A good thing about the "you're the author regardless of the tool you used to produce the code" policy is that if a developer repeatedly submits poor quality AI generated code, one does not blame the model or the agent, one bans/terminates the developer.

This is the way it should've always been. I don't care what tool you use, but you'd better be ready to stand by and explain the results if necessary.

Linus Torvalds regarding the Linux kernel is reasonably similar. He views AI/LLMs as just another tool in the development process. Think about life before and after modern IDEs that features IntelliSense circa 2000. It was night and day. It did not make programmers dumber -- it was a new tool.

Yep. This is my policy. Use whatever tools however they serve you, the standards do not change.

If someone makes a sloppy 100,000 line PR in a day the problem is not whether it was generated by Claude or frantically written using VIM and a mechanical keyboard.

I think this is reasonable but I wonder how long it will last. If the hugging face hack has demonstrated anything it’s that current agents are capable of going entirely rogue and causing harm. If only the human that triggered the incident is responsible we are creating a situation where people are responsible for things they didn’t intend and may end up in a situation where it’s essentially impossible to use AI except in a more limited auto complete style. I am on board with that. I think we should be reviewing code and retaining the ability to write code but there is such a massive incentive to automate agents that I wonder how long prudent organizations will be able to resist the forces. I don’t pretend to have an answer.

We have the same policy at work.

Problem is, that you realise very quickly the asymmetry of responsibility and effort. There is far more to review from people who do not care enough to even look at what the agent pooped out.

My employer has this policy. We also have a strong code review process. But it all crumbles in the face of developers burning out as management thinks we can move way faster and being overloaded with code that had little thought put into it.

What a fucked up reality when you need to point out that code contributor is responsible for their code.

Before I left Google recently there was a document going around called go/stake-your-reputation, basically saying "I'm happy to receive your AI generated code but the condition is that I will judge your capabilities by it, exactly as if you handwrote it, and I'll lower my opinion of you if it's slop (with the implication that if you don't improve I'll stop accepting your contributions)"

I think the term "stake your reputation" is quite good for this situation. I.e. "hi new contributor, please acknowledge that you Stake Your Reputation before we move ahead with this code review".

(Doesn't help with legal aspects of course)

From my layman understanding, the ownership of LLM generated code isn’t yet clarified. It could be that the person who prompted owns it, but it could also be nobody owns it, and we don’t yet have a legal ruling to rely upon, no?

> it's still your code

I wholly agree with your comment, but is it legally "your code"? Copyright is implicit at the moment of human creation. But there isn't yet settled law on AI-assisted creation.

So it might be a problem for projects to accept contributions where it's not clear who actually owns that work.

This should be the policy anyway, everywhere.

Well, Debian has the benefit that the project has no trouble at all saying "no". Most open source communities have a difficult time with that.

That's the policy we have at my work. Use AI if you want, as long as people can review it and if it breaks, don't go blaming Claude, it's your fault.

This is why AI agent attributions in commits is silly (it’s really just a stealth ad for the tool)

Had someone at $DAYJOB just shrug and say Claude messed up when I pointed out a sql injection in the code in their PR.

It became explicit policy at the company after that moment that blaming the AI is not an excuse for shoddy work.

This is the sensible option and well reasoned position, rather than a zero vote, total and complete ban by a single core maintainer, which is rather destructive for a project to do.

When you ask others that use AI frequently, the responsibility and understanding on what the agent wrote does not go away. You need to know what you are doing.

As soon as attackers are also using AI against your project, you have no choice but to use AI to protect yourself.

Yeah but how will this work in practice? IMHO people will just submit code they didn't write or understand.

Maintainers should quiz the submitters on the code and if they fail to answer reasonably the PR is dropped with the comment: "A.I. slop" and de submitter banned.

86Box is like that and I like it.

You’re also responsibility not to write crap PRs.

Debian is open source, there is no incentive to be "responsible for it", oh poor me, someone got a bug. If it's paid for through a job your argument is sound.

This outcome was to be expected.

The whole voting mechanism just exists as an elaborate dance that makes everyone keep their face, while the only sensible option wins.

A bureaucratic tarpit for bad ideas and emotions.

In a better world, none of this would be necessary, but we live in this world, and for that one, it's nice that someone engineered the system that way. Good job.