26 ms·

AI Usage Policy

502 points by mefengl 9mo ago

mefengl 9mo ago
[flagged]
- postepowanieadm 9mo ago
  That's really nice - and fast ui!
  - kleiba 9mo ago
    It gets even better when you click on "raw", IMO... which is what you also get when clicking on "raw" on Github.
- christoph-heiss 9mo ago
  Not sure why you are getting downvoted, given that the original site is such a jarringly user-hostile mess.
  - embedding-shape 9mo ago
    Without using a random 3rd party, and without the "jarring user-hostile mess": https://raw.githubusercontent.com/ghostty-org/ghostty/refs/heads/main/AI_POLICY.md https://raw.githubusercontent.com/ghostty-org/ghostty/refs/h...
    - flexagoon 9mo ago
      This option is pretty unreadable on mobile though
      - embedding-shape 9mo ago
        Is it? Just tried it in Safari, Firefox and Chrome on a iPhone 12 Mini and I can read all the text? Obviously it isn't formatted, as it's raw markdown, just like what parent's recommended 3rd party platform does, but nothing is cut off or missing for me. Actually, trying to load that previous platform on my phone makes it worse for readability, seems there is ~10% less width and not as efficient use of vertical space. Together with both being unformatted markdown, I think the raw GitHub URL seems to render better on mobile, at least small ones like my mini.
  - user34283 9mo ago
    Whatever your opinion on the GitHub UI may be, at least the text formatting of the markdown is working, which can't be said for that alternative site.
cxrpx 9mo ago
with limited training data that llm generated code must be atrocious
jakozaur 9mo ago
See x thread for rationale: https://x.com/mitchellh/status/2014433315261124760?s=46&t=FUC7A03ybfK2P4BtFJjecg https://x.com/mitchellh/status/2014433315261124760?s=46&t=FU... “ Ultimately, I want to see full session transcripts, but we don't have enough tool support for that broadly.” I have a side project, git-prompt-story to attach Claude Vode session in GitHub git notes. Though it is not that simple to do automatic (e.g. i need to redact credentials).
- optimalsolver 9mo ago
  >I want to see full session transcripts, but we don't have enough tool support for that broadly I think AI could help with that.
  - stevenhuang 9mo ago
    simow wrote a tool that does this for Claude code https://simonw.substack.com/p/a-new-way-to-extract-detailed-transcripts https://simonw.substack.com/p/a-new-way-to-extract-detailed-...
- radarsat1 9mo ago
  I've thought about saving my prompts along with project development and even done it by hand a few times, but eventually I realized I don't really get much value from doing so. Are there good reasons to do it?
  - fragmede 9mo ago
    It's not for you. It's so others can see how you arrived to the code that was generated. They can learn better prompting for themselves from it, and also how you think. They can see which cases got considered, or not. All sorts of good stuff that would be helpful for reviewing giant PRs.
    - Ronsenshi 9mo ago
      Sounds depressing. First you deal with massive PRs and now also these agent prompts. Soon enough there won't be any coding at all, it seems. Just doomscrolling through massive prompt files and diffs in hopes of understanding what is going on.
arjunbajaj 9mo ago
I can see this becoming a pretty generally accepted AI usage policy. Very balanced. Covers most of the points I'm sure many of us have experienced here while developing with AI. Most importantly, AI generated code does not substitute human thinking, testing, and clean up/rewrite. On that last point, whenever I've gotten Codex to generate a substantial feature, usually I've had to rewrite a lot of the code to make it more compact even if it is correct. Adding indirection where it does not make sense is a big issue I've noticed LLMs make.
- imiric 9mo ago
  I agree with you on the policy being balanced. However: > AI generated code does not substitute human thinking, testing, and clean up/rewrite. Isn't that the end goal of these tools and companies producing them? According to the marketing[1], the tools are already "smarter than people in many ways". If that is the case, what are these "ways", and why should we trust a human to do a better job at them? If these "ways" keep expanding, which most proponents of this technology believe will happen, then the end state is that the tools are smarter than people at everything, and we shouldn't trust humans to do anything. Now, clearly, we're not there yet, but where the line is drawn today is extremely fuzzy, and mostly based on opinion. The wildly different narratives around this tech certainly don't help. [1]: https://blog.samaltman.com/the-gentle-singularity https://blog.samaltman.com/the-gentle-singularity
  - Terretta 9mo ago
    Intern generated code does not substitute for tech lead thinking, testing, and clean up/rewrite.
    - imiric 9mo ago
      No, the code is generated by a tool that's "smarter than people in many ways". So which parts of "thinking, testing, and clean up/rewrite" can we trust it with?
      - 9mo ago
alansaber 9mo ago
"Pull requests created by AI must have been fully verified with human use." should always be a bare minimum requirement.
- deleted 9mo ago
  [deleted]
- Ntrails 9mo ago
  > "Pull requests [] must have been fully verified with human use." I would expect this is entirely uncontroversial and the AI qualifier redundant.
  - Retr0id 9mo ago
    If you have good tests, certain types of change can be merged without manual testing. One problem specific to AI is that it has a tendency to game/bypass/nerf/disable tests, as opposed to actually making the code do the correct thing.
    - verdverm 9mo ago
      that's why we have CI like GHA that runs the tests on PRs / commits
- bwat49 9mo ago
  I would hope that actually testing the changes is done regardless of whether or not AI is used
- njhnjhnjh 9mo ago
  AI is so smart these days that I typically just ask Claude to verify the code for me. This sort of request may have made sense in the old days but as the quality of generated code rapidly increases, so does the necessity of human intervention decrease.
  - Applejinx 9mo ago
vegabook 9mo ago
Ultimately what's happening here is AI is undermining trust in remote contributions, and in new code. If you don't know somebody personally, and know how they work, the trust barrier is getting higher. I personally am already ultra vigilant for any github repo that is not already well established, and am even concerned about existing projects' code quality into the future. Not against AI per se (which I use), but it's just going to get harder to fight the slop.
epolanski 9mo ago
Honestly I don't care how people come with the code they create, but I hold them responsible for what they try to merge. I work in a team of 5 great professionals, there hasn't been a single instance since Copilot launched in 2022 that anybody, in any single modification did not take full responsibility for what's been committed. I know we all use it, to different extent and usage, but the quality of what's produced hasn't dipped a single bit, I'd even argue it has improved because LLMs can find answers easier in complex codebases. We started putting `_vendor` directories with our main external dependencies as git subtrees, and it's super useful to find information about those directly in their source code and tests. It's really as simple. If your teammates are producing slop, that's a human and professional problem and these people should be fired. If you use the tool correctly, it can help you a lot finding information and connecting dots. Any person with a brain can clearly see the huge benefit of these tools, but also the great danger of not reviewing their output line by line and forfeiting the constant work of resolving design tensions. Of course, open source is a different beast. The people committing may not be professionals and have no real stakes so they get little to lose by producing slop whereas maintainers are already stretched in their time and attention.
- embedding-shape 9mo ago
  > It's really as simple. If you or your teammates are producing slop, that's a human and professional problem and these people should be fired. Agree, slop isn't "the tool is so easy to use I can't review the code I'm producing", slop is the symptom of "I don't care how it's done, as long as it looks correct", and that's been a problem before LLMs too, the difference is how quickly you reach the "slop" state now, not that you have gate your codebase and reject shit code. As always, most problems in "software programming" isn't about software nor programming but everything around it, including communication and workflows. If your workflow allows people to not be responsible for what they produce, and if allows shitty code to get into production, then that's on you and your team, not on the tools that the individuals use.
- altmanaltman 9mo ago
  I mean this policy only applies to outside contributors and not the maintainers. > Ghostty is written with plenty of AI assistance, and many maintainers embrace AI tools as a productive tool in their workflow. As a project, we welcome AI as a tool! > Our reason for the strict AI policy is not due to an anti-AI stance, but instead due to the number of highly unqualified people using AI. It's the people, not the tools, that are the problem. Basically don't write slop and if you want to contribute as an outsider, ensure your contribution actually is valid and works.
kanzure 9mo ago
Another project simply paused external contributions entirely: https://news.ycombinator.com/item?id=46642012 https://news.ycombinator.com/item?id=46642012 Another idea is to simply promote the donation of AI credits instead of output tokens. It would be better to donate credits, not outputs, because people already working on the project would be better at prompting and steering AI outputs.
- lagniappe 9mo ago
  >people already working on the project would be better at prompting and steering AI outputs. In an ideal world sure, but I've seen the entire gamut from amateurs making surprising work to experts whose prompt history looks like a comedy of errors and gotchas. There's some "skill" I can't quite put my finger on when it comes to the way you must speak to an LLM vs another dev. There's more monkey-paw involved in the LLM process, in the sense that you get what you want, but do you want what you'll get?
CrociDB 9mo ago
I recently had to do a similar policy for my TUI feed reader, after getting some AI slop spammy PRs: https://github.com/CrociDB/bulletty?tab=contributing-ov-file#generative-ai-use https://github.com/CrociDB/bulletty?tab=contributing-ov-file... The fact that some people will straight up lie after submitting you a PR with lots of _that type_ of comment in the middle of the code is baffling!
nutjob2 9mo ago
A factor that people have not considered is that the copyright status of AI generated text is not settled law and precedent or new law may retroactively change the copyright status of a whole project. Maybe a bit unlikely, but still an issue no one is really considering. There has been a single ruling (I think) that AI generated code is uncopyrightable. There has been at least one affirmative fair use ruling. Both of these are from the lower courts. I'm still of the opinion that generative AI is not fair use because its clearly substitutive.
- direwolf20 9mo ago
  This only matters if you get sued for copyright violation, though.
  - christoph-heiss 9mo ago
    No? Licenses still apply even if you _don't_ get sued?
    - latexr 9mo ago
      Do they? Isn’t the application of the license its enforcement? It’s illegal to commit fraud or murder, but if you do it and suffer no consequences (perhaps you even get pardoned by your president), does it matter that it was illegal? Laws are as strong as their enforcement. For a less grim and more explicit example, Apple has a policy on the iOS App Store that apps may not use notifications to advertise. Yet it happens all the time, especially from big players like Uber. Apple themselves have done it too. So if you’re a bad actor and disrespectful to your users, does it matter that the rule exists?
    - deleted 9mo ago
      [deleted]
    - direwolf20 9mo ago
      Licenses determine the outcome of copyright lawsuits. If there's no copyright lawsuit, nobody looks at the license. Licenses determine whether a copyright lawsuit is likely to happen. Most entities won't sue you if they expect to lose. But they are not the only deciding factor. Some entities never sue, which means you don't have to follow their licenses. Sometimes they don't sue because they don't think they can prove you infringed copyright, even if you did. Even if AI is found to be copyright infringement in general, that won't mean every output is a copyright infringement of every input. Writing C code wouldn't be copyright infringement of Harry Potter. The entity suing you would still have to prove that you infringed.
Version467 9mo ago
The biggest surprise to me with all this low-quality contribution spam is how little shame people apparently have. I have a handful of open source contributions. All of them are for small-ish projects and the complexity of my contributions are in the same ball-park as what I work on day-to-day. And even though I am relatively confident in my competency as a developer, these contributions are probably the most thoroughly tested and reviewed pieces of code I have ever written. I just really, really don't want to bother someone with low quality "help" who graciously offers their time to work on open source stuff. Other people apparently don't have this feeling at all. Maybe I shouldn't have been surprised by this, but I've definitely been caught off guard by it.
- Etheryte 9mo ago
  I worked for a major open-source company for half a decade. Everyone thinks their contribution is a gift and you should be grateful. To quote Bo Burnham, "you think your dick is a gift, I promise it's not".
  - latexr 9mo ago
    > To quote Bo Burnham, "you think your dick is a gift, I promise it's not". For those curious: https://www.youtube.com/watch?v=llGvsgN17CQ https://www.youtube.com/watch?v=llGvsgN17CQ
  - Cthulhu_ 9mo ago
    Sounds like everyone's got some main character syndrome, the cure for that is to be a meaningless cog in the enterprise wheels for a while. But then I suspect a lot of open source contributions are done exactly by those people - they don't really matter in their day job, but in open source they can Make A Difference. Of course, the vast majority of OS work is the same cog-in-a-machine work, and with low effort AI assisted contributions, the non-hero-coding work becomes more prevalent than ever.
- kleiba 9mo ago
  "Other people" might also just be junior devs - I have seen time and again how (over-)confident newbies can be in their code. (I remember one case where a student suspected a bug in the JVM when some Java code of his caused an error.) It's not necessarily maliciousness or laziness, it could simply be enthusiasm paired with lack of experience.
cranium 9mo ago
A well crafted policy that, I think, will be adopted by many OSS. You'd need that kind of sharp rules to compete against unhinged (or drunken) AI drivers and that's unfortunate. But at the same time, letting people DoS maintainers' time at essential no cost is not an option either.
Lucasoato 9mo ago
> Bad AI drivers will be banned and ridiculed in public. You've been warned. We love to help junior developers learn and grow, but if you're interested in that then don't use AI, and we'll help you. I'm sorry that bad AI drivers have ruined this for you. Finally an AI policy I can agree with :) jokes aside, it might sound a bit too agressive but it's also true that some people have really no shame into overloading you with AI generated shit. You need to protect your attention as much as you can, it's becoming the new currency.
- weinzierl 9mo ago
  I don't think ridicule is an effective threat for people with no shame to begin with.
  - sjajshha 9mo ago
    [dead]
  - wpietri 9mo ago
    Well, this is explicitly public ridicule. The penalty isn't just feeling shamed. It's reputational harm, immortalized via Google. One of the theorized reasons for junk AI submissions is reputation boosting. So maybe this will help. And I think it will help with people who just bought into the AI hype and are proceeding without much thought. Cluelessness can look a lot like shamelessness at first.
  - mijoharas 9mo ago
    I think it makes sense, both for this, and for curl. Presumably people want this for some kind of prestige, so they can put it on their CV (contributed to ghostty/submitted security issue to curl). If we change that equation to have them think "wait, if I do this, then when employers Google me they'll see a blog post saying I'm incompetent" changes calculation that is neutral/positive for if their slop gets accepted to negative/positive. Seems like it's addressing the incentives to me.
- Applejinx 9mo ago
  Doubly so as these bad AI drivers are trading away even the possibility of having attention. It's very possible to render yourself senseless through a habit of deference. Even if you're coming up with ways to optimize AI responses, you are just trying to make a more superior superior to defer to.
rikschennink 9mo ago
> No AI-generated media is allowed (art, images, videos, audio, etc.). Text and code are the only acceptable AI-generated content, per the other rules in this policy. I find this distinction between media and text/code so interesting. To me it sounds like they think "text and code" are free from the controversy surrounding AI-generated media. But judging from how AI companies grabbed all the art, images, videos, and audio they could get their hands on to train their LLMs it's naive to think that they didn't do the same with text and code.
- embedding-shape 9mo ago
  > To me it sounds like "text and code" are free from the controversy surrounding AI-generated media. It really isn't, don't you recall the "protests" against Microsoft starting to use repositories hosted at GitHub for training their own coding models? Lots of articles and sentiments everywhere at the time. Seems to have died down though, probably because most developers seemingly at this point use LLMs in some capacity today. Some just use it as a search engine replacement, others to compose snippets they copy-paste and others wholesale don't type code anymore, just instructions then review it. I'm guessing Ghostty feels like if they'd ban generated text/code, they'd block almost all potential contributors. Not sure I agree with that personally, but I'm guessing that's their perspective.
  - rikschennink 9mo ago
    Right, that's what I'm thinking too (I'll update my statement a bit to make that more clear), but I constantly hear this perspective that it's all good for text and code but when it's media, then it's suddenly problematic. It's equally problematic for text and code.
    - deleted 9mo ago
      [deleted]
    - deleted 9mo ago
      [deleted]
  - 9mo ago
antirez 9mo ago
TLDR don't be an asshole and produce good stuff. But I have the feeling that this is not the right direction for the future. Distrust the process: only trust the results. Moreover this policy is strictly unenforceable because good AI use is indistinguishable from good manual coding. And sometimes even the reverse. I don't believe in coding policies where maintainers need to spot if AI is used or not. I believe in experienced maintainers that are able to tell if a change looks sensible or not.
- b3kart 9mo ago
  This doesn't work in the age of AI where producing crappy results is much cheaper than verifying them. While this is the case, metadata will be important to understand if you should even bother verifying the results.
  - antirez 9mo ago
    The time needed for an AI patch written with the prompt "now make it as small as possible, clean, and human coded" is as big as reviewing the patch itself.
    - b3kart 9mo ago
      If this were so, we wouldn’t be seeing such reactions from open source maintainers. The reality is AI makes it cheap to create large PRs with little substance.
- sumtechguy 9mo ago
  As someone who has picked up recently some 'legacy' code. AI has been really good at mostly summing up what is going on. In many cases it finds things I had no idea was wrong (because I do not know the code very well yet). This is so called 'battle hardened code'. I review it and say 'yeah its is wildly broken and I see how the original developer ended up here'. Sometimes the previous dev would be nice enough to leave a comment or some devs 'the code is the comments'. I have also had AI go wildly off the rails and do very dumb things. It is an interesting tool for sure one you have to keep an eye on or it will confidently make a foot gun for you. It is also nice for someone like me who has some sort of weird social anxiaty thing about bugging my fellow devs. In that I can create options tables and pick good ideas out of that.
senko 9mo ago
On a tangent: the origin of the problems with low-quality drive-by requests is github's social nature. That might have been great when GitHub started, but nowadays many use it as portfolio padding and/or social proof. "This person contributed to a lot of projects" heuristic for "they're a good and passionate developer" means people will increasingly game this using low-quality submissions. This has been happening for years already. Of course, AI just added kerosene to the fire, but re-read the policy and omit AI and it still makes sense! A long term fix for this is to remove the incentive. Paradoxically, AI might help here because this can so trivially be gamed that it's obvious it's not longer any kind of signal.
- stephantul 9mo ago
  Your point about rereading without ai makes so much sense. The economics of it have changed, human nature hasn’t. Before 2023 (?) people also submitted garbage PRs just to be able to add “contributed to X” to their CV. It’s just become a lot cheaper.
  - TeMPOraL 9mo ago
    Let's not forget the Hacktober Fest, the scourge of open source for over a decade now, the driver of low-quality "contribution" spam by hordes of people doing it for a goddamn free t-shirt. No, this problem isn't fundamentally about AI, it's about "social" structure of Github and incentives it creates (fame, employment).
- achyudh 9mo ago
  Mailing lists essentially solve this by introducing friction: only those who genuinely care about the project will bother to git send-email and defend a patch over an email thread. The incentive for low-quality drive-by submissions also evaporates as there is no profile page with green squares to farm. The downside is that it potentially reduces the number of contributors by making it a lot harder for new contributors to onboard.
evilhackerdude 9mo ago
sounds reasonable to me. i've been wondering about encoding detailed AI disclosure in an SBOM. on a related note: i wish we could agree on rebranding the current LLM-driven never-gonna-AGI generation of "AI" to something else… now i'm thinking of when i read the in-game lore definition for VI (Virtual Intelligence) back when i played mass effect 1 ;)
KolmogorovComp 9mo ago
A good PR using IA should be impossible to distinguish from a non-AI one.
- layer8 9mo ago
  The problem is that most aren’t good, and bad ones can take a lot of effort to distinguish, if they look plausible on the surface. So the potentially good ones aren’t worth all the bad ones.
  - KolmogorovComp 9mo ago
    I agree with most of them being bad, I disagree with them taking lots of effort to distinguish, and I am maintainer unfortunately receiving receiving more and more using AI.
epaga 9mo ago
I really like the phrase "bad AI drivers"...AI is a tool, and the stupid drive-by pull requests just mean you're being inconsiderate and unhelpful in your usage of the tool, similar to how "bad drivers" are a nightmare to encounter on a highway...so stop it or you'll end up on the dashcam subreddit of programming.
- skybrian 9mo ago
  The experience of using a coding agent is that you're more of a "backseat driver" though. The AI acts as your driver and you tell it where to go, sometimes making corrections if it's going the wrong way.
  - cmsj 9mo ago
    The experience is what you make of it. Personally I'm quite enjoying using AI as a way to generate code I can disagree with and refactor into what I want.
    - skybrian 9mo ago
      Sure, and I ask it to do the refactoring, too!
deleted 9mo ago
[deleted]
KronisLV 9mo ago
> You must state the tool you used (e.g. Claude Code, Cursor, Amp) Interesting requirement! Feels a bit like asking someone what IDE they used. There shouldn't be that meaningful of a difference between the different tools/providers unless you'd consistently see a few underperform and would choose to ban those or something. The other rules feel like they might discourage AI use due to more boilerplate needed (though I assume the people using AI might make the AI fill out some of it), though I can understand why a project might want to have those sorts of disclosures and control. That said, the rules themselves feel quite reasonable!
milancurcic 9mo ago
I think that a warning of public ridicule may be fine. However, actually doing it is quite low brow IMO. I'm sad to see more and more otherwise admirable projects step down to that (assuming they actually do it).
- phanimahesh 9mo ago
  An unenforced threat is toothless. Publicly stating we do not appreciate XYZ pr that was ai generated, low effort and in bad faith is perfectly acceptable.
  - milancurcic 9mo ago
    I agree with the second statement but public ridicule can be understood to have a stronger effect, and be in bad faith itself.
- njhnjhnjh 9mo ago
  [dead]
hmokiguess 9mo ago
Banned I understand but ridiculed? I would say that these bad drive by spammers are analogous to phishing emails. Do you engage with those? Are they worth any energy or effort from you? I think ghostty should just ghost them :) EDIT: I'm getting downvoted with no feedback, which is fine I guess, so I am just going to share some more colour on my opinion in case I am being misunderstood What I meant with analogous to phishing is that the intent for the work is likely the one of personal reward and perhaps less of the desire to contribute. I was thinking they want their name on the contributors list, they want the credit, they want something and they don't want to put effort on it. Do they deserve to be ridiculed for doing that? Maybe. However, I like to think humans deserve kindness sometimes. It's normal to want something, and I agree that it is not okay to be selfish and lazy about it (ignoring contribution rules and whatnot), so at minimum I think respect applies. Some people are ignorant, naive, and are still maturing and growing. Bullying them may not help (thought it could) and mockery is a form of aggression. I think some true false positives will fall into that category and pay the price for those who are truly ill intended. Lastly, to ridicule is to care. To hate or attack requires caring about it. It requires effort, energy, and time from the maintainers. I think this just adds more waste and is more wasteful. Maybe those wordings are there just to 'scare' people away and maintainers won't bother engaging, though I find it is just compounding the amount of garbage at this point and nobody benefits from it. Anyways, would appreciate some feedback from those of you that seem to think otherwise. Thanks! PS: What I meant with ghostty should "ghost" them was this: https://en.wikipedia.org/wiki/Shadow_banning https://en.wikipedia.org/wiki/Shadow_banning
gverrilla 9mo ago
shaming doesn't work.
lifetimerubyist 9mo ago
Very quaint of them to exempt themselves because they've "proven themselves" already. Surely they are incapable of producing slop because they are just so much smarter than everyone else so the rules shouldn't apply to them, surely.
yaront111 9mo ago
[flagged]
deleted 9mo ago
[deleted]
yomismoaqui 9mo ago
Until now code was something costly to make and could only be created by our monkey brains. But now we have some kind of electronic brains that can also generate code, not at the level of the best human brains out there but good enough for most projects. And they are quicker and cheaper than humans, for sure. So maybe in the end this will reduce the need for human contributions to opensource projects. I just know that as a solo developer AI coding agents enable me to tackle projects I didn't think about event starting before.
Sparkyte 9mo ago
It is important to write the code yourself so you understand how it functions. I tried vibe coding a little bit. I totally felt like I was reading someone else's code base. Sanitization practices of AI are bad too. Let me be clear nothing wrong with AI in your workflow, just be an active participator in your code. Code is not meant to be one and done. You will go through iteration after iteration, security fix after fix. This is how development is.
PlatoIsADisease 9mo ago
These are unbelievably reasonable terms for AI. I might copy it for my company.
dw_arthur 9mo ago
I think a social norm of disclosing AI use at all times would be great. People and companies should also be held 100% accountable for anything created using AI.
- twoodfin 9mo ago
  I wish HN had a title tag for AI-generated posts, like it used to have for PDF’s and still does for year-of-publication.
tzs 9mo ago
> No AI-generated media is allowed (art, images, videos, audio, etc.). Text and code are the only acceptable AI-generated content, per the other rules in this policy What's the reason for this? Media is the most likely thing I'd consider using AI for as part of a contribution to an open source project. My code would be hand crafted by me. Any AI use would be similar to Google use: a way to search for examples and explanations if I'm unclear on something. Said examples and explanations would then be read, and after I understand what is going on I'd write my code. Any documentation I contributed would also be hand written. However, if I wanted to include a diagram in that documentation I might give AI a try. It can't be worse than my zero talent attempts to make something in OmniGraffle or worse a photograph of my attempt to draw a nice diagram on paper. I'd have expected this to be the least concerning use of AI.
- theshrike79 8mo ago
  AI generated media is a copyright gray zone. Very very few companies today have zero lines of AI generated code in their codebases. You can't copyright or patent specific code structures or ways of solving common problems.
andy99 9mo ago
> Issues and discussions can use AI assistance but must have a full human-in-the-loop. This means that any content generated with AI must have been reviewed and edited by a human before submission. I can see this being a problem. I read a thread here a few weeks ago where someone was called out on submitting an AI slop article they wrote with all the usual tells. They finally admitted it but said something to the effect they reviewed it and stood behind every line. The problem with AI writing is at least some people appear incapable of critically reviewing it. Writing something yourself eliminates this problem because it forces you to pick your words (there could be other problems of course). So the AI-blind will still submit slop under the policy but believe themselves to have reviewed it and “stand behind” it.
hereme888 9mo ago
At the moment I have 20 subagents fixing stuff throughout my own codebase. But I've never had the gall to let my AI agent do stuff on other people's projects without my direct oversight.
alya 9mo ago
At the Zulip open-source project, we've had a significant onslaught of AI slop in the past few months. It gets as absurd as PR descriptions with AI-generated "screenshots" of the app to "demonstrate" the changes. We've had to start warning contributors that we won't be able to review their work if they continue misusing AI, and occasionally banning repeat offenders. It's feels draining -- we want to spend our time mentoring people who'll actually learn from feedback, not interacting with contributors who are just copy-pasting LLM responses without thought. Our evolving AI policy is in the same spirit as ghostty's, with more detail to address specific failure modes we've experienced: https://zulip.readthedocs.io/en/latest/contributing/contributing.html#ai-use-policy-and-guidelines https://zulip.readthedocs.io/en/latest/contributing/contribu...
- verdverm 9mo ago
  Honestly, yours looks nothing like Mitchell's to me, and that's a good thing. It's actually reasonable and the guidance you provide on how to best use Ai when contributing to Zulip is :chef's kiss: truly, I'm going to copy yours as a thank you!
- jdxcode 9mo ago
  it's really strange, I maintain a lot of OSS and I just don't see it. I've had a bit of slop, and the # of PRs I receive has 10x'ed, but the quality is generally quite good. I wonder if maybe it's because I make dev tool CLIs that are just easier for AI to work with?
krzyk 9mo ago
It always amazes me why image/videos/audio generated by AI are treated differently from code. Are images somehow better? If one draws, is he better the one that writes code? Why protect one and not the other. Or why protect any form at all?
zzzeek 9mo ago
the endless issue with coding policy statements like this is that the people who need to read them the most are the ones who couldn't care less and don't read anything.
yellowapple 9mo ago
This is the most well-informed and reasonable AI policy I've seen so far. Neither kneejerk-hostile nor laissez faire; just a mature understanding of the limitations of LLMs, and an insistence on transparency and accountability when using them.
waldrews 9mo ago
We're just not going to see any code written entirely without AI except in specialist niches, just as we don't see handwritten assembly and binaries. So the disclosure part is going to become boilerplate. In the old era, the combination 'it works' + 'it uses a sophisticated language' + 'it integrates with a complex codebase' implied that this was an intentional effort by someone who knew what they were doing, and therefore probably safe to commit. We can no longer make that social assumption. So then, what can we rely on to signal 'this was thoroughly supervised and reviewed and understood and tested?' That's going to be hard and subjective. Personal reputations and track records are pedigrees and brands are going to become more important in the industry; and the meritocratic 'code talks no matter where you came from' ethos is at risk.
BoredomIsFun 9mo ago
How about autocomplete with LLMs? Should it be disclosed too? (scratching my balding head).
- pelasaco 9mo ago
  nah, this is just rhetorical polemic..
pelasaco 9mo ago
I’m starting to think AI will kill open source... and maybe even platforms like GitHub/GitLab as we know them. What I’m seeing: a flood of new repos appearing on GitHub with huge codebases and "extensive" documentation, often produced in two or three commits. The problem is that nobody uses them, nobody reads the docs, and many of these projects don’t provide real value. But the infrastructure cost is real: storing it all, indexing it, scanning it, backing it up, mirroring it.... Licensing is another issue. Licenses protect against copying, but AI changes totally the game: someone can download a repo, ask Claude to analyze and understand it, and then generate a similar solution with no verbatim copying. That’s likely legal... So GPL becomes irrelevant.. If that becomes normal, I can easily imagine companies pulling back from open source. Why publish your best work if anyone can cheaply reimplement it? Code will move back to closed source and become the "secret sauce" again. A black box is harder to vibe-code than an open source repo...
aisecurityguy 9mo ago
I wholeheartedly agree. It's the people that are the problem, not the technology. In the hands of people who understand it's utility and limitations, AI becomes an assistant you can't imagine life without. In the hands of people who aren't so intellectually curious, it helps them run into a brick wall much faster. My former boss often shared the words of his father: "A fool with a tool...is still a fool!" Even more true with AI.

AI Usage Policy

502 points by mefengl 9mo ago

mefengl 9mo ago

[flagged]

postepowanieadm 9mo ago
That's really nice - and fast ui!
- kleiba 9mo ago
  It gets even better when you click on "raw", IMO... which is what you also get when clicking on "raw" on Github.
christoph-heiss 9mo ago
Not sure why you are getting downvoted, given that the original site is such a jarringly user-hostile mess.
- embedding-shape 9mo ago
  Without using a random 3rd party, and without the "jarring user-hostile mess": https://raw.githubusercontent.com/ghostty-org/ghostty/refs/heads/main/AI_POLICY.md https://raw.githubusercontent.com/ghostty-org/ghostty/refs/h...
  - flexagoon 9mo ago
    This option is pretty unreadable on mobile though
    - embedding-shape 9mo ago
      Is it? Just tried it in Safari, Firefox and Chrome on a iPhone 12 Mini and I can read all the text? Obviously it isn't formatted, as it's raw markdown, just like what parent's recommended 3rd party platform does, but nothing is cut off or missing for me. Actually, trying to load that previous platform on my phone makes it worse for readability, seems there is ~10% less width and not as efficient use of vertical space. Together with both being unformatted markdown, I think the raw GitHub URL seems to render better on mobile, at least small ones like my mini.
- user34283 9mo ago
  Whatever your opinion on the GitHub UI may be, at least the text formatting of the markdown is working, which can't be said for that alternative site.

cxrpx 9mo ago

with limited training data that llm generated code must be atrocious

jakozaur 9mo ago

See x thread for rationale: https://x.com/mitchellh/status/2014433315261124760?s=46&t=FUC7A03ybfK2P4BtFJjecg https://x.com/mitchellh/status/2014433315261124760?s=46&t=FU... “ Ultimately, I want to see full session transcripts, but we don't have enough tool support for that broadly.” I have a side project, git-prompt-story to attach Claude Vode session in GitHub git notes. Though it is not that simple to do automatic (e.g. i need to redact credentials).

optimalsolver 9mo ago
>I want to see full session transcripts, but we don't have enough tool support for that broadly I think AI could help with that.
- stevenhuang 9mo ago
  simow wrote a tool that does this for Claude code https://simonw.substack.com/p/a-new-way-to-extract-detailed-transcripts https://simonw.substack.com/p/a-new-way-to-extract-detailed-...
radarsat1 9mo ago
I've thought about saving my prompts along with project development and even done it by hand a few times, but eventually I realized I don't really get much value from doing so. Are there good reasons to do it?
- fragmede 9mo ago
  It's not for you. It's so others can see how you arrived to the code that was generated. They can learn better prompting for themselves from it, and also how you think. They can see which cases got considered, or not. All sorts of good stuff that would be helpful for reviewing giant PRs.
  - Ronsenshi 9mo ago
    Sounds depressing. First you deal with massive PRs and now also these agent prompts. Soon enough there won't be any coding at all, it seems. Just doomscrolling through massive prompt files and diffs in hopes of understanding what is going on.

arjunbajaj 9mo ago

I can see this becoming a pretty generally accepted AI usage policy. Very balanced. Covers most of the points I'm sure many of us have experienced here while developing with AI. Most importantly, AI generated code does not substitute human thinking, testing, and clean up/rewrite. On that last point, whenever I've gotten Codex to generate a substantial feature, usually I've had to rewrite a lot of the code to make it more compact even if it is correct. Adding indirection where it does not make sense is a big issue I've noticed LLMs make.

imiric 9mo ago
I agree with you on the policy being balanced. However: > AI generated code does not substitute human thinking, testing, and clean up/rewrite. Isn't that the end goal of these tools and companies producing them? According to the marketing[1], the tools are already "smarter than people in many ways". If that is the case, what are these "ways", and why should we trust a human to do a better job at them? If these "ways" keep expanding, which most proponents of this technology believe will happen, then the end state is that the tools are smarter than people at everything, and we shouldn't trust humans to do anything. Now, clearly, we're not there yet, but where the line is drawn today is extremely fuzzy, and mostly based on opinion. The wildly different narratives around this tech certainly don't help. [1]: https://blog.samaltman.com/the-gentle-singularity https://blog.samaltman.com/the-gentle-singularity
- Terretta 9mo ago
  Intern generated code does not substitute for tech lead thinking, testing, and clean up/rewrite.
  - imiric 9mo ago
    No, the code is generated by a tool that's "smarter than people in many ways". So which parts of "thinking, testing, and clean up/rewrite" can we trust it with?
    - 9mo ago

alansaber 9mo ago

"Pull requests created by AI must have been fully verified with human use." should always be a bare minimum requirement.

deleted 9mo ago
[deleted]
Ntrails 9mo ago
> "Pull requests [] must have been fully verified with human use." I would expect this is entirely uncontroversial and the AI qualifier redundant.
- Retr0id 9mo ago
  If you have good tests, certain types of change can be merged without manual testing. One problem specific to AI is that it has a tendency to game/bypass/nerf/disable tests, as opposed to actually making the code do the correct thing.
  - verdverm 9mo ago
    that's why we have CI like GHA that runs the tests on PRs / commits
bwat49 9mo ago
I would hope that actually testing the changes is done regardless of whether or not AI is used
njhnjhnjh 9mo ago
AI is so smart these days that I typically just ask Claude to verify the code for me. This sort of request may have made sense in the old days but as the quality of generated code rapidly increases, so does the necessity of human intervention decrease.
- Applejinx 9mo ago

vegabook 9mo ago

Ultimately what's happening here is AI is undermining trust in remote contributions, and in new code. If you don't know somebody personally, and know how they work, the trust barrier is getting higher. I personally am already ultra vigilant for any github repo that is not already well established, and am even concerned about existing projects' code quality into the future. Not against AI per se (which I use), but it's just going to get harder to fight the slop.

epolanski 9mo ago

Honestly I don't care how people come with the code they create, but I hold them responsible for what they try to merge. I work in a team of 5 great professionals, there hasn't been a single instance since Copilot launched in 2022 that anybody, in any single modification did not take full responsibility for what's been committed. I know we all use it, to different extent and usage, but the quality of what's produced hasn't dipped a single bit, I'd even argue it has improved because LLMs can find answers easier in complex codebases. We started putting `_vendor` directories with our main external dependencies as git subtrees, and it's super useful to find information about those directly in their source code and tests. It's really as simple. If your teammates are producing slop, that's a human and professional problem and these people should be fired. If you use the tool correctly, it can help you a lot finding information and connecting dots. Any person with a brain can clearly see the huge benefit of these tools, but also the great danger of not reviewing their output line by line and forfeiting the constant work of resolving design tensions. Of course, open source is a different beast. The people committing may not be professionals and have no real stakes so they get little to lose by producing slop whereas maintainers are already stretched in their time and attention.

embedding-shape 9mo ago
> It's really as simple. If you or your teammates are producing slop, that's a human and professional problem and these people should be fired. Agree, slop isn't "the tool is so easy to use I can't review the code I'm producing", slop is the symptom of "I don't care how it's done, as long as it looks correct", and that's been a problem before LLMs too, the difference is how quickly you reach the "slop" state now, not that you have gate your codebase and reject shit code. As always, most problems in "software programming" isn't about software nor programming but everything around it, including communication and workflows. If your workflow allows people to not be responsible for what they produce, and if allows shitty code to get into production, then that's on you and your team, not on the tools that the individuals use.
altmanaltman 9mo ago
I mean this policy only applies to outside contributors and not the maintainers. > Ghostty is written with plenty of AI assistance, and many maintainers embrace AI tools as a productive tool in their workflow. As a project, we welcome AI as a tool! > Our reason for the strict AI policy is not due to an anti-AI stance, but instead due to the number of highly unqualified people using AI. It's the people, not the tools, that are the problem. Basically don't write slop and if you want to contribute as an outsider, ensure your contribution actually is valid and works.

kanzure 9mo ago

Another project simply paused external contributions entirely: https://news.ycombinator.com/item?id=46642012 https://news.ycombinator.com/item?id=46642012 Another idea is to simply promote the donation of AI credits instead of output tokens. It would be better to donate credits, not outputs, because people already working on the project would be better at prompting and steering AI outputs.

lagniappe 9mo ago
>people already working on the project would be better at prompting and steering AI outputs. In an ideal world sure, but I've seen the entire gamut from amateurs making surprising work to experts whose prompt history looks like a comedy of errors and gotchas. There's some "skill" I can't quite put my finger on when it comes to the way you must speak to an LLM vs another dev. There's more monkey-paw involved in the LLM process, in the sense that you get what you want, but do you want what you'll get?

CrociDB 9mo ago

I recently had to do a similar policy for my TUI feed reader, after getting some AI slop spammy PRs: https://github.com/CrociDB/bulletty?tab=contributing-ov-file#generative-ai-use https://github.com/CrociDB/bulletty?tab=contributing-ov-file... The fact that some people will straight up lie after submitting you a PR with lots of _that type_ of comment in the middle of the code is baffling!

nutjob2 9mo ago

A factor that people have not considered is that the copyright status of AI generated text is not settled law and precedent or new law may retroactively change the copyright status of a whole project. Maybe a bit unlikely, but still an issue no one is really considering. There has been a single ruling (I think) that AI generated code is uncopyrightable. There has been at least one affirmative fair use ruling. Both of these are from the lower courts. I'm still of the opinion that generative AI is not fair use because its clearly substitutive.

direwolf20 9mo ago
This only matters if you get sued for copyright violation, though.
- christoph-heiss 9mo ago
  No? Licenses still apply even if you _don't_ get sued?
  - latexr 9mo ago
    Do they? Isn’t the application of the license its enforcement? It’s illegal to commit fraud or murder, but if you do it and suffer no consequences (perhaps you even get pardoned by your president), does it matter that it was illegal? Laws are as strong as their enforcement. For a less grim and more explicit example, Apple has a policy on the iOS App Store that apps may not use notifications to advertise. Yet it happens all the time, especially from big players like Uber. Apple themselves have done it too. So if you’re a bad actor and disrespectful to your users, does it matter that the rule exists?
  - deleted 9mo ago
    [deleted]
  - direwolf20 9mo ago
    Licenses determine the outcome of copyright lawsuits. If there's no copyright lawsuit, nobody looks at the license. Licenses determine whether a copyright lawsuit is likely to happen. Most entities won't sue you if they expect to lose. But they are not the only deciding factor. Some entities never sue, which means you don't have to follow their licenses. Sometimes they don't sue because they don't think they can prove you infringed copyright, even if you did. Even if AI is found to be copyright infringement in general, that won't mean every output is a copyright infringement of every input. Writing C code wouldn't be copyright infringement of Harry Potter. The entity suing you would still have to prove that you infringed.

Version467 9mo ago

The biggest surprise to me with all this low-quality contribution spam is how little shame people apparently have. I have a handful of open source contributions. All of them are for small-ish projects and the complexity of my contributions are in the same ball-park as what I work on day-to-day. And even though I am relatively confident in my competency as a developer, these contributions are probably the most thoroughly tested and reviewed pieces of code I have ever written. I just really, really don't want to bother someone with low quality "help" who graciously offers their time to work on open source stuff. Other people apparently don't have this feeling at all. Maybe I shouldn't have been surprised by this, but I've definitely been caught off guard by it.

Etheryte 9mo ago
I worked for a major open-source company for half a decade. Everyone thinks their contribution is a gift and you should be grateful. To quote Bo Burnham, "you think your dick is a gift, I promise it's not".
- latexr 9mo ago
  > To quote Bo Burnham, "you think your dick is a gift, I promise it's not". For those curious: https://www.youtube.com/watch?v=llGvsgN17CQ https://www.youtube.com/watch?v=llGvsgN17CQ
- Cthulhu_ 9mo ago
  Sounds like everyone's got some main character syndrome, the cure for that is to be a meaningless cog in the enterprise wheels for a while. But then I suspect a lot of open source contributions are done exactly by those people - they don't really matter in their day job, but in open source they can Make A Difference. Of course, the vast majority of OS work is the same cog-in-a-machine work, and with low effort AI assisted contributions, the non-hero-coding work becomes more prevalent than ever.
kleiba 9mo ago
"Other people" might also just be junior devs - I have seen time and again how (over-)confident newbies can be in their code. (I remember one case where a student suspected a bug in the JVM when some Java code of his caused an error.) It's not necessarily maliciousness or laziness, it could simply be enthusiasm paired with lack of experience.

cranium 9mo ago

A well crafted policy that, I think, will be adopted by many OSS. You'd need that kind of sharp rules to compete against unhinged (or drunken) AI drivers and that's unfortunate. But at the same time, letting people DoS maintainers' time at essential no cost is not an option either.

Lucasoato 9mo ago

> Bad AI drivers will be banned and ridiculed in public. You've been warned. We love to help junior developers learn and grow, but if you're interested in that then don't use AI, and we'll help you. I'm sorry that bad AI drivers have ruined this for you. Finally an AI policy I can agree with :) jokes aside, it might sound a bit too agressive but it's also true that some people have really no shame into overloading you with AI generated shit. You need to protect your attention as much as you can, it's becoming the new currency.

weinzierl 9mo ago
I don't think ridicule is an effective threat for people with no shame to begin with.
- sjajshha 9mo ago
  [dead]
- wpietri 9mo ago
  Well, this is explicitly public ridicule. The penalty isn't just feeling shamed. It's reputational harm, immortalized via Google. One of the theorized reasons for junk AI submissions is reputation boosting. So maybe this will help. And I think it will help with people who just bought into the AI hype and are proceeding without much thought. Cluelessness can look a lot like shamelessness at first.
- mijoharas 9mo ago
  I think it makes sense, both for this, and for curl. Presumably people want this for some kind of prestige, so they can put it on their CV (contributed to ghostty/submitted security issue to curl). If we change that equation to have them think "wait, if I do this, then when employers Google me they'll see a blog post saying I'm incompetent" changes calculation that is neutral/positive for if their slop gets accepted to negative/positive. Seems like it's addressing the incentives to me.
Applejinx 9mo ago
Doubly so as these bad AI drivers are trading away even the possibility of having attention. It's very possible to render yourself senseless through a habit of deference. Even if you're coming up with ways to optimize AI responses, you are just trying to make a more superior superior to defer to.

rikschennink 9mo ago

> No AI-generated media is allowed (art, images, videos, audio, etc.). Text and code are the only acceptable AI-generated content, per the other rules in this policy. I find this distinction between media and text/code so interesting. To me it sounds like they think "text and code" are free from the controversy surrounding AI-generated media. But judging from how AI companies grabbed all the art, images, videos, and audio they could get their hands on to train their LLMs it's naive to think that they didn't do the same with text and code.

embedding-shape 9mo ago
> To me it sounds like "text and code" are free from the controversy surrounding AI-generated media. It really isn't, don't you recall the "protests" against Microsoft starting to use repositories hosted at GitHub for training their own coding models? Lots of articles and sentiments everywhere at the time. Seems to have died down though, probably because most developers seemingly at this point use LLMs in some capacity today. Some just use it as a search engine replacement, others to compose snippets they copy-paste and others wholesale don't type code anymore, just instructions then review it. I'm guessing Ghostty feels like if they'd ban generated text/code, they'd block almost all potential contributors. Not sure I agree with that personally, but I'm guessing that's their perspective.
- rikschennink 9mo ago
  Right, that's what I'm thinking too (I'll update my statement a bit to make that more clear), but I constantly hear this perspective that it's all good for text and code but when it's media, then it's suddenly problematic. It's equally problematic for text and code.
  - deleted 9mo ago
    [deleted]
  - deleted 9mo ago
    [deleted]
- 9mo ago

antirez 9mo ago

TLDR don't be an asshole and produce good stuff. But I have the feeling that this is not the right direction for the future. Distrust the process: only trust the results. Moreover this policy is strictly unenforceable because good AI use is indistinguishable from good manual coding. And sometimes even the reverse. I don't believe in coding policies where maintainers need to spot if AI is used or not. I believe in experienced maintainers that are able to tell if a change looks sensible or not.

b3kart 9mo ago
This doesn't work in the age of AI where producing crappy results is much cheaper than verifying them. While this is the case, metadata will be important to understand if you should even bother verifying the results.
- antirez 9mo ago
  The time needed for an AI patch written with the prompt "now make it as small as possible, clean, and human coded" is as big as reviewing the patch itself.
  - b3kart 9mo ago
    If this were so, we wouldn’t be seeing such reactions from open source maintainers. The reality is AI makes it cheap to create large PRs with little substance.
sumtechguy 9mo ago
As someone who has picked up recently some 'legacy' code. AI has been really good at mostly summing up what is going on. In many cases it finds things I had no idea was wrong (because I do not know the code very well yet). This is so called 'battle hardened code'. I review it and say 'yeah its is wildly broken and I see how the original developer ended up here'. Sometimes the previous dev would be nice enough to leave a comment or some devs 'the code is the comments'. I have also had AI go wildly off the rails and do very dumb things. It is an interesting tool for sure one you have to keep an eye on or it will confidently make a foot gun for you. It is also nice for someone like me who has some sort of weird social anxiaty thing about bugging my fellow devs. In that I can create options tables and pick good ideas out of that.

senko 9mo ago

On a tangent: the origin of the problems with low-quality drive-by requests is github's social nature. That might have been great when GitHub started, but nowadays many use it as portfolio padding and/or social proof. "This person contributed to a lot of projects" heuristic for "they're a good and passionate developer" means people will increasingly game this using low-quality submissions. This has been happening for years already. Of course, AI just added kerosene to the fire, but re-read the policy and omit AI and it still makes sense! A long term fix for this is to remove the incentive. Paradoxically, AI might help here because this can so trivially be gamed that it's obvious it's not longer any kind of signal.

stephantul 9mo ago
Your point about rereading without ai makes so much sense. The economics of it have changed, human nature hasn’t. Before 2023 (?) people also submitted garbage PRs just to be able to add “contributed to X” to their CV. It’s just become a lot cheaper.
- TeMPOraL 9mo ago
  Let's not forget the Hacktober Fest, the scourge of open source for over a decade now, the driver of low-quality "contribution" spam by hordes of people doing it for a goddamn free t-shirt. No, this problem isn't fundamentally about AI, it's about "social" structure of Github and incentives it creates (fame, employment).
achyudh 9mo ago
Mailing lists essentially solve this by introducing friction: only those who genuinely care about the project will bother to git send-email and defend a patch over an email thread. The incentive for low-quality drive-by submissions also evaporates as there is no profile page with green squares to farm. The downside is that it potentially reduces the number of contributors by making it a lot harder for new contributors to onboard.

evilhackerdude 9mo ago

sounds reasonable to me. i've been wondering about encoding detailed AI disclosure in an SBOM. on a related note: i wish we could agree on rebranding the current LLM-driven never-gonna-AGI generation of "AI" to something else… now i'm thinking of when i read the in-game lore definition for VI (Virtual Intelligence) back when i played mass effect 1 ;)

KolmogorovComp 9mo ago

A good PR using IA should be impossible to distinguish from a non-AI one.

layer8 9mo ago
The problem is that most aren’t good, and bad ones can take a lot of effort to distinguish, if they look plausible on the surface. So the potentially good ones aren’t worth all the bad ones.
- KolmogorovComp 9mo ago
  I agree with most of them being bad, I disagree with them taking lots of effort to distinguish, and I am maintainer unfortunately receiving receiving more and more using AI.

epaga 9mo ago

I really like the phrase "bad AI drivers"...AI is a tool, and the stupid drive-by pull requests just mean you're being inconsiderate and unhelpful in your usage of the tool, similar to how "bad drivers" are a nightmare to encounter on a highway...so stop it or you'll end up on the dashcam subreddit of programming.

skybrian 9mo ago
The experience of using a coding agent is that you're more of a "backseat driver" though. The AI acts as your driver and you tell it where to go, sometimes making corrections if it's going the wrong way.
- cmsj 9mo ago
  The experience is what you make of it. Personally I'm quite enjoying using AI as a way to generate code I can disagree with and refactor into what I want.
  - skybrian 9mo ago
    Sure, and I ask it to do the refactoring, too!

deleted 9mo ago

[deleted]

KronisLV 9mo ago

> You must state the tool you used (e.g. Claude Code, Cursor, Amp) Interesting requirement! Feels a bit like asking someone what IDE they used. There shouldn't be that meaningful of a difference between the different tools/providers unless you'd consistently see a few underperform and would choose to ban those or something. The other rules feel like they might discourage AI use due to more boilerplate needed (though I assume the people using AI might make the AI fill out some of it), though I can understand why a project might want to have those sorts of disclosures and control. That said, the rules themselves feel quite reasonable!

milancurcic 9mo ago

I think that a warning of public ridicule may be fine. However, actually doing it is quite low brow IMO. I'm sad to see more and more otherwise admirable projects step down to that (assuming they actually do it).

phanimahesh 9mo ago
An unenforced threat is toothless. Publicly stating we do not appreciate XYZ pr that was ai generated, low effort and in bad faith is perfectly acceptable.
- milancurcic 9mo ago
  I agree with the second statement but public ridicule can be understood to have a stronger effect, and be in bad faith itself.
njhnjhnjh 9mo ago
[dead]

hmokiguess 9mo ago

Banned I understand but ridiculed? I would say that these bad drive by spammers are analogous to phishing emails. Do you engage with those? Are they worth any energy or effort from you? I think ghostty should just ghost them :) EDIT: I'm getting downvoted with no feedback, which is fine I guess, so I am just going to share some more colour on my opinion in case I am being misunderstood What I meant with analogous to phishing is that the intent for the work is likely the one of personal reward and perhaps less of the desire to contribute. I was thinking they want their name on the contributors list, they want the credit, they want something and they don't want to put effort on it. Do they deserve to be ridiculed for doing that? Maybe. However, I like to think humans deserve kindness sometimes. It's normal to want something, and I agree that it is not okay to be selfish and lazy about it (ignoring contribution rules and whatnot), so at minimum I think respect applies. Some people are ignorant, naive, and are still maturing and growing. Bullying them may not help (thought it could) and mockery is a form of aggression. I think some true false positives will fall into that category and pay the price for those who are truly ill intended. Lastly, to ridicule is to care. To hate or attack requires caring about it. It requires effort, energy, and time from the maintainers. I think this just adds more waste and is more wasteful. Maybe those wordings are there just to 'scare' people away and maintainers won't bother engaging, though I find it is just compounding the amount of garbage at this point and nobody benefits from it. Anyways, would appreciate some feedback from those of you that seem to think otherwise. Thanks! PS: What I meant with ghostty should "ghost" them was this: https://en.wikipedia.org/wiki/Shadow_banning https://en.wikipedia.org/wiki/Shadow_banning

gverrilla 9mo ago

shaming doesn't work.

lifetimerubyist 9mo ago

Very quaint of them to exempt themselves because they've "proven themselves" already. Surely they are incapable of producing slop because they are just so much smarter than everyone else so the rules shouldn't apply to them, surely.

yaront111 9mo ago

[flagged]

deleted 9mo ago

[deleted]

yomismoaqui 9mo ago

Until now code was something costly to make and could only be created by our monkey brains. But now we have some kind of electronic brains that can also generate code, not at the level of the best human brains out there but good enough for most projects. And they are quicker and cheaper than humans, for sure. So maybe in the end this will reduce the need for human contributions to opensource projects. I just know that as a solo developer AI coding agents enable me to tackle projects I didn't think about event starting before.

Sparkyte 9mo ago

It is important to write the code yourself so you understand how it functions. I tried vibe coding a little bit. I totally felt like I was reading someone else's code base. Sanitization practices of AI are bad too. Let me be clear nothing wrong with AI in your workflow, just be an active participator in your code. Code is not meant to be one and done. You will go through iteration after iteration, security fix after fix. This is how development is.

PlatoIsADisease 9mo ago

These are unbelievably reasonable terms for AI. I might copy it for my company.

dw_arthur 9mo ago

I think a social norm of disclosing AI use at all times would be great. People and companies should also be held 100% accountable for anything created using AI.

twoodfin 9mo ago
I wish HN had a title tag for AI-generated posts, like it used to have for PDF’s and still does for year-of-publication.

tzs 9mo ago

> No AI-generated media is allowed (art, images, videos, audio, etc.). Text and code are the only acceptable AI-generated content, per the other rules in this policy What's the reason for this? Media is the most likely thing I'd consider using AI for as part of a contribution to an open source project. My code would be hand crafted by me. Any AI use would be similar to Google use: a way to search for examples and explanations if I'm unclear on something. Said examples and explanations would then be read, and after I understand what is going on I'd write my code. Any documentation I contributed would also be hand written. However, if I wanted to include a diagram in that documentation I might give AI a try. It can't be worse than my zero talent attempts to make something in OmniGraffle or worse a photograph of my attempt to draw a nice diagram on paper. I'd have expected this to be the least concerning use of AI.

theshrike79 8mo ago
AI generated media is a copyright gray zone. Very very few companies today have zero lines of AI generated code in their codebases. You can't copyright or patent specific code structures or ways of solving common problems.

andy99 9mo ago

> Issues and discussions can use AI assistance but must have a full human-in-the-loop. This means that any content generated with AI must have been reviewed and edited by a human before submission. I can see this being a problem. I read a thread here a few weeks ago where someone was called out on submitting an AI slop article they wrote with all the usual tells. They finally admitted it but said something to the effect they reviewed it and stood behind every line. The problem with AI writing is at least some people appear incapable of critically reviewing it. Writing something yourself eliminates this problem because it forces you to pick your words (there could be other problems of course). So the AI-blind will still submit slop under the policy but believe themselves to have reviewed it and “stand behind” it.

hereme888 9mo ago

At the moment I have 20 subagents fixing stuff throughout my own codebase. But I've never had the gall to let my AI agent do stuff on other people's projects without my direct oversight.

alya 9mo ago

At the Zulip open-source project, we've had a significant onslaught of AI slop in the past few months. It gets as absurd as PR descriptions with AI-generated "screenshots" of the app to "demonstrate" the changes. We've had to start warning contributors that we won't be able to review their work if they continue misusing AI, and occasionally banning repeat offenders. It's feels draining -- we want to spend our time mentoring people who'll actually learn from feedback, not interacting with contributors who are just copy-pasting LLM responses without thought. Our evolving AI policy is in the same spirit as ghostty's, with more detail to address specific failure modes we've experienced: https://zulip.readthedocs.io/en/latest/contributing/contributing.html#ai-use-policy-and-guidelines https://zulip.readthedocs.io/en/latest/contributing/contribu...

verdverm 9mo ago
Honestly, yours looks nothing like Mitchell's to me, and that's a good thing. It's actually reasonable and the guidance you provide on how to best use Ai when contributing to Zulip is :chef's kiss: truly, I'm going to copy yours as a thank you!
jdxcode 9mo ago
it's really strange, I maintain a lot of OSS and I just don't see it. I've had a bit of slop, and the # of PRs I receive has 10x'ed, but the quality is generally quite good. I wonder if maybe it's because I make dev tool CLIs that are just easier for AI to work with?

krzyk 9mo ago

It always amazes me why image/videos/audio generated by AI are treated differently from code. Are images somehow better? If one draws, is he better the one that writes code? Why protect one and not the other. Or why protect any form at all?

zzzeek 9mo ago

the endless issue with coding policy statements like this is that the people who need to read them the most are the ones who couldn't care less and don't read anything.

yellowapple 9mo ago

This is the most well-informed and reasonable AI policy I've seen so far. Neither kneejerk-hostile nor laissez faire; just a mature understanding of the limitations of LLMs, and an insistence on transparency and accountability when using them.

waldrews 9mo ago

We're just not going to see any code written entirely without AI except in specialist niches, just as we don't see handwritten assembly and binaries. So the disclosure part is going to become boilerplate. In the old era, the combination 'it works' + 'it uses a sophisticated language' + 'it integrates with a complex codebase' implied that this was an intentional effort by someone who knew what they were doing, and therefore probably safe to commit. We can no longer make that social assumption. So then, what can we rely on to signal 'this was thoroughly supervised and reviewed and understood and tested?' That's going to be hard and subjective. Personal reputations and track records are pedigrees and brands are going to become more important in the industry; and the meritocratic 'code talks no matter where you came from' ethos is at risk.

BoredomIsFun 9mo ago

How about autocomplete with LLMs? Should it be disclosed too? (scratching my balding head).

pelasaco 9mo ago
nah, this is just rhetorical polemic..

pelasaco 9mo ago

I’m starting to think AI will kill open source... and maybe even platforms like GitHub/GitLab as we know them. What I’m seeing: a flood of new repos appearing on GitHub with huge codebases and "extensive" documentation, often produced in two or three commits. The problem is that nobody uses them, nobody reads the docs, and many of these projects don’t provide real value. But the infrastructure cost is real: storing it all, indexing it, scanning it, backing it up, mirroring it.... Licensing is another issue. Licenses protect against copying, but AI changes totally the game: someone can download a repo, ask Claude to analyze and understand it, and then generate a similar solution with no verbatim copying. That’s likely legal... So GPL becomes irrelevant.. If that becomes normal, I can easily imagine companies pulling back from open source. Why publish your best work if anyone can cheaply reimplement it? Code will move back to closed source and become the "secret sauce" again. A black box is harder to vibe-code than an open source repo...

aisecurityguy 9mo ago

I wholeheartedly agree. It's the people that are the problem, not the technology. In the hands of people who understand it's utility and limitations, AI becomes an assistant you can't imagine life without. In the hands of people who aren't so intellectually curious, it helps them run into a brick wall much faster. My former boss often shared the words of his father: "A fool with a tool...is still a fool!" Even more true with AI.