35 ms·

Define policy forbidding use of AI code generators

551 points by todsacerdoti 1y ago

randomNumber7 1y ago
I know a secret. You can read the code the AI generated for you and check if it is what you want to do. It is still faster than writing it yourself most of the time.
- JonChesterfield 1y ago
  Like skimming through a maths textbook right? Way quicker than writing one, same reassuring sense of understanding.
  - randomNumber7 1y ago
    Just that code and math textbooks are s.th. different. I already understand how to code, I just need to do s.th. useful with it.
teruakohatu 1y ago
So essentially it’s “let us cover ourselves by saying it’s not allowed” and in practice that means not allowing code that a human thinks is AI generated code. Universities have this issue too, despite many offering students and staff Grammarly (Gen AI) while also trying to ban Gen AI.
- _fat_santa 1y ago
  Well I guess the key difference is code is deterministic, that is whether an paper accomplishes it's goals is somewhat subjective but with code its an absolute certainty. I'm sure that if a contributor working on a feature used cursor to initially generate the code but then goes over it to ensure it's working as expected that would be allowed, this is more for those folks that just want to jam in a quick vibe-coded PR so they can add "contributed to the QEMU project" on their resumes.
  - hananova 1y ago
    You'd be wrong, the linked commit clearly says that anything written by, or derived from, AI code generation is not allowed.
- SchemaLoad 1y ago
  Sounds like a good idea to ensure developers are owning the code they submit rather than hiding behind "I don't know why it does that, ChatGPT wrote it". Use AI if you want to, but if the person on the other side can tell, and you can't defend the submission as your own, that's a problem.
  - JoshTriplett 1y ago
    > Use AI if you want to, but if the person on the other side can tell, and you can't defend the submission as your own, that's a problem. The actual policy is "don't use AI code generators"; don't try to weasel that into "use it if you want to, but if the person on the other side can tell". That's effectively "it's only cheating if you get caught". By way of analogy, Open Source projects also typically have policies (whether written or unwritten) that you only submit code you are legally allowed to submit. In theory, you could take a pile of proprietary reverse-engineered code that you have no license to, or a pile of code from another project that you aren't respecting the license of, and submit it anyway, and slap a `Signed-off-by` on it. Nothing will physically stop you, and people might not be able to tell. That doesn't make it OK.
    - SchemaLoad 1y ago
      The way I interpret it is that if you brainstorm using ChatGPT but write your own code using the ideas created in this step that would be fine, the reviewer wouldn't suspect the code of being AI generated because you've made sure it fits in with the project and actually works. The exact wording here is that they will reject changes they suspect of being AI generated, not that you can't have read anything AI generated in the process. Getting AI to remind you of the libraries API is a fair bit different to having it generate 1000 lines of code you have hardly read before submitting.
      - Art9681 1y ago
        What if the code is AI generated and the developer that drove it also understands the code and can explain it?
- GuB-42 1y ago
  It more like a clarification. The rules regarding the origin of code contributions are rather strict, that is, you can't contribute other people code unless you can make sure that the licence is appropriate. A LLM may output a copy of someone else code, sometimes verbatim, without giving you its origin, so you can't contribute code written by a LLM.
Havoc 1y ago
I wonder whether the motivation is really legal? I get the sense that some projects are just sick of reviewing crap AI submissions
- SchemaLoad 1y ago
  This could honestly break open source, with how quickly you can generate bullshit, and how long it takes to review and reject it. I can imagine more projects going the way of Android where you can download the source, but realistically you can't contribute as a random outsider.
  - api 1y ago
    Quality contributions to OSS are rare unless the project is huge.
    - loeg 1y ago
      Historically the opposite of quality contributions has been no contributions, not net-negative contributions (random slop that costs more in review than it provides benefit).
      - lmm 1y ago
        No it hasn't? Net-negative contributions to open source have been extremely common for years, it's not like you need an LLM to make them.
        loeg 1y ago
        I guess we've had very different experiences!
      - LtWorf 1y ago
        Nah. I've had a lot of bad contributions. One PR deleted and readded all of the lines in the project, and the entire test suite was failing. The person got upset at me for saying I could not accept such a thing. There's other examples.
daeken 1y ago
I've been trying out Claude Code (the tool I've found most effective in terms of agentic code gen/manipulation) for an emulator project of mine for the last few days. Part of it is a compiler from an architecture definition to disassembler/interpreter/recompiler. I hit a fairly minor compiler bug and decided to ask Claude to debug and fix it. Some things I noted: 1. My C# code compiled just fine and ran even, but it was convinced that I was missing a closing brace on a lambda near where the exception was occurring. The diff was ... Putting the existing brace on a new line. Confidently stated that was the problem and declared it fixed. 2. It did figure out that an unexpected type was being seen, and implemented a pathway that allowed for it to get to the next error, but didn't look into why that type had gotten there; that was the actual bug, not the unhandled type. So it "fixed" it, but just kicked the can down the road. 3. When figuring out the issue, it just looked at the stack trace. That was it. It was running the compiler itself; it could've just embedded some debug code (like I did) and work out what the actual issue was, but it didn't even try. The exception was just a NotSupportedException with no extra details to work off of, so adding just a crumb of context would let you solve the issue. Now, is this the simplest emulator you could throw AI at? No, not at all. But neither is qemu. I'm thoroughly unconvinced that current tools could provide real value on codebases like these. I'm bullish on them for the future, and I use GenAI constantly, but this ain't a viable use case today.
- lowbloodsugar 1y ago
  This is the part that makes me sure my job is safe. I use AI to write code, but it really sucks at debugging.
jekwoooooe 1y ago
When will people give up this archaic practice of sending patches over emails?
- SchemaLoad 1y ago
  Sending patches over email is basically a filter for slop. Stops the low effort drive by PRs and anyone who actually wants to invest some time in to contributing won't have a problem working out the workflow.
  - deleted 1y ago
    [deleted]
  - jnwatson 1y ago
    AI can figure out how to send a patch via email a lot faster than a human.
- MobiusHorizons 1y ago
  likely when it stops being a useful way to cut out noise
- gerdesj 1y ago
  When enough people don't want to do it anymore. Feel free to step up, live with email patches, and add to the numbers of those who don't like it and say so. Why is it archaic if it works? I get there might be other ways to do patch sharing and discussion but what exactly is your problem with email as a transport? You might as well describe voice and ears as archaic!
  - jekwoooooe 1y ago
    Archaic: Very old or old fashioned
    - gerdesj 1y ago
      Dictionaries work fine for those with eyes, minds and fingers. This mechanistic effort at a definition is insufficient. How on earth can whatever this is manage less than a thumb through a dictionary? Archaic has way more meanings than just "old".
wyldfire 1y ago
I understand where this comes from but I think it's a mistake. I agree it would be nice if there were "well settled law" regarding AI and copyright, probably relatively few rulings and next to zero legislation on which to base their feelings. In addition to a policy to reject contributions from AI, I think it may make sense to point out places where AI generated content can be used. For example - how much of QEMU project's (copious) CI setup is really stuff that is critical content to protect? What about ever-more interesting test cases or environments that could be enabled? Something like "contribute those things here instead, and make judicious use of AI there, with these kinds of guard rails..."
- dclowd9901 1y ago
  What's the risk of not doing this? Better code but slower velocity for an open source project? I think that particular brand of risk makes sense for this particular project, and the authors don't seem particularly negative toward GenAI as a concept, just going through a "one way door" with it.
  - mrheosuper 1y ago
    >Better code but slower velocity for an open source project Better code and "AI assist coding" are not exclusive of each other.
    - dclowd9901 1y ago
      In my experience they seem to be, granted that is anecdotal.
- kazinator 1y ago
  There is a well settled practice in computing that you just don't plagiarize code. Even a small snippet. Even if copyright law would consider such a small thing "fair use".
  - 9283409232 1y ago
curious_cat_163 1y ago
That’s very conservative.
JonChesterfield 1y ago
Interesting. Harder line than the LLVM one found at https://llvm.org/docs/DeveloperPolicy.html#ai-generated-contributions https://llvm.org/docs/DeveloperPolicy.html#ai-generated-cont... I'm very old man shouting at clouds about this stuff. I don't want to review code the author doesn't understand and I don't want to merge code neither of us understand.
- compton93 1y ago
  I don't want to review code the author doesn't understand This really bothers me. I've had people ask me to do some task except they get AI to provide instructions on how to do the task and send me the instructions, rather than saying "Hey can you please do X". It's insulting.
  - andy99 1y ago
    Had someone higher up ask about something in my area of expertise. I said I didn't think is was possible, he followed up with a chatGPT conversation he had where it "gave him some ideas that we could use as an approach", as if that was some useful insight. This is the same people that think that "learning to code" is a translation issue they don't have time for as opposed to experience they don't have.
    - candiddevmike 1y ago
      Imagine a boring dystopia where everyone is given hallucinated tasks from LLMs that may in some crazy way be feasible but aren't, and you can't argue that they're impossible without being fired since leadership lacks critical thinking.
      - tines 1y ago
        Reminds me of the wonderful skit, The Expert: https://www.youtube.com/watch?v=BKorP55Aqvg https://www.youtube.com/watch?v=BKorP55Aqvg
        1y ago
ants_everywhere 1y ago
This is signed off primarily by RedHat, and they tend to be pretty serious/corporate. I suspect their concern is not so much whether users have own the copyright to AI output but rather the risk that AI will spit out code from its training set that belongs to another project. Most hypervisors are closed source and some are developed by litigious companies.
- duskwuff 1y ago
  I'd also worry that a language model is much more likely to introduce subtle logical errors, potentially ones which violate the hypervisor's security boundaries - and a user relying heavily on that model to write code for them will be much less prepared to detect those errors.
  - ants_everywhere 1y ago
    Generally speaking AI will make it easier to write more secure code. Tooling and automation help a lot with security and AI makes it easier to write good tooling. I would wager good money that in a few years the most security-focused companies will be relying heavily on AI somewhere in their software supply chain. So I don't think this policy is about security posture. No doubt human experts are reviewing the security-relevant patches anyway.
    - tho23i4234324 1y ago
      I'd doubt this very much - LLMs hallucinate API calls and commit all sorts of subtle errors that you need to catch (esp. if you're on proprietary problems which it's not trained on). It's a good replacement for Google, but probably nothing close to what it's being hyped out to be by the capital allocators.
    - OtherShrezzing 1y ago
      While LLMs are really good at generating content, one of their key weaknesses is their (relative) inability to detect _missing_ content. I'd argue that the most impactful software security bugs in the last couple of decades (Heartbleed etc) have been errors of omission, rather than errors of inclusion. This means LLMs are: 1) producing lots more code to be audited 2) poor at auditing that code for the most impactful class of bugs That feels like a dangerous combination.
Art9681 1y ago
This is a "BlockBuster laughs Netflix out of the room" moment. I am a huge fan of QEMU and used it throughout my career. The maintainers have every right to govern their project as they see fit. But this is a lot of mental gymnastics to justify clinging to punchcards in a world where we now have magnetic tape and keyboards to do things faster. This tech didn't spawn weeks ago. Every major project has had at least two years to prepare for this moment. Pull your pants up.
- 9283409232 1y ago
  You're so dramatic. Like they said in the declaration, these are the early days of AI development and all the problems they mention will be eventually resolved so they have no problem taking a backseat while things sort themselves out and I respect that choice.
- add-sub-mul-div 1y ago
  > This is a "BlockBuster laughs Netflix out of the room" moment I'm not sure that's the dunk you think it is. Good for Netflix for making money, but we're drowning in their empty slop content now and worse off for it.
  - gjs278 1y ago
    [dead]
  - danielbln 1y ago
    Who is forcing you to watch slop? And mind you, there was a TON of garbage at any local Blockbuster back in the day, with the added joy of having to go somewhere to rent it, being slapped with late and rewind fees or not even have availability of what you want to watch. Choice is good. It means more slop, but also more gold. Figure out how to find the gold.
- catlifeonmars 1y ago
  2 years isn’t that long. It took the Linux kernel 10 years to start accepting code written in Rust. This isn’t quite the same as the typical frontend flavor-of-the week JavaScript library.
benlivengood 1y ago
Open source and libre/free software are particularly vulnerable to a future where AI-generated code is ruled to be either infringing or public domain. In the former case, disentangling AI-edits from human edits could tie a project up in legal proceedings for years and projects don't have any funding to fight a copyright suit. Specifically, code that is AI-generated and subsequently modified or incorporated in the rest of the code would raise the question of whether subsequent human edits were non-fair-use derivative works. In the latter case the license restrictions no longer apply to portions of the codebase raising similar issues from derived code; a project that is only 98% OSS/FS licensed suddenly has much less leverage in takedowns to companies abusing the license terms; having to prove that infringers are definitely using the human-generated and licensed code. Proprietary software is only mildly harmed in either case; it would require speculative copyright owners to disassemble their binaries and try to make the case that AI-generated code infringed without being able to see the codebase itself. And plenty of proprietary software has public domain code in it already.
- deadbabe 1y ago
  If a software is truly wide open source in the sense of “do whatever the fuck you want with this code, we don’t care”, then it has nothing to fear from AI.
  - candiddevmike 1y ago
    Won't apply to closed source, not public code, which the GPL (QEMU uses) is quite good at ensuring becomes open source...
  - kgwxd 1y ago
    Can't release someone else's proprietary source under a "do whatever the fuck you want" license and actually do whatever the fuck you want, without getting sued.
    - deadbabe 1y ago
      It’d be like trying to squeeze blood from a stone
hughw 1y ago
I'd hope there could be some distinction between using LLM as a super autocomplete in your IDE, vs giving it high-level guidelines and making it generate substantive code. It's a gray area, sure, but if I made a contribution I'd want to be able to use the labor-saving feature of Copilot, say, without danger of it copying an algorithm from open source code. For example, today I generated a series of case statements and Copilot detected the pattern and saved me tons of typing.
- dheera 1y ago
  That and also just AI glasses that become an extension of my mind and body, just giving me clues and guidance on everything I do including what's on my screen. I see those glasses as becoming just a part of me, just like my current dumb glasses are a part of me that enables me to see better, the smart glasses will help me to see AND think better. My brain was trained on a lot of proprietary code as well, the copyright issues around AI models are pointless western NIMBY thinking and will lead to the downfall of western civilization if they keep pursuing legal what-ifs as an excuse to reject awesome technology.
mattl 1y ago
I'm interested to see how this plays out. I'd like a similar policy for my projects, but also a similar policy/T&C that prohibits the crawling of the content too.
- candiddevmike 1y ago
  Only way to prohibit crawling is to go back to invite only, probably self-hosted repositories. These companies have no shame, your T&Cs won't mean anything to them and you have no way of proving they violated them without some kind of discovery into their training data.
  - deleted 1y ago
    [deleted]
acedTrex 1y ago
Oh hey, the thing I predicted in my blog titled "yes i will judge you for using AI" happened lol Basically I think open source has traditionally HEAVILY relied on hidden competency markers to judge the quality of incoming contributions. LLMs throw that entire concept on its head by presenting code that has competent markers but none of the backing experience. It is a very very jarring experience for experienced individuals. I suspect that virtual or in person meetings and other forms of social proof independent of the actual PR will become far more crucial for making inroads in large projects in the future.
- SchemaLoad 1y ago
  I've started seeing this at work with coworkers using LLMs to generate code reviews. They submit comments which are way above their skill level which almost trick you in to thinking they are correct since only a very skilled developer would make these suggestions. And then ultimately you end up wasting tons of time proving how these suggestions are wrong. Spending far more time than the person pasting the suggestions spent to generate them.
  - acedTrex 1y ago
    Yep 100%, it is something I have also observed. Frankly has been frustrating to the point I spun up a quick one off html site to rant/get my thoughts out. https://jaysthoughts.com/aithoughts1 https://jaysthoughts.com/aithoughts1
    - whatevertrevor 1y ago
      Just some feedback: your site is hard to read on mobile devices because of the sidebar.
      - acedTrex 1y ago
        Thank you, I'll get that fixed. Edit: Mobile should be fixed now
  - 1y ago
BurningFrog 1y ago
Would it make sense to include the complete prompt that generated the code with the code?
- astrobiased 1y ago
  It would need to be more than that. A prompt for one model can have different results vs another. Even when the model has different treatment for inference, eg quantization, the same prompt for the unquantized and quantized model could differ.
  - verdverm 1y ago
    Even more so, when you come back to understand in a few years, the model will no longer be available
    - galangalalgol 1y ago
      One of several reasons to use an open model even if it isn't quite as good. Version control the models and commit the prompts with the model name and a hash of the parameters. I'm not really sure what value that reproducibility adds though.
- catlifeonmars 1y ago
  You’d need to hash the model weights and save the seeds for the temperature prng as well, in order to verify the provenance. Ideally it would be reproducible, right?
  - danielbln 1y ago
    Maybe 2 years ago. Nowadays LLMs call functions and use tools, good luck capturing that in a way that it's reproducible.
- ethan_smith 1y ago
  Including prompts would create transparency but still wouldn't resolve the underlying copyright uncertainty of the output or guarantee the code wasn't trained on incompatibly-licensed material.
deleted 1y ago
[deleted]
deleted 1y ago
[deleted]
Aeolun 1y ago
This seems absolutely impossible to enforce. All my editors give me AI assisted code hints. Zed, cursor, VS code. All of them now show me autocomplete that comes from an LLM. There's absolutely no distinction between that code, and code that I've typed out myself. It's like complaining that I may have no legal right to submit my stick figure because I potentially copied it from the drawing of another stick figure. I'm firmly convinced that these policies are only written to have plausible deniability when stuff with generated code gets inevitably submitted anyway. There's no way the people that write these things aren't aware they're completely unenforceable.
- luispauloml 1y ago
  > I'm firmly convinced that these policies are only written to have plausible deniability when stuff with generated code gets inevitably submitted anyway. Of course it is. And nobody said otherwise, because that is explicitly stated on the commit message: [...] More broadly there is, as yet, no broad consensus on the licensing implications of code generators trained on inputs under a wide variety of licenses And in the patch itself: [...] With AI content generators, the copyright and license status of the output is ill-defined with no generally accepted, settled legal foundation. What other commenters pointed out is that, beyond the legal issue, other problems also arise form the use of AI-generated code.
  - teeray 1y ago
    It’s like the seemingly-confusing gates passing through customs that say “nothing to declare” when you’ve already made your declarations. Walking through that gate is a conscious act that places culpability on you, so you can’t simply say “oh, I forgot” or something. The thinking here is probably similar: if AI-generated code becomes poisonous and is detected in a project, the DCO could allow shedding liability onto the contributor that said it wasn’t AI-generated.
  - Filligree 1y ago
    > Of course it is. And nobody said otherwise, because that is explicitly stated on the commit message Don’t be ridiculous. The majority of people are in fact honest, and won’t submit such code; the major effect of the policy is to prevent those contributions. Then you get plausible deniability for code submitted by villains, sure, but I’d like to hope that’s rare.
sysmax 1y ago
I wish people would make distinction regarding the size/scope of the AI-generated parts. Like with video copyright laws, where a 5-second clip from a copyrighted movie is usually considered fair use and not frowned upon. Because for projects like QEMU, current AI models can actually do mind-boggling stuff. You can give it a PDF describing an instruction set, and it will generate you wrapper classes for emulating particular instructions. Then you can give it one class like this and a few paragraphs from the datasheet, and it will spit out unit tests checking that your class works as the CPU vendor describes. Like, you can get from 0% to 100% test coverage several orders of magnitude faster than doing it by hand. Or refactoring, where you want to add support for a particular memory virtualization trick, and you need to update 100 instruction classes based on straight-forward, but not 100% formal rule. A human developer would be pulling their hairs out, while an LLM will do it faster than you can get a coffee.
- echelon 1y ago
  Qemu can make the choice to stay in the "stone age" if they want. Contributors who prefer AI assistance can spend their time elsewhere. It might actually be prudent for some (perhaps many foundational) OSS projects to reject AI until the full legal case law precedent has been established. If they begin taking contributions and we find out later that courts find this is in violation of some third party's copyright (as shocking as that outcome may seem), that puts these projects in jeopardy. And they certainly do not have the funding or bandwidth to avoid litigation. Or to handle a complete rollback to pre-AI background states.
- 762236 1y ago
  It sounds like you're saying someone could rewrite Qemu on their own, with the help of AI. That would be pretty funny.
  - mrheosuper 1y ago
    Given enough time, a monkey randomly types on typewriter can rewrite QEMU.
- halostatue 1y ago
pretoriusdre 1y ago
AI generated code is generally pretty good and incredibly fast. Seeing this new phenomenon must be difficult for those people who have spent a long time perfecting their craft. Essentially, they might feel that their skillsets are being undermined. It would be especially hard for people who associate a lot of their self-identity with their job. Being a purist is noble, but I think that this stance is foolish. Essentially, people who chose not to use AI code tools will be overtaken by the people who do. That's the unfortunate reality.
- loktarogar 1y ago
  It's not a stance about the merits of AI generated code but about the legal status of it, in terms of who owns it and related concepts.
  - pretoriusdre 1y ago
    Yes the reasoning behind the decision is clear and as you described. But I would also make the point that the decision also comes with certain consequences, to which a discussion about merits is directly relevant.
    - loktarogar 1y ago
      > Essentially, people who chose not to use AI code tools will be overtaken by the people who do. That's the unfortunate reality. Who is going to "overtake" QEMU, what exactly does that mean, and what will it matter if they are?
      - danielbln 1y ago
        OP said people. QEMU is not people.
        loktarogar 1y ago
        We're talking about a decision that the people behind QEMU made that affects people, to which the consequences of made the discussion of merits "directly relevant". If we're talking about something that neither involving QEMU nor the people behind it, where is the relevance? It's just a rant on AI at that point.
naveed125 1y ago
Coolest thing I've seen today.
N1H1L 1y ago
I use LLMs for generating documentation- I write my code, and ask Claude to write my documentation
- auggierose 1y ago
  I think you are doing it the wrong way around.
  - insane_dreamer 1y ago
    Maybe not. I trust Claude to write docs. I don’t trust it to write my code the way I want.
jssjsnj 1y ago
Oi
abhisek 1y ago
> It's best to start strict and safe, then relax. Makes total sense. I am just wondering how do we differentiate between AI generated code and human written code that is influenced or copied from some unknown source. The same licensing problem may happen with human code as well especially for OSS where anyone can contribute. Given the current usage, I am not sure if AI generated code has an identity of its own. It’s really a tool in the hand of a human.
- catlifeonmars 1y ago
  > Given the current usage, I am not sure if AI generated code has an identity of its own. It’s really a tool in the hand of a human. It’s a power saw. A really powerful tool that can be dangerous if used improperly. In that sense the code generator can have more or less of a mind of its own depending on the wielder. Ok I think I’ve stretched the analogy to the breaking point…
b0a04gl 1y ago
[dead]
caleblloyd 1y ago
Signed by mostly people at RedHat, which is owned by IBM, which makes Watson, which beat humans in Jeopardy in 2011. > These are early days of AI-assisted software development. Are they? Or is this just IBM destroying another acquisition slowly. Meanwhile the Dotnet Runtime is fully embracing AI. Which people on the outside may laugh at but you have extremely talented engineers like Stephen Toub and David Fowler advocating for it. So enterprises: next time you have an IBM rep trying to sell you AI services, do yourself a favor and go to any other number of companies out there who are actually serious about helping you build for the future. And since I am a North Carolina native, here’s to hoping IBM and RedHat get their stuff together.
bgwalter 1y ago
It is interesting to read the pro-AI rant in the comments on the linked commit. The person who is threatening to use "AI" anyway has almost no contributions either in qemu or on GitHub in general. This is the target group for code generators. All talk but no projects.
ludicrousdispla 1y ago
>> The tools will mature, and we can expect some to become safely usable in free software projects. It should be possible to build a useful AI code generator for a given programming language solely from the source code for the language itself. Doing so however would require some maturity.
zoobab 1y ago
BigTech now control Qemu? "Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>"
wlkr 1y ago
qq
incomingpain 1y ago
Using AI code generators. I have been able to get the code base large enough that it was starting to make nonsense changes. However, my overall experience I have been thinking about how this is going to be a massive boon to open source. So many patches, so many new tools will be created to streamline getting new packages into repos. Everything can be tested. Open source is going to be epicly boosted now. QEMU deciding to sit out from this acceleration is crazy to me, but probably what is going to give Xen/Docker/Podman the lead.
flerchin 1y ago
I suppose the practical effect will be that contributors who use AI will have to defend their code as if they did not. To me, this implies more ownership of the code and deep understanding of it. This exchange happens fairly often in PRs I'm involved with: "Why did you do this insane thing?" "IDK, claude suggested it and it works."
UrineSqueegee 1y ago
if AI using books to train isn't copyright infringement then the outputted code isn't copyrighted material either
tqwhite 1y ago
I don't blame them for worrying about it. The policy should not be to forbid it but make sure you don't leave artifacts because I guarantee, people are going to use a bot to write their code. Hell, in six months, I doubt you will be able to get a code editor that doesn't use AI for code completion at least. Also, AI coded programs will be copyrightable just like the old days. You think the big corps are going to both not use bot coding and give up ownership of their code? Fat chance. Remember the Micky Mouse copyright extension? If the courts aren't sensible, we will have one of those the next day. The old days ended very abruptly this time.
randomNumber7 1y ago
I mean for low level C code the current LLMs are not that helpful anyway. On the other hand I am 100% sure that every company that doesn't use LLMs will be out of business in 10 years.
saurik 1y ago
As someone who once worked on a product that had to carefully walk the line of legality, I haven't found any mention in this discussion of what I imagine is a key problem for qemu, that doesn't face other projects: as an emulator, they are already under a lot of scrutiny for legality, and so they are going to need to be a lot more conservative than other random projects with respect to increasing their legal risk.
lexiciccone 1y ago
[dead]
maerF0x0 1y ago
I was literally musing on a parallel subject yesterday morning, how engineers kinda did it to themselves with Open Source, LLM Code generators would probably not be possible without the large corpus of totally available (readable) lines of mostly valid code hosted in places like github.com . It strikes me that Open Source was inevitable as companies and engineers found it economical (a good choice) to amortize the cost of building something across many of them, without as much legality/negotiation/constraints as if they did so in a closed source way collectively. It was kinda a sort of good will community thing. For FOSS, in the case of companies by not competing on things like a javascript framework, and instead on the product features themselves. Or, in the case of engineers by allowing themselves access to that same code across many employers. Now that gambit is approaching the point where most projects which could be assembled by entirely FOSS (lots of it) is becoming easier and easier to generate. It'd take a 20(?) person team of expensive nerds weeks/months to build a website in 1995, but now a normal individual can simply ask for a website to be made by an LLM. Across my ~30 years in software (eep), it seems that the table stakes for the minimum viable software keeps just growing and growing-- It used to be a push to have an API, now its minimum viable, it used to be a push to get "live" notificatoins (via polling!) now its minimum viable to push via websockets. Etc etc for the surviving set of features.

551 points by todsacerdoti 1y ago

I know a secret. You can read the code the AI generated for you and check if it is what you want to do. It is still faster than writing it yourself most of the time.

JonChesterfield 1y ago
Like skimming through a maths textbook right? Way quicker than writing one, same reassuring sense of understanding.
- randomNumber7 1y ago
  Just that code and math textbooks are s.th. different. I already understand how to code, I just need to do s.th. useful with it.

teruakohatu 1y ago

So essentially it’s “let us cover ourselves by saying it’s not allowed” and in practice that means not allowing code that a human thinks is AI generated code. Universities have this issue too, despite many offering students and staff Grammarly (Gen AI) while also trying to ban Gen AI.

_fat_santa 1y ago
Well I guess the key difference is code is deterministic, that is whether an paper accomplishes it's goals is somewhat subjective but with code its an absolute certainty. I'm sure that if a contributor working on a feature used cursor to initially generate the code but then goes over it to ensure it's working as expected that would be allowed, this is more for those folks that just want to jam in a quick vibe-coded PR so they can add "contributed to the QEMU project" on their resumes.
- hananova 1y ago
  You'd be wrong, the linked commit clearly says that anything written by, or derived from, AI code generation is not allowed.
SchemaLoad 1y ago
Sounds like a good idea to ensure developers are owning the code they submit rather than hiding behind "I don't know why it does that, ChatGPT wrote it". Use AI if you want to, but if the person on the other side can tell, and you can't defend the submission as your own, that's a problem.
- JoshTriplett 1y ago
  > Use AI if you want to, but if the person on the other side can tell, and you can't defend the submission as your own, that's a problem. The actual policy is "don't use AI code generators"; don't try to weasel that into "use it if you want to, but if the person on the other side can tell". That's effectively "it's only cheating if you get caught". By way of analogy, Open Source projects also typically have policies (whether written or unwritten) that you only submit code you are legally allowed to submit. In theory, you could take a pile of proprietary reverse-engineered code that you have no license to, or a pile of code from another project that you aren't respecting the license of, and submit it anyway, and slap a `Signed-off-by` on it. Nothing will physically stop you, and people might not be able to tell. That doesn't make it OK.
  - SchemaLoad 1y ago
    The way I interpret it is that if you brainstorm using ChatGPT but write your own code using the ideas created in this step that would be fine, the reviewer wouldn't suspect the code of being AI generated because you've made sure it fits in with the project and actually works. The exact wording here is that they will reject changes they suspect of being AI generated, not that you can't have read anything AI generated in the process. Getting AI to remind you of the libraries API is a fair bit different to having it generate 1000 lines of code you have hardly read before submitting.
    - Art9681 1y ago
      What if the code is AI generated and the developer that drove it also understands the code and can explain it?
GuB-42 1y ago
It more like a clarification. The rules regarding the origin of code contributions are rather strict, that is, you can't contribute other people code unless you can make sure that the licence is appropriate. A LLM may output a copy of someone else code, sometimes verbatim, without giving you its origin, so you can't contribute code written by a LLM.

Havoc 1y ago

I wonder whether the motivation is really legal? I get the sense that some projects are just sick of reviewing crap AI submissions

SchemaLoad 1y ago
This could honestly break open source, with how quickly you can generate bullshit, and how long it takes to review and reject it. I can imagine more projects going the way of Android where you can download the source, but realistically you can't contribute as a random outsider.
- api 1y ago
  Quality contributions to OSS are rare unless the project is huge.
  - loeg 1y ago
    Historically the opposite of quality contributions has been no contributions, not net-negative contributions (random slop that costs more in review than it provides benefit).
    - lmm 1y ago
      No it hasn't? Net-negative contributions to open source have been extremely common for years, it's not like you need an LLM to make them.
      - loeg 1y ago
        I guess we've had very different experiences!
    - LtWorf 1y ago
      Nah. I've had a lot of bad contributions. One PR deleted and readded all of the lines in the project, and the entire test suite was failing. The person got upset at me for saying I could not accept such a thing. There's other examples.

daeken 1y ago

I've been trying out Claude Code (the tool I've found most effective in terms of agentic code gen/manipulation) for an emulator project of mine for the last few days. Part of it is a compiler from an architecture definition to disassembler/interpreter/recompiler. I hit a fairly minor compiler bug and decided to ask Claude to debug and fix it. Some things I noted: 1. My C# code compiled just fine and ran even, but it was convinced that I was missing a closing brace on a lambda near where the exception was occurring. The diff was ... Putting the existing brace on a new line. Confidently stated that was the problem and declared it fixed. 2. It did figure out that an unexpected type was being seen, and implemented a pathway that allowed for it to get to the next error, but didn't look into why that type had gotten there; that was the actual bug, not the unhandled type. So it "fixed" it, but just kicked the can down the road. 3. When figuring out the issue, it just looked at the stack trace. That was it. It was running the compiler itself; it could've just embedded some debug code (like I did) and work out what the actual issue was, but it didn't even try. The exception was just a NotSupportedException with no extra details to work off of, so adding just a crumb of context would let you solve the issue. Now, is this the simplest emulator you could throw AI at? No, not at all. But neither is qemu. I'm thoroughly unconvinced that current tools could provide real value on codebases like these. I'm bullish on them for the future, and I use GenAI constantly, but this ain't a viable use case today.

lowbloodsugar 1y ago
This is the part that makes me sure my job is safe. I use AI to write code, but it really sucks at debugging.

jekwoooooe 1y ago

When will people give up this archaic practice of sending patches over emails?

SchemaLoad 1y ago
Sending patches over email is basically a filter for slop. Stops the low effort drive by PRs and anyone who actually wants to invest some time in to contributing won't have a problem working out the workflow.
- deleted 1y ago
  [deleted]
- jnwatson 1y ago
  AI can figure out how to send a patch via email a lot faster than a human.
MobiusHorizons 1y ago
likely when it stops being a useful way to cut out noise
gerdesj 1y ago
When enough people don't want to do it anymore. Feel free to step up, live with email patches, and add to the numbers of those who don't like it and say so. Why is it archaic if it works? I get there might be other ways to do patch sharing and discussion but what exactly is your problem with email as a transport? You might as well describe voice and ears as archaic!
- jekwoooooe 1y ago
  Archaic: Very old or old fashioned
  - gerdesj 1y ago
    Dictionaries work fine for those with eyes, minds and fingers. This mechanistic effort at a definition is insufficient. How on earth can whatever this is manage less than a thumb through a dictionary? Archaic has way more meanings than just "old".

wyldfire 1y ago

I understand where this comes from but I think it's a mistake. I agree it would be nice if there were "well settled law" regarding AI and copyright, probably relatively few rulings and next to zero legislation on which to base their feelings. In addition to a policy to reject contributions from AI, I think it may make sense to point out places where AI generated content can be used. For example - how much of QEMU project's (copious) CI setup is really stuff that is critical content to protect? What about ever-more interesting test cases or environments that could be enabled? Something like "contribute those things here instead, and make judicious use of AI there, with these kinds of guard rails..."

dclowd9901 1y ago
What's the risk of not doing this? Better code but slower velocity for an open source project? I think that particular brand of risk makes sense for this particular project, and the authors don't seem particularly negative toward GenAI as a concept, just going through a "one way door" with it.
- mrheosuper 1y ago
  >Better code but slower velocity for an open source project Better code and "AI assist coding" are not exclusive of each other.
  - dclowd9901 1y ago
    In my experience they seem to be, granted that is anecdotal.
kazinator 1y ago
There is a well settled practice in computing that you just don't plagiarize code. Even a small snippet. Even if copyright law would consider such a small thing "fair use".
- 9283409232 1y ago

curious_cat_163 1y ago

That’s very conservative.

JonChesterfield 1y ago

Interesting. Harder line than the LLVM one found at https://llvm.org/docs/DeveloperPolicy.html#ai-generated-contributions https://llvm.org/docs/DeveloperPolicy.html#ai-generated-cont... I'm very old man shouting at clouds about this stuff. I don't want to review code the author doesn't understand and I don't want to merge code neither of us understand.

compton93 1y ago
I don't want to review code the author doesn't understand This really bothers me. I've had people ask me to do some task except they get AI to provide instructions on how to do the task and send me the instructions, rather than saying "Hey can you please do X". It's insulting.
- andy99 1y ago
  Had someone higher up ask about something in my area of expertise. I said I didn't think is was possible, he followed up with a chatGPT conversation he had where it "gave him some ideas that we could use as an approach", as if that was some useful insight. This is the same people that think that "learning to code" is a translation issue they don't have time for as opposed to experience they don't have.
  - candiddevmike 1y ago
    Imagine a boring dystopia where everyone is given hallucinated tasks from LLMs that may in some crazy way be feasible but aren't, and you can't argue that they're impossible without being fired since leadership lacks critical thinking.
    - tines 1y ago
      Reminds me of the wonderful skit, The Expert: https://www.youtube.com/watch?v=BKorP55Aqvg https://www.youtube.com/watch?v=BKorP55Aqvg
      - 1y ago

ants_everywhere 1y ago

This is signed off primarily by RedHat, and they tend to be pretty serious/corporate. I suspect their concern is not so much whether users have own the copyright to AI output but rather the risk that AI will spit out code from its training set that belongs to another project. Most hypervisors are closed source and some are developed by litigious companies.

duskwuff 1y ago
I'd also worry that a language model is much more likely to introduce subtle logical errors, potentially ones which violate the hypervisor's security boundaries - and a user relying heavily on that model to write code for them will be much less prepared to detect those errors.
- ants_everywhere 1y ago
  Generally speaking AI will make it easier to write more secure code. Tooling and automation help a lot with security and AI makes it easier to write good tooling. I would wager good money that in a few years the most security-focused companies will be relying heavily on AI somewhere in their software supply chain. So I don't think this policy is about security posture. No doubt human experts are reviewing the security-relevant patches anyway.
  - tho23i4234324 1y ago
    I'd doubt this very much - LLMs hallucinate API calls and commit all sorts of subtle errors that you need to catch (esp. if you're on proprietary problems which it's not trained on). It's a good replacement for Google, but probably nothing close to what it's being hyped out to be by the capital allocators.
  - OtherShrezzing 1y ago
    While LLMs are really good at generating content, one of their key weaknesses is their (relative) inability to detect _missing_ content. I'd argue that the most impactful software security bugs in the last couple of decades (Heartbleed etc) have been errors of omission, rather than errors of inclusion. This means LLMs are: 1) producing lots more code to be audited 2) poor at auditing that code for the most impactful class of bugs That feels like a dangerous combination.

Art9681 1y ago

This is a "BlockBuster laughs Netflix out of the room" moment. I am a huge fan of QEMU and used it throughout my career. The maintainers have every right to govern their project as they see fit. But this is a lot of mental gymnastics to justify clinging to punchcards in a world where we now have magnetic tape and keyboards to do things faster. This tech didn't spawn weeks ago. Every major project has had at least two years to prepare for this moment. Pull your pants up.

9283409232 1y ago
You're so dramatic. Like they said in the declaration, these are the early days of AI development and all the problems they mention will be eventually resolved so they have no problem taking a backseat while things sort themselves out and I respect that choice.
add-sub-mul-div 1y ago
> This is a "BlockBuster laughs Netflix out of the room" moment I'm not sure that's the dunk you think it is. Good for Netflix for making money, but we're drowning in their empty slop content now and worse off for it.
- gjs278 1y ago
  [dead]
- danielbln 1y ago
  Who is forcing you to watch slop? And mind you, there was a TON of garbage at any local Blockbuster back in the day, with the added joy of having to go somewhere to rent it, being slapped with late and rewind fees or not even have availability of what you want to watch. Choice is good. It means more slop, but also more gold. Figure out how to find the gold.
catlifeonmars 1y ago
2 years isn’t that long. It took the Linux kernel 10 years to start accepting code written in Rust. This isn’t quite the same as the typical frontend flavor-of-the week JavaScript library.

benlivengood 1y ago

Open source and libre/free software are particularly vulnerable to a future where AI-generated code is ruled to be either infringing or public domain. In the former case, disentangling AI-edits from human edits could tie a project up in legal proceedings for years and projects don't have any funding to fight a copyright suit. Specifically, code that is AI-generated and subsequently modified or incorporated in the rest of the code would raise the question of whether subsequent human edits were non-fair-use derivative works. In the latter case the license restrictions no longer apply to portions of the codebase raising similar issues from derived code; a project that is only 98% OSS/FS licensed suddenly has much less leverage in takedowns to companies abusing the license terms; having to prove that infringers are definitely using the human-generated and licensed code. Proprietary software is only mildly harmed in either case; it would require speculative copyright owners to disassemble their binaries and try to make the case that AI-generated code infringed without being able to see the codebase itself. And plenty of proprietary software has public domain code in it already.

deadbabe 1y ago
If a software is truly wide open source in the sense of “do whatever the fuck you want with this code, we don’t care”, then it has nothing to fear from AI.
- candiddevmike 1y ago
  Won't apply to closed source, not public code, which the GPL (QEMU uses) is quite good at ensuring becomes open source...
- kgwxd 1y ago
  Can't release someone else's proprietary source under a "do whatever the fuck you want" license and actually do whatever the fuck you want, without getting sued.
  - deadbabe 1y ago
    It’d be like trying to squeeze blood from a stone

hughw 1y ago

I'd hope there could be some distinction between using LLM as a super autocomplete in your IDE, vs giving it high-level guidelines and making it generate substantive code. It's a gray area, sure, but if I made a contribution I'd want to be able to use the labor-saving feature of Copilot, say, without danger of it copying an algorithm from open source code. For example, today I generated a series of case statements and Copilot detected the pattern and saved me tons of typing.

dheera 1y ago
That and also just AI glasses that become an extension of my mind and body, just giving me clues and guidance on everything I do including what's on my screen. I see those glasses as becoming just a part of me, just like my current dumb glasses are a part of me that enables me to see better, the smart glasses will help me to see AND think better. My brain was trained on a lot of proprietary code as well, the copyright issues around AI models are pointless western NIMBY thinking and will lead to the downfall of western civilization if they keep pursuing legal what-ifs as an excuse to reject awesome technology.

mattl 1y ago

I'm interested to see how this plays out. I'd like a similar policy for my projects, but also a similar policy/T&C that prohibits the crawling of the content too.

candiddevmike 1y ago
Only way to prohibit crawling is to go back to invite only, probably self-hosted repositories. These companies have no shame, your T&Cs won't mean anything to them and you have no way of proving they violated them without some kind of discovery into their training data.
- deleted 1y ago
  [deleted]

acedTrex 1y ago

Oh hey, the thing I predicted in my blog titled "yes i will judge you for using AI" happened lol Basically I think open source has traditionally HEAVILY relied on hidden competency markers to judge the quality of incoming contributions. LLMs throw that entire concept on its head by presenting code that has competent markers but none of the backing experience. It is a very very jarring experience for experienced individuals. I suspect that virtual or in person meetings and other forms of social proof independent of the actual PR will become far more crucial for making inroads in large projects in the future.

SchemaLoad 1y ago
I've started seeing this at work with coworkers using LLMs to generate code reviews. They submit comments which are way above their skill level which almost trick you in to thinking they are correct since only a very skilled developer would make these suggestions. And then ultimately you end up wasting tons of time proving how these suggestions are wrong. Spending far more time than the person pasting the suggestions spent to generate them.
- acedTrex 1y ago
  Yep 100%, it is something I have also observed. Frankly has been frustrating to the point I spun up a quick one off html site to rant/get my thoughts out. https://jaysthoughts.com/aithoughts1 https://jaysthoughts.com/aithoughts1
  - whatevertrevor 1y ago
    Just some feedback: your site is hard to read on mobile devices because of the sidebar.
    - acedTrex 1y ago
      Thank you, I'll get that fixed. Edit: Mobile should be fixed now
- 1y ago

BurningFrog 1y ago

Would it make sense to include the complete prompt that generated the code with the code?

astrobiased 1y ago
It would need to be more than that. A prompt for one model can have different results vs another. Even when the model has different treatment for inference, eg quantization, the same prompt for the unquantized and quantized model could differ.
- verdverm 1y ago
  Even more so, when you come back to understand in a few years, the model will no longer be available
  - galangalalgol 1y ago
    One of several reasons to use an open model even if it isn't quite as good. Version control the models and commit the prompts with the model name and a hash of the parameters. I'm not really sure what value that reproducibility adds though.
catlifeonmars 1y ago
You’d need to hash the model weights and save the seeds for the temperature prng as well, in order to verify the provenance. Ideally it would be reproducible, right?
- danielbln 1y ago
  Maybe 2 years ago. Nowadays LLMs call functions and use tools, good luck capturing that in a way that it's reproducible.
ethan_smith 1y ago
Including prompts would create transparency but still wouldn't resolve the underlying copyright uncertainty of the output or guarantee the code wasn't trained on incompatibly-licensed material.

deleted 1y ago

[deleted]

deleted 1y ago

[deleted]

Aeolun 1y ago

This seems absolutely impossible to enforce. All my editors give me AI assisted code hints. Zed, cursor, VS code. All of them now show me autocomplete that comes from an LLM. There's absolutely no distinction between that code, and code that I've typed out myself. It's like complaining that I may have no legal right to submit my stick figure because I potentially copied it from the drawing of another stick figure. I'm firmly convinced that these policies are only written to have plausible deniability when stuff with generated code gets inevitably submitted anyway. There's no way the people that write these things aren't aware they're completely unenforceable.

luispauloml 1y ago
> I'm firmly convinced that these policies are only written to have plausible deniability when stuff with generated code gets inevitably submitted anyway. Of course it is. And nobody said otherwise, because that is explicitly stated on the commit message: [...] More broadly there is, as yet, no broad consensus on the licensing implications of code generators trained on inputs under a wide variety of licenses And in the patch itself: [...] With AI content generators, the copyright and license status of the output is ill-defined with no generally accepted, settled legal foundation. What other commenters pointed out is that, beyond the legal issue, other problems also arise form the use of AI-generated code.
- teeray 1y ago
  It’s like the seemingly-confusing gates passing through customs that say “nothing to declare” when you’ve already made your declarations. Walking through that gate is a conscious act that places culpability on you, so you can’t simply say “oh, I forgot” or something. The thinking here is probably similar: if AI-generated code becomes poisonous and is detected in a project, the DCO could allow shedding liability onto the contributor that said it wasn’t AI-generated.
- Filligree 1y ago
  > Of course it is. And nobody said otherwise, because that is explicitly stated on the commit message Don’t be ridiculous. The majority of people are in fact honest, and won’t submit such code; the major effect of the policy is to prevent those contributions. Then you get plausible deniability for code submitted by villains, sure, but I’d like to hope that’s rare.

sysmax 1y ago

I wish people would make distinction regarding the size/scope of the AI-generated parts. Like with video copyright laws, where a 5-second clip from a copyrighted movie is usually considered fair use and not frowned upon. Because for projects like QEMU, current AI models can actually do mind-boggling stuff. You can give it a PDF describing an instruction set, and it will generate you wrapper classes for emulating particular instructions. Then you can give it one class like this and a few paragraphs from the datasheet, and it will spit out unit tests checking that your class works as the CPU vendor describes. Like, you can get from 0% to 100% test coverage several orders of magnitude faster than doing it by hand. Or refactoring, where you want to add support for a particular memory virtualization trick, and you need to update 100 instruction classes based on straight-forward, but not 100% formal rule. A human developer would be pulling their hairs out, while an LLM will do it faster than you can get a coffee.

echelon 1y ago
Qemu can make the choice to stay in the "stone age" if they want. Contributors who prefer AI assistance can spend their time elsewhere. It might actually be prudent for some (perhaps many foundational) OSS projects to reject AI until the full legal case law precedent has been established. If they begin taking contributions and we find out later that courts find this is in violation of some third party's copyright (as shocking as that outcome may seem), that puts these projects in jeopardy. And they certainly do not have the funding or bandwidth to avoid litigation. Or to handle a complete rollback to pre-AI background states.
762236 1y ago
It sounds like you're saying someone could rewrite Qemu on their own, with the help of AI. That would be pretty funny.
- mrheosuper 1y ago
  Given enough time, a monkey randomly types on typewriter can rewrite QEMU.
halostatue 1y ago

pretoriusdre 1y ago

AI generated code is generally pretty good and incredibly fast. Seeing this new phenomenon must be difficult for those people who have spent a long time perfecting their craft. Essentially, they might feel that their skillsets are being undermined. It would be especially hard for people who associate a lot of their self-identity with their job. Being a purist is noble, but I think that this stance is foolish. Essentially, people who chose not to use AI code tools will be overtaken by the people who do. That's the unfortunate reality.

loktarogar 1y ago
It's not a stance about the merits of AI generated code but about the legal status of it, in terms of who owns it and related concepts.
- pretoriusdre 1y ago
  Yes the reasoning behind the decision is clear and as you described. But I would also make the point that the decision also comes with certain consequences, to which a discussion about merits is directly relevant.
  - loktarogar 1y ago
    > Essentially, people who chose not to use AI code tools will be overtaken by the people who do. That's the unfortunate reality. Who is going to "overtake" QEMU, what exactly does that mean, and what will it matter if they are?
    - danielbln 1y ago
      OP said people. QEMU is not people.
      - loktarogar 1y ago
        We're talking about a decision that the people behind QEMU made that affects people, to which the consequences of made the discussion of merits "directly relevant". If we're talking about something that neither involving QEMU nor the people behind it, where is the relevance? It's just a rant on AI at that point.

naveed125 1y ago

Coolest thing I've seen today.

N1H1L 1y ago

I use LLMs for generating documentation- I write my code, and ask Claude to write my documentation

auggierose 1y ago
I think you are doing it the wrong way around.
- insane_dreamer 1y ago
  Maybe not. I trust Claude to write docs. I don’t trust it to write my code the way I want.

jssjsnj 1y ago

abhisek 1y ago

> It's best to start strict and safe, then relax. Makes total sense. I am just wondering how do we differentiate between AI generated code and human written code that is influenced or copied from some unknown source. The same licensing problem may happen with human code as well especially for OSS where anyone can contribute. Given the current usage, I am not sure if AI generated code has an identity of its own. It’s really a tool in the hand of a human.

catlifeonmars 1y ago
> Given the current usage, I am not sure if AI generated code has an identity of its own. It’s really a tool in the hand of a human. It’s a power saw. A really powerful tool that can be dangerous if used improperly. In that sense the code generator can have more or less of a mind of its own depending on the wielder. Ok I think I’ve stretched the analogy to the breaking point…

b0a04gl 1y ago

[dead]

caleblloyd 1y ago

Signed by mostly people at RedHat, which is owned by IBM, which makes Watson, which beat humans in Jeopardy in 2011. > These are early days of AI-assisted software development. Are they? Or is this just IBM destroying another acquisition slowly. Meanwhile the Dotnet Runtime is fully embracing AI. Which people on the outside may laugh at but you have extremely talented engineers like Stephen Toub and David Fowler advocating for it. So enterprises: next time you have an IBM rep trying to sell you AI services, do yourself a favor and go to any other number of companies out there who are actually serious about helping you build for the future. And since I am a North Carolina native, here’s to hoping IBM and RedHat get their stuff together.

bgwalter 1y ago

It is interesting to read the pro-AI rant in the comments on the linked commit. The person who is threatening to use "AI" anyway has almost no contributions either in qemu or on GitHub in general. This is the target group for code generators. All talk but no projects.

ludicrousdispla 1y ago

>> The tools will mature, and we can expect some to become safely usable in free software projects. It should be possible to build a useful AI code generator for a given programming language solely from the source code for the language itself. Doing so however would require some maturity.

zoobab 1y ago

BigTech now control Qemu? "Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>"

wlkr 1y ago

incomingpain 1y ago

Using AI code generators. I have been able to get the code base large enough that it was starting to make nonsense changes. However, my overall experience I have been thinking about how this is going to be a massive boon to open source. So many patches, so many new tools will be created to streamline getting new packages into repos. Everything can be tested. Open source is going to be epicly boosted now. QEMU deciding to sit out from this acceleration is crazy to me, but probably what is going to give Xen/Docker/Podman the lead.

flerchin 1y ago

I suppose the practical effect will be that contributors who use AI will have to defend their code as if they did not. To me, this implies more ownership of the code and deep understanding of it. This exchange happens fairly often in PRs I'm involved with: "Why did you do this insane thing?" "IDK, claude suggested it and it works."

UrineSqueegee 1y ago

if AI using books to train isn't copyright infringement then the outputted code isn't copyrighted material either

tqwhite 1y ago

I don't blame them for worrying about it. The policy should not be to forbid it but make sure you don't leave artifacts because I guarantee, people are going to use a bot to write their code. Hell, in six months, I doubt you will be able to get a code editor that doesn't use AI for code completion at least. Also, AI coded programs will be copyrightable just like the old days. You think the big corps are going to both not use bot coding and give up ownership of their code? Fat chance. Remember the Micky Mouse copyright extension? If the courts aren't sensible, we will have one of those the next day. The old days ended very abruptly this time.

randomNumber7 1y ago

I mean for low level C code the current LLMs are not that helpful anyway. On the other hand I am 100% sure that every company that doesn't use LLMs will be out of business in 10 years.

saurik 1y ago

As someone who once worked on a product that had to carefully walk the line of legality, I haven't found any mention in this discussion of what I imagine is a key problem for qemu, that doesn't face other projects: as an emulator, they are already under a lot of scrutiny for legality, and so they are going to need to be a lot more conservative than other random projects with respect to increasing their legal risk.

lexiciccone 1y ago

[dead]

maerF0x0 1y ago

I was literally musing on a parallel subject yesterday morning, how engineers kinda did it to themselves with Open Source, LLM Code generators would probably not be possible without the large corpus of totally available (readable) lines of mostly valid code hosted in places like github.com . It strikes me that Open Source was inevitable as companies and engineers found it economical (a good choice) to amortize the cost of building something across many of them, without as much legality/negotiation/constraints as if they did so in a closed source way collectively. It was kinda a sort of good will community thing. For FOSS, in the case of companies by not competing on things like a javascript framework, and instead on the product features themselves. Or, in the case of engineers by allowing themselves access to that same code across many employers. Now that gambit is approaching the point where most projects which could be assembled by entirely FOSS (lots of it) is becoming easier and easier to generate. It'd take a 20(?) person team of expensive nerds weeks/months to build a website in 1995, but now a normal individual can simply ask for a website to be made by an LLM. Across my ~30 years in software (eep), it seems that the table stakes for the minimum viable software keeps just growing and growing-- It used to be a push to have an API, now its minimum viable, it used to be a push to get "live" notificatoins (via polling!) now its minimum viable to push via websockets. Etc etc for the surviving set of features.