[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20260301180245.GA1827@brightrain.aerifal.cx>
Date: Sun, 1 Mar 2026 13:02:45 -0500
From: Rich Felker <dalias@...c.org>
To: musl@...ts.openwall.com
Subject: Re: Proposed "AI" policies
On Sat, Oct 19, 2024 at 07:40:45PM -0400, Rich Felker wrote:
> Some mentions here and there of ChatGPT/"AI" in musl- and
> musl-adjacent contexts has had me thinking we really should have some
> explicit policy on this stuff, which could be posted on the wiki as
> well as in final form here, and wherever else it may be appropriate,
> before it becomes an issue.
I'm thinking about publishing these in a more official place (as in,
on the website) soon.
> In a sense I don't even see these as "AI policies", just provenance,
> authorship-credit, honesty, license-honoring, etc. policies, but
> unfortunately it's "AI" that's made it necessary to spell them out
> explicitly. So, here's roughly what I have in mind:
>
> 1. Please DO NOT submit "AI generated" code/patches for inclusion in
> musl. These do not have clear authorship, are derived from models
> that are clearly derived from a plethora of copyrighted works
> without license or attribution, and thereby cannot be licensed by
> the submitter. Being that most patch contributions to musl are
> small and simple enough that it's dubious whether copyright applies
> at all, this may not be an issue in all cases, but it's still
> dishonest and wastes our time reviewing code that the submitter did
> not write and does not have any reasonable basis to assume is
> correct. Often the changes proposed by these models are blatently
> incorrect and introduce bugs/vulns into previously-correct code.
>
> 2. Please DO NOT submit "AI generated" or otherwise automated bug
> reports without disclosing the provenance (or lack thereof). This
> wastes everybody's time. If you are using tooling to identify
> potential bugs, please either confirm before reporting that you
> have actually found a bug (not just that the tool said it's a bug),
> or clearly state in the report that it's unconfirmed, which tools
> you used, and why you think the alleged bug may be legitimate -- or
> if you don't know you're just asking whether it might be.
>
> 3. Even being a permissive license, the MIT license requires
> attribution and preservation of copyright notice. It thereby does
> not permit incorporation of musl sources (or other MIT licensed
> code) into models or derived outputs of models where the necessary
> attribution and preservation of copyright notice are not possible.
>
> Anything I'm missing or that seems like it should be changed?
A couple more I think should be added:
4. If, unaware of this policy, you first attempted using "AI" to
produce code/patches intended for inclusion, please treat this
situation as if you had read stolen/leaked proprietary code and
cease further engagement with the relevant issue/enhancement. As
long as you can commit to not doing it again, it doesn't preclude
later contributing to the project elsewhere, but any further work
on the area you already attempted with unknown-provenance code must
be deemed tainted and unusable.
5. If you are or plan to be regularly contributing to musl, please try
to avoid reviewing submissions (or non-upstreamed forks) made in
violation of these policies. From a provenance standpoint, having
engaged with code that someone else prompted the "AI" to generate
is not a lot different from if you had prompted it yourself, and it
likewise draws in to question the provenance of any overlapping
work.
In some ways I think point 5 might be overly cautious, but I'd really
rather not have bad "AI" submissions followed up with a bunch of
attention reviewing them rather than just clean outright rejection.
Because then all the ideas that come out of the review are partly
derivative of what went into it. And, even with a policy that says no,
reviewing it gives a public impression that it's a matter open to
consideration.
Rich
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
