←back to thread

AI tooling must be disclosed for contributions

(github.com)
728 points freetonik | 2 comments | 21 Aug 25 18:49 UTC | HN request time: 0s | source
Show context
Waterluvian ◴[21 Aug 25 19:07 UTC] No.44976790[source]▶
I’m not a big AI fan but I do see it as just another tool in your toolbox. I wouldn’t really care how someone got to the end result that is a PR.

But I also think that if a maintainer asks you to jump before submitting a PR, you politely ask, “how high?”

replies(16): >>44976860 #>>44976869 #>>44976945 #>>44977015 #>>44977025 #>>44977121 #>>44977142 #>>44977241 #>>44977503 #>>44978050 #>>44978116 #>>44978159 #>>44978240 #>>44978311 #>>44978533 #>>44979437 #
cvoss ◴[21 Aug 25 19:24 UTC] No.44976945[source]▶
It does matter how and where a PR comes from, because reviewers are fallible and finite, so trust enters the equation inevitably. You must ask "Do I trust where this came from?" And to answer that, you need to know where it come from.

If trust didn't matter, there wouldn't have been a need for the Linux Kernel team to ban the University of Minnesota for attempting to intentionally smuggle bugs through the PR process as part of an unauthorized social experiment. As it stands, if you / your PRs can't be trusted, they should not even be admitted to the review process.

replies(4): >>44977169 #>>44977263 #>>44978862 #>>44979553 #
koolba ◴[21 Aug 25 19:45 UTC] No.44977169[source]▶
> You must ask "Do I trust where this came from?" And to answer that, you need to know where it come from.

No you don’t. You can’t outsource trust determinations. Especially to the people you claim not to trust!

You make the judgement call by looking at the code and your known history of the contributor.

Nobody cares if contributors use an LLM or a magnetic needle to generate code. They care if bad code gets introduced or bad patches waste reviewers’ time.

replies(3): >>44977245 #>>44977531 #>>44978479 #
falcor84 ◴[21 Aug 25 19:51 UTC] No.44977245[source]▶
Trust is absolutely a thing. Maintaining an open source project is an unreasonably demanding and thankless job, and it would be even more so if you had to treat every single PR as if it's a high likelihood supply-chain attack.
replies(1): >>44977696 #
1. fnimick ◴[21 Aug 25 20:31 UTC] No.44977696[source]▶
While true, we really should be treating every single piece of external code as though it's malicious.
replies(1): >>44978629 #
2. tsimionescu ◴[21 Aug 25 22:01 UTC] No.44978629[source]▶
No, we shouldn't. We live in a society, and that level of distrust is not just unrealistic, it's disastrous. This doesn't mean you should share your house keys with every drive by PR contributor, but neither should you treat every PR as if it's coming from Jia Tan.