t be scanned by corporations in the future looking for violations to sue about, shut down rival FLOSS projects, etc.
Eye contact is benign for most of us. We still give it a context warning in civilized circles. It costs us almost nothing, and lets people make an informed decision what you engage with.
The without disclosure part tells everything you need to know here. If it’s such a benign and maybe even beneficial thing to do then why are you hiding it? What possible reason could you have not to label that? In an open source Community shouldn’t everything like that be known?
We saw this play out with GMO foods:
later:
In the us anyway the food is labeled as bio-engineered, and everyone still buys it
There are so many levels of LLM involvement and once you make this distinction you actually have to devote some of your limited resources to define and enforce it. So I think it might not be strictly beneficial, but possibly also have downsides.
Where would you draw the line at which point it counts as LLM involvement? Having one run as some sort of spell/syntax checker? Doing some research (and being influenced by it) before hand coding something? Having it create a working prototype and then reimplementing it by hand? If you use code from somewhere else to solve a problem and ai use has not been disclosed for this code, do you automatically have to assume LLM usage was involved or is there plausible deniability?
I think in the end you’d have to use too many resources check it and debate where the line is drawn, when the real question is how you retain human knowledge and engagement within your community.
Just disclose how you used it.
“Just” like with GDPR, “just” follow the rules for personal data management. In reality, compliance stuff like that is expensive to implement.
So if you are going to require it, don’t pretend it is without cost. Which is exactly what you seem to be doing.
I wonder what’s the reason to make it optional? I think I’ve seen this approach with other projects as well. Isn’t transparency and accountability a good thing? Also, this kind of information helps immensely when reading pull requests or silly bug reports. And Debian acknowledge there might be licensing issues. So it might become some sort of liability to them once it taints everything and we can’t even tell?! So why? What’s the upside? Adorn oneself with borrowed plumes and not being forced to disclose the fact? Or too much bookkeeping?
Because the idea is to judge the code by its quality, not by who or what wrote it.
I think that’s a commendable effort. Usually I do it the same way. Just feels massively unfair to me towards human contributors. I’ve seen the AI pull requests and bugreports come in. And it’s very time consuming to deal with them. They’re long, convoluted, touch a lot of code… There’s frequently a good amount of “hallucinations” in them, because they’re sent in autonomously or by people who don’t know what they’re doing. There might be dozens of them in quick succession as with the larger projects. They eat up time and effort which is now missing to deal with human contributions or wishes. My own opinion is: Transparency would help a lot to prioritize stuff. I mean AI isn’t sentient, and as long as that holds true, I’d rather treat people with respect and the amount of attention they deserve… (In contrast to a level playing field between human and machine… Because the machines will easily beat us by sheer volume.)
True, but I think the kind of people who send those monster PRs either already have AIs cosign it or they aren’t reading the policy anyway. There have also been a number of studies that show LLMs usually ignore this kind of instruction.
Hmmh. Sure. People also deliberately instruct their agents not to reveal the fact. I can empathize with that, because there’s all these people out there yelling at you, and launching shit storms.
I believe the uptake in “co-authored by …” is due to some companies making it the default setting in their frameworks. It’s to some degree Microsoft being nice to us, not necessarily benevolence of the people sending in those PRs. Doesn’t really matter to me though. It’s enough to make me happy if that’s attached to some commit or PR. I don’t care how it got there, as long as it fits the purpose.
Edit: And thanks for your comment. I don’t think I agree. Nonetheless this might be the answer to my question.
I think it’s just the simple fact that there’s no way to enforce it
There are ways to enforce it. Yeah, you won’t be able to make everyone follow the rule, but it’s the same with any law and any public policy and they’re still valuable. You don’t make campaigns against DUI because you expect everyone to stop doing it, as that’s a nirvana fallacy, you make them because you expect them to reduce DUI.
With systems starting to move to watermarking tech a lot of them will actually be detectable.
Either way that doesn’t make it a bad idea or less useful.
Which tells a lot about how good they are. Slop is slop because it’s bad, but a high quality PR isn’t
It’s a good question for the people using it but the point is that you can really verify if someone is using it or not
Conversely… if it’s so benign, why should it have a label?
Not really worth discussing - it’s not benign, and it can be made purposefully not benign by a third party without notification or knowledge. A third party who has already demonstrated a penchant for world domination, both technologically and physically.
Code in general is proven not to be benign
Excuse you my code doesn’t even compile properly, so it can not be malign by definition.
I should hope that open source developers are exclusively using open source models that are trained on open source projects.
I mean, I would think, at least. It seems to me that most of the people in charge of big projects are usually FOSS purists.
That’s part of the reason why AI scrapers are breaking the small web. FOSS purists really have no significant defense against it aside from Anubis.
Real DoS protection comes from capacity, which costs serious dollars, especially in this day and age where botfarms can be hired by the hour for rather cheap and record-breaking attacks seem to happen like monthly.
The alternative is using a CDN, but there are none that align with FOSS ideals. And for CDNs to be really effective, you need them to break open TLS and handle the decrypted traffic, which raises privacy concerns on top.
But anyways…most license agreements would make it a requirement that if you’re using an open-source model, that it be properly attributed, right?
Most developers who use these tools (even FLOSS developers) appear to be using the corporate owned models that were definitely trained on both proprietary source code and code that is incompatible with the GPL license. Some EU courts have also already judged that LLM code cannot be copyrighted, which also means it cannot be licensed as GPL.
Currently, all code generated with an LLM has a 3 to 10% chance of unknowingly plagiarizing the copyrighted code it was trained on, and any FLOSS project that uses it is making a huge gamble that their codebase won’t be scanned by corporations in the future looking for violations to sue about, shut down rival FLOSS projects, etc.
It would be Useful for doing a retrospective on whether AI is helpful or not
Eye contact is benign for most of us. We still give it a context warning in civilized circles. It costs us almost nothing, and lets people make an informed decision what you engage with.