From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on inbox.vuxu.org X-Spam-Level: X-Spam-Status: No, score=-3.0 required=5.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED,RCVD_IN_MSPIKE_H4, RCVD_IN_MSPIKE_WL autolearn=ham autolearn_force=no version=3.4.4 Received: from second.openwall.net (second.openwall.net [193.110.157.125]) by inbox.vuxu.org (Postfix) with SMTP id 8A4612CF88 for ; Sun, 20 Oct 2024 01:41:02 +0200 (CEST) Received: (qmail 9947 invoked by uid 550); 19 Oct 2024 23:40:55 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Reply-To: musl@lists.openwall.com x-ms-reactions: disallow Received: (qmail 9903 invoked from network); 19 Oct 2024 23:40:54 -0000 Date: Sat, 19 Oct 2024 19:40:45 -0400 From: Rich Felker To: musl@lists.openwall.com Message-ID: <20241019234045.GQ10433@brightrain.aerifal.cx> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.5.21 (2010-09-15) Subject: [musl] Proposed "AI" policies Some mentions here and there of ChatGPT/"AI" in musl- and musl-adjacent contexts has had me thinking we really should have some explicit policy on this stuff, which could be posted on the wiki as well as in final form here, and wherever else it may be appropriate, before it becomes an issue. In a sense I don't even see these as "AI policies", just provenance, authorship-credit, honesty, license-honoring, etc. policies, but unfortunately it's "AI" that's made it necessary to spell them out explicitly. So, here's roughly what I have in mind: 1. Please DO NOT submit "AI generated" code/patches for inclusion in musl. These do not have clear authorship, are derived from models that are clearly derived from a plethora of copyrighted works without license or attribution, and thereby cannot be licensed by the submitter. Being that most patch contributions to musl are small and simple enough that it's dubious whether copyright applies at all, this may not be an issue in all cases, but it's still dishonest and wastes our time reviewing code that the submitter did not write and does not have any reasonable basis to assume is correct. Often the changes proposed by these models are blatently incorrect and introduce bugs/vulns into previously-correct code. 2. Please DO NOT submit "AI generated" or otherwise automated bug reports without disclosing the provenance (or lack thereof). This wastes everybody's time. If you are using tooling to identify potential bugs, please either confirm before reporting that you have actually found a bug (not just that the tool said it's a bug), or clearly state in the report that it's unconfirmed, which tools you used, and why you think the alleged bug may be legitimate -- or if you don't know you're just asking whether it might be. 3. Even being a permissive license, the MIT license requires attribution and preservation of copyright notice. It thereby does not permit incorporation of musl sources (or other MIT licensed code) into models or derived outputs of models where the necessary attribution and preservation of copyright notice are not possible. Anything I'm missing or that seems like it should be changed? Rich