[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAH8yC8mXa6Q1i_4rjhPhPKakVaQ0i5QdKk0hETRYM6kY1tyfTA@mail.gmail.com>
Date: Thu, 21 Aug 2025 12:34:07 -0400
From: Jeffrey Walton <noloader@...il.com>
To: musl@...ts.openwall.com
Subject: Re: Proposed "AI" policies
Hi Rich,
On Thu, Aug 21, 2025 at 11:36 AM Rich Felker <dalias@...c.org> wrote:
> On Sat, Oct 19, 2024 at 07:40:45PM -0400, Rich Felker wrote:
> > Some mentions here and there of ChatGPT/"AI" in musl- and
> > musl-adjacent contexts has had me thinking we really should have some
> > explicit policy on this stuff, which could be posted on the wiki as
> > well as in final form here, and wherever else it may be appropriate,
> > before it becomes an issue.
> >
> > In a sense I don't even see these as "AI policies", just provenance,
> > authorship-credit, honesty, license-honoring, etc. policies, but
> > unfortunately it's "AI" that's made it necessary to spell them out
> > explicitly. So, here's roughly what I have in mind:
> >
> > 1. Please DO NOT submit "AI generated" code/patches for inclusion in
> > musl. These do not have clear authorship, are derived from models
> > that are clearly derived from a plethora of copyrighted works
> > without license or attribution, and thereby cannot be licensed by
> > the submitter. Being that most patch contributions to musl are
> > small and simple enough that it's dubious whether copyright applies
> > at all, this may not be an issue in all cases, but it's still
> > dishonest and wastes our time reviewing code that the submitter did
> > not write and does not have any reasonable basis to assume is
> > correct. Often the changes proposed by these models are blatently
> > incorrect and introduce bugs/vulns into previously-correct code.
> >
> > 2. Please DO NOT submit "AI generated" or otherwise automated bug
> > reports without disclosing the provenance (or lack thereof). This
> > wastes everybody's time. If you are using tooling to identify
> > potential bugs, please either confirm before reporting that you
> > have actually found a bug (not just that the tool said it's a bug),
> > or clearly state in the report that it's unconfirmed, which tools
> > you used, and why you think the alleged bug may be legitimate -- or
> > if you don't know you're just asking whether it might be.
> >
> > 3. Even being a permissive license, the MIT license requires
> > attribution and preservation of copyright notice. It thereby does
> > not permit incorporation of musl sources (or other MIT licensed
> > code) into models or derived outputs of models where the necessary
> > attribution and preservation of copyright notice are not possible.
> >
> > Anything I'm missing or that seems like it should be changed?
>
> One thing I'd like to add based on having heard reports that "AI" is
> deemed important for non-native English speakers to make reports:
>
> 4. If you are considering use of "AI" tools to generate, proofread, or
> translate something you are trying to report because you don't
> consider yourself sufficiently proficient in English, instead
> please just submit it in a language you are comfortable writing
> with a brief English note at the beginning to that effect. This
> allows those of us reading the report to use tools (or the advice
> of actual people) we trust to accurately translate the meaning
> instead of having to trust that the "AI" tool you were going to use
> emitted text that matches what you wanted to say. Debugging
> confabulations generated by your tooling is a much worse (and
> unacceptable) burden on us than making sense of a foreign language
> would be.
>
> Exact wording could be adjusted (perhaps to be more accessible
> English) as needed.
>
Related, cURL requires the source of a vulnerability report be stated
because the project was being overrun with false positives and low quality
bug reports from AI generated slop. See <
https://curl.se/mail/lib-2025-05/0013.html> and <
https://github.com/curl/curl/pull/17325>. The last link includes changes to
cURL's docs/CONTRIBUTE.md.
Jeff
Content of type "text/html" skipped
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
