Debian permitting use of genAI:
-
@neil Also, as the director of a company with about 200 Debian servers I have no idea what to do with this right now... 🤯
@neil Somewhat related: I had to write @codeenigma's AI policy this year, on consultation with colleagues and peers of course, which was interesting.
It ended up being "unless there's a strong business case, don't" i.e. you need to be able to prove "AI will definitely make this better". Coupled with "here's a list of permitted AI services and models, you may not use any others". The second part attempts to minimise environmental impact, we added environmental credentials to supplier selection.
-
I would think that just based on license concerns alone would necessitate a policy of "No source-code or binary files may be generated wholly or in part by an LLM."
If _you_ didn't write it, or if you don't have a license to relicense it, you can't in good order publish it under an open-source license. (Or, for that matter, a closed-source license.)
@skjeggtroll @freshstart @neil it's worse than this actually.
We know that LLM code sometimes includes fragments of training data verbatim. We know much training data is licensed such that verbatim copies requires attribution. So we know that LLM code sometimes violates these attribution requirements.
There is no practical way to check whether a given section of LLM produced code violates an attribution requirement. How are you going to search against all lines of code in the training database? Do you run that search for each line of code?
Even worse: two different people using the same LLM, even with different prompts, may generate the same or substantially similar code. Whoever tries to slap a license on that code second is in violation of the first person's license, assuming a world in which such code is licensable at all. These people probably don't know of each others' existence at first. This has already happened, see:
https://blog.terrygodier.com/2026/08/09/mea-culpa-dark-hours.html
To accept any LLM-generated code or documentation is to say that you are fine with license violations. If, as Debian did, you try to thrust the impossible burden of ensuring license violations do not occur onto each contributor, I'm not sure what you're saying, but your policy isn't sincere.
-
For a reasoned, contrary point of view please see this thread:
-
@neil Well, with even the Linux kernel accepting the use of LLMs... maybe it's time to start looking towards BSD, maybe even specifically NetBSD as they seem clearest on the case.
Code runs deep and sometimes fast and so does this issue.
-
@tim @neil Neil said his opinions are for another day.
Personally I think LLM/AI can be a useful tool, but right now we're at the stage where global production goes whee! this stuff is amazing and does all these cool things, but it's leaking crap into the environment like PFAS, microplastics, CO2 and chlorofluorocarbons, and yes, plenty of people are calling it out, but we all still want and use fridges, cars, packaged food and nonstick pans. So yeah... what do you do?
-
Debian permitting use of genAI:
1) I am surprised. Perhaps I am naive, but I was of the impression that Debian would be one of the last distros that would want this.
2) I agree that the legal position varies around the world, and is subject to change. I don't know how easy it would be to remove genAI code if the risk profile changed.
3) I am surprised how little weight is given (by anyone, not just Debian devs) to the environmental harm of genAI. Perhaps that is justified as being too remote to be of direct concern.
4) As a long term Debian user impacted by this decision, I need to make a decision. Not doing anything is a decision in itself, even if a temporary decision. Moving from Debian would be many days of work, but that doesn't mean doing so is the wrong decision for me. Aargh.
@neil The environmental concerns are tricky; I'd condemn the crazy huge datacentre buildouts - but locally run AIs aren't that bad - and most people don't know the huge power usage of CI systems that we've depended on for decades; there's also lots of different types of AI usage - the 'agent' stuff is very heavy compute, reviewing code or small rework isn't that bad.
-
Debian permitting use of genAI:
1) I am surprised. Perhaps I am naive, but I was of the impression that Debian would be one of the last distros that would want this.
2) I agree that the legal position varies around the world, and is subject to change. I don't know how easy it would be to remove genAI code if the risk profile changed.
3) I am surprised how little weight is given (by anyone, not just Debian devs) to the environmental harm of genAI. Perhaps that is justified as being too remote to be of direct concern.
4) As a long term Debian user impacted by this decision, I need to make a decision. Not doing anything is a decision in itself, even if a temporary decision. Moving from Debian would be many days of work, but that doesn't mean doing so is the wrong decision for me. Aargh.
@neil I presume that this decision by the debian developers will impact the devuan fork as well?
-
@iinavpov @skjeggtroll @neil do I understand it correctly though that Debian now could conceivably allow new packages that are say largely written by an LLM?
@freshstart
Not more or less than yesterday.Currently, because licensing is unclear, such a package may well face many extra hurdles.
but adding public domain code to your, say, GPL licensed project doesn't make it less GPL licensed.
Creating software mostly from public domain code and relicensing it is - I don't know, I'm not a lawyer. Weird certainly.
-
@KimSJ @voltagex @neil Non-Linux I guess as the Linux kernel allows for AI contributions.
I am trying NetBSD first and see how I get on. I am under no illusions that it will be harder than continuing with debian and its derivatives.
I have been using debian based OSs since I installed eeebuntu on my first eeepc in 2009, and every device I own currently uses one or another flavour of the debian family.
It will take a while to lose the "sudo apt update" muscle memory.
-
@neil I can't actually recommend that you wade in very far, but if you do, you will see that many developers voted for options that focused on environmental (and other harms) of AI. It just happens that the winning option chose to pretend those harms don't exist. It's like "shitty elected leader $Y of country $X"; as a non-$Y supporter you have to live not only with a shitty leader, but also the reputational damage to being from country $X.
-
Debian permitting use of genAI:
1) I am surprised. Perhaps I am naive, but I was of the impression that Debian would be one of the last distros that would want this.
2) I agree that the legal position varies around the world, and is subject to change. I don't know how easy it would be to remove genAI code if the risk profile changed.
3) I am surprised how little weight is given (by anyone, not just Debian devs) to the environmental harm of genAI. Perhaps that is justified as being too remote to be of direct concern.
4) As a long term Debian user impacted by this decision, I need to make a decision. Not doing anything is a decision in itself, even if a temporary decision. Moving from Debian would be many days of work, but that doesn't mean doing so is the wrong decision for me. Aargh.
@neil I think I am a bit less surprised - I have seen a lot of pro-AI posts on Debian lists recently (not subscribed to, just other people have highlighted). I sadly think it's inevitable that genAI will make its way into pretty much every Linux distro that is widely used, in the same way as systemd did.
Having been an environmental campaigner in the past, I've also seen how easy it is for people to think 'well my emissions don't matter' (for whatever reason, e.g. China burns lots of coal).
-
Debian permitting use of genAI:
1) I am surprised. Perhaps I am naive, but I was of the impression that Debian would be one of the last distros that would want this.
2) I agree that the legal position varies around the world, and is subject to change. I don't know how easy it would be to remove genAI code if the risk profile changed.
3) I am surprised how little weight is given (by anyone, not just Debian devs) to the environmental harm of genAI. Perhaps that is justified as being too remote to be of direct concern.
4) As a long term Debian user impacted by this decision, I need to make a decision. Not doing anything is a decision in itself, even if a temporary decision. Moving from Debian would be many days of work, but that doesn't mean doing so is the wrong decision for me. Aargh.
@neil meanwhile, here I am, using Ubuntu, with a local AI installed in it through LM Studio to play around and learn how to use AI to inflate my resume and earn more money.
-
J jwcph@helvede.net shared this topic
