[<prev] [<thread-prev] [day] [month] [year] [list]
Message-ID: <CAOZ3c1q3szGNstpVm5xCrADnf+QqKs77wnN_XgrAohuf-qGMMw@mail.gmail.com>
Date: Tue, 27 Jan 2026 08:46:17 +0000
From: zxuiji <gb2985@...il.com>
To: musl@...ts.openwall.com
Subject: Re: Proposed "AI" policies
Having read it, + 1 upvote from me :)
On Tue, 27 Jan 2026 at 02:20, Jeffrey Walton <noloader@...il.com> wrote:
>
>
> On Sat, Oct 19, 2024 at 7:41 PM Rich Felker <dalias@...c.org> wrote:
>
>> Some mentions here and there of ChatGPT/"AI" in musl- and
>> musl-adjacent contexts has had me thinking we really should have some
>> explicit policy on this stuff, which could be posted on the wiki as
>> well as in final form here, and wherever else it may be appropriate,
>> before it becomes an issue.
>>
>> In a sense I don't even see these as "AI policies", just provenance,
>> authorship-credit, honesty, license-honoring, etc. policies, but
>> unfortunately it's "AI" that's made it necessary to spell them out
>> explicitly. So, here's roughly what I have in mind:
>>
>> 1. Please DO NOT submit "AI generated" code/patches for inclusion in
>> musl. These do not have clear authorship, are derived from models
>> that are clearly derived from a plethora of copyrighted works
>> without license or attribution, and thereby cannot be licensed by
>> the submitter. Being that most patch contributions to musl are
>> small and simple enough that it's dubious whether copyright applies
>> at all, this may not be an issue in all cases, but it's still
>> dishonest and wastes our time reviewing code that the submitter did
>> not write and does not have any reasonable basis to assume is
>> correct. Often the changes proposed by these models are blatently
>> incorrect and introduce bugs/vulns into previously-correct code.
>>
>> 2. Please DO NOT submit "AI generated" or otherwise automated bug
>> reports without disclosing the provenance (or lack thereof). This
>> wastes everybody's time. If you are using tooling to identify
>> potential bugs, please either confirm before reporting that you
>> have actually found a bug (not just that the tool said it's a bug),
>> or clearly state in the report that it's unconfirmed, which tools
>> you used, and why you think the alleged bug may be legitimate -- or
>> if you don't know you're just asking whether it might be.
>>
>> 3. Even being a permissive license, the MIT license requires
>> attribution and preservation of copyright notice. It thereby does
>> not permit incorporation of musl sources (or other MIT licensed
>> code) into models or derived outputs of models where the necessary
>> attribution and preservation of copyright notice are not possible.
>>
>> Anything I'm missing or that seems like it should be changed?
>
>
> Sorry to dig up an old thread...
>
> cURL just stopped its Bug Bounty program due (in part) to AI slop. See <
> https://daniel.haxx.se/blog/2026/01/26/the-end-of-the-curl-bug-bounty/>.
>
> Jeff
>
Content of type "text/html" skipped
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
