Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Redox OS has adopted a Certificate of Origin policy and a strict no-LLM policy

gitlab.redox-os.org

Post reply on HN
Print view View original

31–40 of 504 posts

Re: Redox OS has adopted a Certificate of Origin policy and a strict no-LLM policy

#31

Post by usrbinbash »

lifis wrote: post #25
duskdozer wrote: post #18

Earlier quoted context omitted.

>Not sure how they can expect to make a viable full OS without massive use of LLMs, so this makes no sense. Why not?

Because it takes a massive amount of developer work (perhaps more than anything else), and it's very unlikely they either have the ability to attract enough human developers to be able to do it without LLM assistance. Not to mention that even finding good developers willing to develop without AI (a significant handicap, even more so for coding things like an OS that are well represented in LLM training) seems difficu…

> Because it takes a massive amount of developer work

You know what else takes "a massive amount of developer work"?

"any LLM-generated code must be reviewed by a good programmer"

And this is the crux of the matter with using LLMs to generate code for everything but really simple greenfield projects: They don't really speed things up, because everything they produce HAS TO be verified by someone, and that someone HAS TO have the necessary skill to write such code themselves.

LLMs save time on the typing part of programming. Incidentially that part is the least time consuming.

Re: Redox OS has adopted a Certificate of Origin policy and a strict no-LLM policy

#32

Post by repelsteeltje »

BlackFly wrote: post #15
khalic wrote: post #3

The LLM ban is unenforceable, they must know this. Is it to scare off the most obvious stuff and have a way to kick people off easily in case of incomplete evidence?

It is enforceable, I think you mean to say that it cannot be prevented since people can attempt to hide their usage? Most rules and laws are like that, you proscribe some behavior but that doesn't prevent people from doing it. Therefore you typically need to also define punishments: > This policy is not open to discussion, any content submitted that is clearly labelled as LLM-generated (including issues, merge reques…

I think the bigger point about enforcement is not whether you're able to detect "content submitted that is clearly labelled as LLM-generated", but that banning presumes you can identify the origin. Ie.: any individual contributor must be known to have (at most) one identity.

Once identity is guaranteed, privileges basically come down to reputation — which in this case is a binary "you're okay until we detect content that is clearly labelled as LLM-generated".

[Added]

Note that identity (especially avoiding duplicate identity) is not easily solved.

Re: Redox OS has adopted a Certificate of Origin policy and a strict no-LLM policy

#34

Post by ptnpzwqd »

lifis wrote: post #16

Not sure how they can expect to make a viable full OS without massive use of LLMs, so this makes no sense. What makes sense if that of course any LLM-generated code must be reviewed by a good programmer and must be correct and well written, and the AI usage must be precisely disclosed. What they should ban is people posting AI-generated code without mentioning it or replying "I don't know, the AI did it like that" to…

The problem is the increasing review burden - with LLMs it is possible to create superficially valid looking (but potentially incorrect) code without much effort, which will still take a lot of effort to review. So outright rejecting code that can identified as LLM-generated at a glance, is a rough filter to remove the lowest effort PRs.

Over time this might not be enough, though, so I suspect we will see default deny policies popping up soon enough.

Re: Redox OS has adopted a Certificate of Origin policy and a strict no-LLM policy

#35

Post by holyra »

baq wrote: post #17

While I appreciate the morality and ethics of this choice, the current trend means projects going in this direction are making themselves irrelevant (don't bother quipping at how relevant redox is today, thanks). E.g. top security researches are now using LLMs to find new RCEs and local privilege escalations; no reason why the models couldn't fix these, too - and it's only the security surface. IOW I think this stanc…

People can choose not to use AI. This is because they think it is inevitable that they will eventually use LLMs.

Re: Redox OS has adopted a Certificate of Origin policy and a strict no-LLM policy

#36

Post by tentacleuno »

_zagj wrote: post #26
khalic wrote: post #3

The LLM ban is unenforceable, they must know this. Is it to scare off the most obvious stuff and have a way to kick people off easily in case of incomplete evidence?

> The LLM ban is unenforceable Just require that the CLA/Certificate of Origin statement be printed out, signed, and mailed with an envelope and stamp, where besides attesting that they appropriately license their contributions ((A)GPL, BSD, MIT, or whatever) and have the authority to do so, that they also attest that they haven't used any LLMs for their contributions. This will strongly deter direct LLM usage. Indir…

> As an aside, I've noticed a huge drop off in license literacy amongst developers

What do you mean by this? I always assumed this was the case anyway; MIT is, if I'm not mistaken, one of the mostly used licenses. I typically had a "fuck it" attitude when it came to the license, and I assume quite a lot of other people shared that sentiment. The code is the fun bit.

Re: Redox OS has adopted a Certificate of Origin policy and a strict no-LLM policy

#37

Post by eyk19 »

ptnpzwqd wrote: post #6

I think this is a reasonable decision (although maybe increasingly insufficient). It doesn't really matter what your stance on AI is, the problem is the increased review burden on OSS maintainers. In the past, the code itself was a sort of proof of effort - you would need to invest some time and effort on your PRs, otherwise they would be easily dismissed at a glance. That is no longer the case, as LLMs can quickly g…

I feel like the pattern here is donate compute, not code. If agents are writing most of the software anyway, why deal with the overhead of reviewing other people's PRs? You're basically reviewing someone else's agent output when you could just run your own.

Maintainers could just accept feature requests, point their own agents at them using donated compute, and skip the whole review dance. You get code that actually matches the project's style and conventions, and nobody has to spend time cleaning up after a stranger's slightly-off take on how things should work.

Re: Redox OS has adopted a Certificate of Origin policy and a strict no-LLM policy

#38

Post by mfld »

lukaslalinsky wrote: post #20

I think we will be getting into an interesting situation soon, where project maintainers use LLMs because they truly are useful in many cases, but will ban contributors for doing so, because they can't review how well did the user guide the LLM.

Maybe a future direction will be the submission of detailed research, specifications and change plans for feature requests. Something that can be assessed by a human and turned into working code by both slides.

Re: Redox OS has adopted a Certificate of Origin policy and a strict no-LLM policy

#39

Post by andrewchambers »

ptnpzwqd wrote: post #6

I think this is a reasonable decision (although maybe increasingly insufficient). It doesn't really matter what your stance on AI is, the problem is the increased review burden on OSS maintainers. In the past, the code itself was a sort of proof of effort - you would need to invest some time and effort on your PRs, otherwise they would be easily dismissed at a glance. That is no longer the case, as LLMs can quickly g…

Isn't the obvious solution to not accept drive by changes?

Re: Redox OS has adopted a Certificate of Origin policy and a strict no-LLM policy

#40

Post by holyra »

lifis wrote: post #25
duskdozer wrote: post #18

Earlier quoted context omitted.

>Not sure how they can expect to make a viable full OS without massive use of LLMs, so this makes no sense. Why not?

Because it takes a massive amount of developer work (perhaps more than anything else), and it's very unlikely they either have the ability to attract enough human developers to be able to do it without LLM assistance. Not to mention that even finding good developers willing to develop without AI (a significant handicap, even more so for coding things like an OS that are well represented in LLM training) seems difficu…

The LLM has brainwashed so many devs that they now think they are nothing without it.
Post reply on HN