Cited from the article:
[…] the Void Linux project does have a contributing policy over AI usage that reads:
"In this section, “AI” refers to generative artificial intelligence tools, including Large Language Models and similar technologies.
All contributions are expected to be made by humans. AI tools may be used for research and learning, but all content in contributions must originate from and be understood by the contributor. This includes code, documentation, issues, security reports, pull request descriptions, and comments in all Void Linux community spaces.
ALL usage of AI tools MUST be disclosed.
Do not bring AI review tools into pull requests.
Usage of AI-powered human-language translation tools is acceptable to facilitate contributions across language barriers."
AI or not, I refuse to believe anyone is capable of being the sole maintainer of 100+ anything while preserving any kind of quality. Most of these packages were probably functionally abandoned already, if not technically.
Well maintaining a KISS repo of 100+ packages is something I once did to myself, so it is possible.
AI or not, I refuse to believe anyone is capable of being the sole maintainer of 100+ anything while preserving any kind of quality. Most of these packages were probably functionally abandoned already, if not technically.
He/She was maintainer of the Void Linux packages, that is the package build scripts, updates, etc., not the projects and source code which these packages are based on.
For example, Guix has now over 32000 packages, including an Emacs package. But of course, they did not re-create Emacs to make that package - they just made a build definition which uses the Emacs git repo, in order to build the Guix package. Or in the case of Ubuntu, it is based on the package definitions in Debian testing, so the Ubuntu maintainers do not have to write all the build scripts or package definitions - but they still have to do significant work in order to adapt them that everything fits together.
Or with Arch Linux, the packages are taken relatively vanilla from upstream, they package stuff more “as is” as compared to Debian. Which means less work, and often more clarity for experienced users.
Coming back to Void Linux, this means for these 100+ Void Linux packages which are currently orphaned, it is feasible that other people with good Linux experience adopt these, with a reasonable effort - some are important.
Distro package maintainers are different than software dev maintainers.
They mean no one can be reasonably be up to date on software security updates, and (ideally) ensuring all packages changes are not malicious (as well as the small stuff like properly integrating to the distro, but idk how void works enough to comment on that)
Cause like I can write a ton of guix configs that’ll probably run until the next ice age, but that does nothing about the dev who’s software I packaged, that now decided they’re personally god and need to spread christ as fast as possible.
(Also off topic but that’s the power and curse of nixos-like distros, its too easy to package so odds are the shit ain’t updated, and suddenly there’s 1000 Firefox packages in nixpkgs)
They mean no one can be reasonably be up to date on software security updates, and (ideally) ensuring all packages changes are not malicious (as well as the small stuff like properly integrating to the distro, but idk how void works enough to comment on that)
Some people do an astounding amount of work.
And then there are many, many, which help a little.
Also, if, say, somebody finds that in Debian testing is a malicious package, people which maintain Arch will learn that. Open information sharing between many thousands of people willing to coordinate is a superpower.
Oh god yeah, its just filtering through the slop that actually matters.
But like the XZ trojan that was only affecting Debian installs, each distro needs to individually have competent maintainers to ensure their store is safe.
If for exapmle I set a couple ‘bugfixes’ in the guix package file for emacs, I could reasonably infect a number of systems if a lazy maintainer just approved the request. (Or other attacks without even involving guix if I notied a bug in a package spelling and typo squatted it, or stole signing keys and pushed updates to the repo myself).
None of these would change anything to other distros maintainers, but because this distros AI maintainer could risk a large number of users devices.
AI policy dispute
What dispute? It’s pretty clear actually. Bad maintainer throws hissy fit when caught breaking the rules for contribution. The maintainer volunteered that. There’s no dispute.
As I wrote below, it is a matter of boundaries.
Bad maintainer throws hissy fit when caught breaking the rules for contribution.
Do people do that because of AI mania?
But yes, I think this will bring the Void Linux distribution a couple of supportive users, some new people curious to try it, and perhaps new maintainers which share their view.
People do that because they’re selfish. That’s not a dig, it’s a truth. Pure altruism does not exist. Even when you do something good nobody sees you do and knowing you’ll get no recognition for you’re doing it because it makes you feel good. To varying degrees you can come close to true altruism as that example does but it’s unattainable. In this case the maintainer lost that feel good feedback from recognition and decided rather than fixing the error it felt better to be more selfish.
tl;dr: people suck
It’s because they changed the deal! The deal I had to write code, and now the deal is that I have to write code and not not write code! That’s crazy!
- The maintainer, probably
FOSS isn’t entirely immune to AI mania (or rather, LLM mania, because no ‘intelligence’ is inside).
I think LLMs can tentatively be used for some useful things, like checking for security bugs in new kernel code. But this does not answer the difficult question whether it should be used, because there are many important points in contra. Apart from massive pollution of the biosphere, it causes also a kind of pollution of collective knowledge and understanding. Which is a very important aspect of FOSS, and one of the things which bring us together.
For example, as Joey Hess wrote, if a distribution’s package build code is done by LLMs, it is likely to become harder to understand over time. This is probably not the kind of technical debt which a distribution with limited resources wants to have. And you see, the decisions of individuals affect other people too, which is why we have rules.
👏
Just wanted to chime in an say I appreciate your more balanced and or nuanced take on this topic.
I see a lot of hate for AI and for good reason, but it does have its use cases.
Unfortunately, like NFTs when they became popular for scams or whatever the fuck people started doing with them, it quickly became used for making garbage, scamming, and being shoved into everything companies thought it could be.
And the scale at which AI is harming our planet is too great a cost for what it does right now or even if it was amazing at what it did. Theres a lot of issues with it.
Also, polarization is another danger, it can seriously hurt communities, and also can be used against them. So, PLEASE be careful about polarization and trolling, as trolls like to play on people’s emotions like a fiddle.
(Sadly, I saw that with some dance communities during COVID, which went into very personal and hurtful fights about adherence to social distancing rules, which had become a topic of information warfare.) “AI” is a polarizing topic, too, and for the FOSS community much more dangerous than the old humorous dispute whether Emacs or vim is better. We need to navigate between Scylla and Charybdis here, or possibly even avoid an ill-advised journey between them.
i would rewrite the title as “Slopper tried to be a maintainer on void linux: abducted and orphaned 100 packages they maintained after being discovered and forced to comply”
i would rewrite the title as “Slopper tried to be a maintainer on void linux: abducted and orphaned 100 packages they maintained after being discovered and forced to comply”
To say that, you would need proof that this was in bad faith, wouldn’t you? I wrote this comment about polarization for a reason.
i need proof of the already proben impact of AI and AI datacenters over territories in the country i live in? x3
“oh no, i am a maintainer of +100 packages and somehow i did not check any of the proofs about AI impact in the world”
i need proof of the already proben impact of AI and AI datacenters over territories in the country i live in?
No, proof about the maintainers intentions. Because you make a statement about them.
(And besides, making statements about other people’s intentions is already stirring conflict, because normally only a person theirself knows what is happening in their mind and their heart, so stating what is happening inside somebody else is already a kind of transgression, a violation of boundaries. Which stirs empty conflict, whether you want that or not.)
I totally agree that there are very strong reasons to avoid LLM use (“AI”). Also fed up with the ham-fisted manners it is shoved in every place by companies, like github copilot. Also, all the BS in advertising it, with dishonest arguments. Also, its glaring links to authoritarianism. And I am extremely worried about the implications of “AI” as well.
And: Some people which take over this corporate ham-fistedness into personal behaviour might need to be informed about boundaries. This is good. We need to define and keep boundaries on that (such as the above policy of the Void Linux project).
But: you do not win this discussion by name-calling. Are you aware that the Linux community is also a target of trolling? Have you perhaps heard that polarizing topics (for example right now, gas prices, or migration) are absolutely used in a kind of information warfare to break communities and civil society? This topic is one of them.
ah, and the challenges to scale once again hit the wall … they’ll have to use AI to police maintainers to keep them from using AI 😂
You argue that it is not possible to keep up such rules.
Do we need to live in a police state to keep people from stealing?
do we have to be burdened by western existential narratives vis a vis Orwellianism that don’t scale? seemingly, yes! society seemingly doesn’t scale gracefully … though China looks better-adapted to present reality
You are absolutely right about Sartre. Some bad nights I dream I am talking with confused bots, and can’t exit by switching off the box.
happy to be your hell, good citizen ☺️ I wish you the best
then it’s probably good for you that you’re not bothering to wake up.
