Post · bonfire.cafe

@mttaggart Okay, I know that ban all contributions is the option I would normally pick, but if this shit is ever sustainable and if its here to stay, even in the form of local LLMs when the cost of compute is no longer subsidized for the big models... I would choose to ensure that contributions must adhere to strict standards.

Linus Torvalds was just stating that the kernal security mailing list is a mess and more or less said "If you're going to submit bugs, read the mailing list, to make sure it isn't a dupe, as it very likely is. Also, submit a patch to go with your bug if you're actually serious." I'm paraphrasing, but that was about it.

I would be cut-throat about it. If the issue is a dupe, its deleted without review. No patch? deleted without review. Not following guidelines. Deleted. Get the fuck out, I don't have time for your slop if you don't have time to read the documentation and guidelines.

Taggart :ifin:

@mttaggart@infosec.exchange · 2 hours ago

@da_667 If you're going to ban, I don't think it's compatible with accepting contributions from the whole world sight-unseen. You need to have a known entity and a baseline to judge against in order to make a case. And that approach also minimizes the likelihood of a violation, because you've already established trust.

I kind of think the GitHubification of open source is about to reverse in a lot of ways, and this is one of them.

AAKL

@AAKL@infosec.exchange · 2 hours ago

@mttaggart @da_667 Given all of the above, the third option makes sense because if you go with the second, you still run the risk of slop and/or threats. But the third option establishes a vetted and trusted group that can still submit AI reports, but the assumption is that these reports will also be vetted first by the trusted group.

da_667

@da_667@infosec.exchange · 2 hours ago

@mttaggart if people are going to blindly submit code without checking to see if its already been logged, and are just going to submit things without reviewing them, maybe it has to change, and that changing that model is for the better.

I don't know. I'm just saying that this is how I'd handle it. If you don't have the time to read the rules and respect the process, then I'm not going to respect the slop you wasted tokens and cpu time to submit.

Brahms

@brahms@chaos.social · 2 hours ago

@da_667 @mttaggart is this something that has changed with the arrival of AI contributions? I would expect these "strict" standards from any (serious) contribution, no matter who (or what) wrote it.

similar problem with copyright of contributed code. if your project explicitly requires any contribution to adhere to relevant law, you generally dont have to care whether it was ai-written or not, it applies to all.

Taggart :ifin:

@mttaggart@infosec.exchange · 2 hours ago

@brahms @da_667 I really think there's a divergence in cultures here that is getting missed. I would venture that many, many projects on GitHub—maybe not venerable FOSS pillars, but still important projects—have plenty of first-timers submitting big PRs, and getting the code accepted after review.

The problem is now scale and doubt. If you have a reason to suspect AI code, and you're seeking to implement a ban, that model no longer works. So yes, it would represent a material change for many projects.

1 more replies