I lean more towards Nussbaum’s position. Allow it only when the submitting person can explain the changes. That would at least put completely vibe-coded submissions out of Debian.
That being said, I would ban fully automated submissions from bots and agents. A human still needs to have a part in it, in my opinion.
Yeah, I agree. In practice it’s difficult to tell whether or not someone used AI to help them code something (especially if they didn’t just tell the LLM to do everything lmao), so it makes more sense to check whether they actually understand the code they’re trying to commit. That’ll keep out the slop while still letting people use coding LLM agents as a static analysis tool for finding bugs or something.
I think I’d be okey with semi automated submissions if they are managed by the maintainer themselves. There were a couple of security incident of long existing vulnerabilities recently. I think its fine if maintainers have a bot running making security audits to find and fix them before somebody else can use them. Of course if some human going over potential PRs.
the most basic rule of thumb that should ALWAYS be held to is that a human has to take responsibility for the actions of a tool, computers cannot be held accountable.
A computer can never be held accountable, therefore computers must never make a management decision.
Rules about submissions and determining if a pr helps a project is a management decision. AI or automated tools can reject a PR if it fails to meet a human made rule (like failing to compile or breaking code standards) but accepting a pr to merge? That should be a human.
I lean more towards Nussbaum’s position. Allow it only when the submitting person can explain the changes. That would at least put completely vibe-coded submissions out of Debian.
That being said, I would ban fully automated submissions from bots and agents. A human still needs to have a part in it, in my opinion.
Yeah, I agree. In practice it’s difficult to tell whether or not someone used AI to help them code something (especially if they didn’t just tell the LLM to do everything lmao), so it makes more sense to check whether they actually understand the code they’re trying to commit. That’ll keep out the slop while still letting people use coding LLM agents as a static analysis tool for finding bugs or something.
I think I’d be okey with semi automated submissions if they are managed by the maintainer themselves. There were a couple of security incident of long existing vulnerabilities recently. I think its fine if maintainers have a bot running making security audits to find and fix them before somebody else can use them. Of course if some human going over potential PRs.
the most basic rule of thumb that should ALWAYS be held to is that a human has to take responsibility for the actions of a tool, computers cannot be held accountable.
A computer can never be held accountable, therefore computers must never make a management decision.
Rules about submissions and determining if a pr helps a project is a management decision. AI or automated tools can reject a PR if it fails to meet a human made rule (like failing to compile or breaking code standards) but accepting a pr to merge? That should be a human.