Linux

IMO one of the major problems with LLm code generation is that it has the capacity to overwhelm human capacity to review code and properly understand the codebase.

From that perspective, a prohibitive policy doesn't have to be 100% effective to be useful, it just needs to slow things down enough to keep the manageable and maintainable (and fun to work on).

Some people will absolutely lie, but I suspect most contributors will respect the rules, and ultimately cut down on AI PRs overall, as those AI contributors switch to projects who are pro-AI.

There's no need to excise anything unless you specifically let an agent create a commit. No need for pre-push hooks.

I think KDEs policy is quite rational, it's a compromise and still clearly anti-vibe coding. IMO the problems are overstated

If it turns out that it gets ruled as copyright violations, you can bet your ass they're going to reform copyright law instead of rolling everything back.

I don't disagree that it is a risk, and I am trying to move toward projects that do have err on the side of avoiding that risk. I have NetBSD on my laptop, and when I get a little more comfortable with it, I intend to convert the other Linux installations I maintain.

BUT, I believe the BSDs already went through a situation where some of their source was possibly under restrictive copyright and rather than "rolling back", they "simply" identified the possibly infringing code and re-wrote those sections to have the same function (which can't be copyrighted) without sharing any creative expression (which is). So, even the projects that are taking the risk that an LLM (or other generative AI) generates infringing code might not have quite as much cleanup / lost effort as you describe.

Also, LLM out isn't automatically a derivative work of the training data. I'd have to dig through some other messages to find an exact quote from their documents, but I believe they (EDIT: the U.S. copyright office) said only output that is "significantly similar" to training data is potentially infringing. That does further limit the risk.

I still think it's too high of a risk because well-meaning contributors might incorrectly introduce infringing code, since for models that don't disclose their training data (Claude, Copilot, Gemini, etc.) even dedicated contributors don't have the information they need to discover the output is infringing. In that past, that result (introducing infringing code) was generally limited to the acts of malicious actors that are submitting code they know to be infringing to poison a project and open it to legal action.

But, I can't ask that someone (i.e. a project maintainer) substitute my risk/reward judgement for theirs, and I have no experience maintaining a large project. All of my code contributions are to either projects others maintain, or my own hobby projects that I doubt have any users other than myself (and I don't even use all the published/available ones anymore).

Have to think about this in an open source context. You have an open ended population ready to submit to your project if they think they can be useful

Now, thanks to GenAI, a bunch of people who aren't good at various things now thinks they are good at various things. Whether it's coding, making comics, making videos, what have you. Try to do nuance even if it strictly makes sense, and you are stuck with the slop problem if your project is sufficiently popular.

In terms of more directly on your points, if someone does GenAI to do a security analysis, ok, but I'd want them to do the tedium of trying to identify the false positives and then re-report it in their words of actual understanding. It can catch things, but along the way makes a haystack of sillyness to go through. Same for code review, legitimate issues, but lots of missing (I spent a non trivial amount of time yesterday because a GenAI code review insisted a variable would be unitialized when referenced, when I see an uncoditional assignment just a few lines above, trying to think if there was some catch I wasn't seeing). So indirectly using it and only subjecting the developer/maintainer to that which you know makes sense.

Problem being is that people have used Claude and have forwarded to me saying "I don't understand this well enough to judge, but forwarding to you just in case". I have the same tools doing the same things as you, I don't need meat proxies that just pass through the stuff without understanding.

Even if you don't disclose it it's immediately obvious to anyone with a brain that you haven't worked at all on it.

I don't begrudge Cosmic or anything, it's just not what I want. I'm glad it exists.

KDE 4 was the TRULY bad release, if I recall correctly. It was a massive change from 3 and reduction in features and stability. I actually noped back over to Windows for a while as a result. I remember 5 being a welcome return to form comparatively.

EDIT: From the wikipedia Article on KDE4, oof:

KDE 4.0 was released in January 2008. Linux.com described the reaction from users as a "revolt", writing that the backlash KDE 4.0 received was on a scale that was unprecedented for a FOSS project. Although it was a developer's release, several distributions made the KDE 4.0 desktop environment available to their users without specifying that it was an experimental option. openSUSE released a more polished KDE 4 option while other distributions "released packages that simply [didn't] work," according to project leader Aaron Seigo. As a result, many users complained about the loss of features and stability. A number of KDE developers, including project leader Aaron Seigo, were targeted for abuse by outlets like Linux Hater's Blog. Several KDE developers stepped back from the public scrutiny.[36]

they released the first non-testing version of their new DE too soon.

This was the only issue I had with Cosmic. I don't know what the current state of the DE is these days, but surely they've fleshed out some bugs by now.

Also, cosmic-text is an amazing gift to the world, for what that's worth. Doesn't really justify using the DE, but that library is amazing.

I disagree that 5 was bad for most of its run. I think it was at about version 5.13 that I switched to it, having originally been a gnome 2.x user who hated Gnome3, but found KDE4.x unusable, and I've never regretted it a single time.

I'd struggle to remember any problem I have had with my system that I'd lay at the feet of KDE 5.

I'm not suggesting it's perfect and I'm sure some folks did have issues, but I never got the feeling I was one of a lucky few having a good experience with KDE5. KDE 4 - yes that was a frustratingly bad desktop experience, and I think it was widely regarded as such. But I strongly disagree on painting KDE5 with the same brush.