[musl] Proposed "AI" policies

[musl] Proposed "AI" policies

[Rich Felker]

Some mentions here and there of ChatGPT/"AI" in musl- and
musl-adjacent contexts has had me thinking we really should have some
explicit policy on this stuff, which could be posted on the wiki as
well as in final form here, and wherever else it may be appropriate,
before it becomes an issue.

In a sense I don't even see these as "AI policies", just provenance,
authorship-credit, honesty, license-honoring, etc. policies, but
unfortunately it's "AI" that's made it necessary to spell them out
explicitly. So, here's roughly what I have in mind:

1. Please DO NOT submit "AI generated" code/patches for inclusion in
   musl. These do not have clear authorship, are derived from models
   that are clearly derived from a plethora of copyrighted works
   without license or attribution, and thereby cannot be licensed by
   the submitter. Being that most patch contributions to musl are
   small and simple enough that it's dubious whether copyright applies
   at all, this may not be an issue in all cases, but it's still
   dishonest and wastes our time reviewing code that the submitter did
   not write and does not have any reasonable basis to assume is
   correct. Often the changes proposed by these models are blatently
   incorrect and introduce bugs/vulns into previously-correct code.

2. Please DO NOT submit "AI generated" or otherwise automated bug
   reports without disclosing the provenance (or lack thereof). This
   wastes everybody's time. If you are using tooling to identify
   potential bugs, please either confirm before reporting that you
   have actually found a bug (not just that the tool said it's a bug),
   or clearly state in the report that it's unconfirmed, which tools
   you used, and why you think the alleged bug may be legitimate -- or
   if you don't know you're just asking whether it might be.

3. Even being a permissive license, the MIT license requires
   attribution and preservation of copyright notice. It thereby does
   not permit incorporation of musl sources (or other MIT licensed
   code) into models or derived outputs of models where the necessary
   attribution and preservation of copyright notice are not possible.

Anything I'm missing or that seems like it should be changed?

Rich

Re: [musl] Proposed "AI" policies

[Quentin Rameau]

Hi,

> Anything I'm missing or that seems like it should be changed?

>    musl. These do not have clear authorship, are derived from models
>    that are clearly derived from a plethora of copyrighted works
>    without license or attribution, and thereby cannot be licensed by
>    the submitter. Being that most patch contributions to musl are

Maybe that part above could be reworded a bit, although I believe what
you say is true, the problem is just that those are completely opaque
regarding training sources, and so cannot be proven of good faith
at all, enven if in practice it was actually trained
from truly righteous material.

> 2. Please DO NOT submit "AI generated" or otherwise automated bug
>    reports without disclosing the provenance (or lack thereof). This
>    wastes everybody's time. If you are using tooling to identify
>    potential bugs, please either confirm before reporting that you
>    have actually found a bug (not just that the tool said it's a bug),
>    or clearly state in the report that it's unconfirmed, which tools
>    you used, and why you think the alleged bug may be legitimate -- or
>    if you don't know you're just asking whether it might be.

Maybe the bug reporting part should be emphasized on its own,
disregarding the source of it, I think that's valable for computers
and humans altogether.
Then the AI part could be an addition to it, instead of the inverse.

Re: [musl] Proposed "AI" policies

[Rich Felker]

On Sat, Oct 19, 2024 at 07:40:45PM -0400, Rich Felker wrote:
> Some mentions here and there of ChatGPT/"AI" in musl- and
> musl-adjacent contexts has had me thinking we really should have some
> explicit policy on this stuff, which could be posted on the wiki as
> well as in final form here, and wherever else it may be appropriate,
> before it becomes an issue.
> 
> In a sense I don't even see these as "AI policies", just provenance,
> authorship-credit, honesty, license-honoring, etc. policies, but
> unfortunately it's "AI" that's made it necessary to spell them out
> explicitly. So, here's roughly what I have in mind:
> 
> 1. Please DO NOT submit "AI generated" code/patches for inclusion in
>    musl. These do not have clear authorship, are derived from models
>    that are clearly derived from a plethora of copyrighted works
>    without license or attribution, and thereby cannot be licensed by
>    the submitter. Being that most patch contributions to musl are
>    small and simple enough that it's dubious whether copyright applies
>    at all, this may not be an issue in all cases, but it's still
>    dishonest and wastes our time reviewing code that the submitter did
>    not write and does not have any reasonable basis to assume is
>    correct. Often the changes proposed by these models are blatently
>    incorrect and introduce bugs/vulns into previously-correct code.
> 
> 2. Please DO NOT submit "AI generated" or otherwise automated bug
>    reports without disclosing the provenance (or lack thereof). This
>    wastes everybody's time. If you are using tooling to identify
>    potential bugs, please either confirm before reporting that you
>    have actually found a bug (not just that the tool said it's a bug),
>    or clearly state in the report that it's unconfirmed, which tools
>    you used, and why you think the alleged bug may be legitimate -- or
>    if you don't know you're just asking whether it might be.
> 
> 3. Even being a permissive license, the MIT license requires
>    attribution and preservation of copyright notice. It thereby does
>    not permit incorporation of musl sources (or other MIT licensed
>    code) into models or derived outputs of models where the necessary
>    attribution and preservation of copyright notice are not possible.
> 
> Anything I'm missing or that seems like it should be changed?

One thing I'd like to add based on having heard reports that "AI" is
deemed important for non-native English speakers to make reports:

4. If you are considering use of "AI" tools to generate, proofread, or
   translate something you are trying to report because you don't
   consider yourself sufficiently proficient in English, instead
   please just submit it in a language you are comfortable writing
   with a brief English note at the beginning to that effect. This
   allows those of us reading the report to use tools (or the advice
   of actual people) we trust to accurately translate the meaning
   instead of having to trust that the "AI" tool you were going to use
   emitted text that matches what you wanted to say. Debugging
   confabulations generated by your tooling is a much worse (and
   unacceptable) burden on us than making sense of a foreign language
   would be.

Exact wording could be adjusted (perhaps to be more accessible
English) as needed.

Re: [musl] Proposed "AI" policies

[Jeffrey Walton]

[-- Attachment #1: Type: text/plain, Size: 3964 bytes --]

Hi Rich,

On Thu, Aug 21, 2025 at 11:36 AM Rich Felker <dalias@libc.org> wrote:

> On Sat, Oct 19, 2024 at 07:40:45PM -0400, Rich Felker wrote:
> > Some mentions here and there of ChatGPT/"AI" in musl- and
> > musl-adjacent contexts has had me thinking we really should have some
> > explicit policy on this stuff, which could be posted on the wiki as
> > well as in final form here, and wherever else it may be appropriate,
> > before it becomes an issue.
> >
> > In a sense I don't even see these as "AI policies", just provenance,
> > authorship-credit, honesty, license-honoring, etc. policies, but
> > unfortunately it's "AI" that's made it necessary to spell them out
> > explicitly. So, here's roughly what I have in mind:
> >
> > 1. Please DO NOT submit "AI generated" code/patches for inclusion in
> >    musl. These do not have clear authorship, are derived from models
> >    that are clearly derived from a plethora of copyrighted works
> >    without license or attribution, and thereby cannot be licensed by
> >    the submitter. Being that most patch contributions to musl are
> >    small and simple enough that it's dubious whether copyright applies
> >    at all, this may not be an issue in all cases, but it's still
> >    dishonest and wastes our time reviewing code that the submitter did
> >    not write and does not have any reasonable basis to assume is
> >    correct. Often the changes proposed by these models are blatently
> >    incorrect and introduce bugs/vulns into previously-correct code.
> >
> > 2. Please DO NOT submit "AI generated" or otherwise automated bug
> >    reports without disclosing the provenance (or lack thereof). This
> >    wastes everybody's time. If you are using tooling to identify
> >    potential bugs, please either confirm before reporting that you
> >    have actually found a bug (not just that the tool said it's a bug),
> >    or clearly state in the report that it's unconfirmed, which tools
> >    you used, and why you think the alleged bug may be legitimate -- or
> >    if you don't know you're just asking whether it might be.
> >
> > 3. Even being a permissive license, the MIT license requires
> >    attribution and preservation of copyright notice. It thereby does
> >    not permit incorporation of musl sources (or other MIT licensed
> >    code) into models or derived outputs of models where the necessary
> >    attribution and preservation of copyright notice are not possible.
> >
> > Anything I'm missing or that seems like it should be changed?
>
> One thing I'd like to add based on having heard reports that "AI" is
> deemed important for non-native English speakers to make reports:
>
> 4. If you are considering use of "AI" tools to generate, proofread, or
>    translate something you are trying to report because you don't
>    consider yourself sufficiently proficient in English, instead
>    please just submit it in a language you are comfortable writing
>    with a brief English note at the beginning to that effect. This
>    allows those of us reading the report to use tools (or the advice
>    of actual people) we trust to accurately translate the meaning
>    instead of having to trust that the "AI" tool you were going to use
>    emitted text that matches what you wanted to say. Debugging
>    confabulations generated by your tooling is a much worse (and
>    unacceptable) burden on us than making sense of a foreign language
>    would be.
>
> Exact wording could be adjusted (perhaps to be more accessible
> English) as needed.
>

Related, cURL requires the source of a vulnerability report be stated
because the project was being overrun with false positives and low quality
bug reports from AI generated slop. See <
https://curl.se/mail/lib-2025-05/0013.html> and <
https://github.com/curl/curl/pull/17325>. The last link includes changes to
cURL's docs/CONTRIBUTE.md.

Jeff

[-- Attachment #2: Type: text/html, Size: 4865 bytes --]

Re: [musl] Proposed "AI" policies

[zyxhere💭]

[-- Attachment #1: Type: text/plain, Size: 4050 bytes --]

On Thu, 2025-08-21 at 11:36 -0400, Rich Felker wrote:
> On Sat, Oct 19, 2024 at 07:40:45PM -0400, Rich Felker wrote:
> > Some mentions here and there of ChatGPT/"AI" in musl- and
> > musl-adjacent contexts has had me thinking we really should have some
> > explicit policy on this stuff, which could be posted on the wiki as
> > well as in final form here, and wherever else it may be appropriate,
> > before it becomes an issue.
> > 
> > In a sense I don't even see these as "AI policies", just provenance,
> > authorship-credit, honesty, license-honoring, etc. policies, but
> > unfortunately it's "AI" that's made it necessary to spell them out
> > explicitly. So, here's roughly what I have in mind:
> > 
> > 1. Please DO NOT submit "AI generated" code/patches for inclusion in
> >    musl. These do not have clear authorship, are derived from models
> >    that are clearly derived from a plethora of copyrighted works
> >    without license or attribution, and thereby cannot be licensed by
> >    the submitter. Being that most patch contributions to musl are
> >    small and simple enough that it's dubious whether copyright applies
> >    at all, this may not be an issue in all cases, but it's still
> >    dishonest and wastes our time reviewing code that the submitter did
> >    not write and does not have any reasonable basis to assume is
> >    correct. Often the changes proposed by these models are blatently
> >    incorrect and introduce bugs/vulns into previously-correct code.
> > 
> > 2. Please DO NOT submit "AI generated" or otherwise automated bug
> >    reports without disclosing the provenance (or lack thereof). This
> >    wastes everybody's time. If you are using tooling to identify
> >    potential bugs, please either confirm before reporting that you
> >    have actually found a bug (not just that the tool said it's a bug),
> >    or clearly state in the report that it's unconfirmed, which tools
> >    you used, and why you think the alleged bug may be legitimate -- or
> >    if you don't know you're just asking whether it might be.
> > 
> > 3. Even being a permissive license, the MIT license requires
> >    attribution and preservation of copyright notice. It thereby does
> >    not permit incorporation of musl sources (or other MIT licensed
> >    code) into models or derived outputs of models where the necessary
> >    attribution and preservation of copyright notice are not possible.
> > 
> > Anything I'm missing or that seems like it should be changed?
> 
> One thing I'd like to add based on having heard reports that "AI" is
> deemed important for non-native English speakers to make reports:
> 
> 4. If you are considering use of "AI" tools to generate, proofread, or
>    translate something you are trying to report because you don't
>    consider yourself sufficiently proficient in English, instead
>    please just submit it in a language you are comfortable writing
>    with a brief English note at the beginning to that effect. This
>    allows those of us reading the report to use tools (or the advice
>    of actual people) we trust to accurately translate the meaning
>    instead of having to trust that the "AI" tool you were going to use
>    emitted text that matches what you wanted to say. Debugging
>    confabulations generated by your tooling is a much worse (and
>    unacceptable) burden on us than making sense of a foreign language
>    would be.
> 
> Exact wording could be adjusted (perhaps to be more accessible
> English) as needed.

FWWIWs Gentoo[1] only has:

"It is expressly forbidden to contribute to Gentoo any content that has
been created with the assistance of Natural Language Processing
artificial intelligence tools. This motion can be revisited, should a
case been made over such a tool that does not pose copyright, ethical
and quality concerns."

With rational for it at the bottom

[1] https://wiki.gentoo.org/wiki/Project:Council/AI_policy
-- 
zyxhere💭 <zyx@envs.net>

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 358 bytes --]

Re: [musl] Proposed "AI" policies

[Jeffrey Walton]

[-- Attachment #1: Type: text/plain, Size: 2619 bytes --]

On Sat, Oct 19, 2024 at 7:41 PM Rich Felker <dalias@libc.org> wrote:

> Some mentions here and there of ChatGPT/"AI" in musl- and
> musl-adjacent contexts has had me thinking we really should have some
> explicit policy on this stuff, which could be posted on the wiki as
> well as in final form here, and wherever else it may be appropriate,
> before it becomes an issue.
>
> In a sense I don't even see these as "AI policies", just provenance,
> authorship-credit, honesty, license-honoring, etc. policies, but
> unfortunately it's "AI" that's made it necessary to spell them out
> explicitly. So, here's roughly what I have in mind:
>
> 1. Please DO NOT submit "AI generated" code/patches for inclusion in
>    musl. These do not have clear authorship, are derived from models
>    that are clearly derived from a plethora of copyrighted works
>    without license or attribution, and thereby cannot be licensed by
>    the submitter. Being that most patch contributions to musl are
>    small and simple enough that it's dubious whether copyright applies
>    at all, this may not be an issue in all cases, but it's still
>    dishonest and wastes our time reviewing code that the submitter did
>    not write and does not have any reasonable basis to assume is
>    correct. Often the changes proposed by these models are blatently
>    incorrect and introduce bugs/vulns into previously-correct code.
>
> 2. Please DO NOT submit "AI generated" or otherwise automated bug
>    reports without disclosing the provenance (or lack thereof). This
>    wastes everybody's time. If you are using tooling to identify
>    potential bugs, please either confirm before reporting that you
>    have actually found a bug (not just that the tool said it's a bug),
>    or clearly state in the report that it's unconfirmed, which tools
>    you used, and why you think the alleged bug may be legitimate -- or
>    if you don't know you're just asking whether it might be.
>
> 3. Even being a permissive license, the MIT license requires
>    attribution and preservation of copyright notice. It thereby does
>    not permit incorporation of musl sources (or other MIT licensed
>    code) into models or derived outputs of models where the necessary
>    attribution and preservation of copyright notice are not possible.
>
> Anything I'm missing or that seems like it should be changed?


Sorry to dig up an old thread...

cURL just stopped its Bug Bounty program due (in part) to AI slop.  See <
https://daniel.haxx.se/blog/2026/01/26/the-end-of-the-curl-bug-bounty/>.

Jeff

[-- Attachment #2: Type: text/html, Size: 3314 bytes --]

Re: [musl] Proposed "AI" policies

[zxuiji]

[-- Attachment #1: Type: text/plain, Size: 2799 bytes --]

Having read it, + 1 upvote from me :)

On Tue, 27 Jan 2026 at 02:20, Jeffrey Walton <noloader@gmail.com> wrote:

>
>
> On Sat, Oct 19, 2024 at 7:41 PM Rich Felker <dalias@libc.org> wrote:
>
>> Some mentions here and there of ChatGPT/"AI" in musl- and
>> musl-adjacent contexts has had me thinking we really should have some
>> explicit policy on this stuff, which could be posted on the wiki as
>> well as in final form here, and wherever else it may be appropriate,
>> before it becomes an issue.
>>
>> In a sense I don't even see these as "AI policies", just provenance,
>> authorship-credit, honesty, license-honoring, etc. policies, but
>> unfortunately it's "AI" that's made it necessary to spell them out
>> explicitly. So, here's roughly what I have in mind:
>>
>> 1. Please DO NOT submit "AI generated" code/patches for inclusion in
>>    musl. These do not have clear authorship, are derived from models
>>    that are clearly derived from a plethora of copyrighted works
>>    without license or attribution, and thereby cannot be licensed by
>>    the submitter. Being that most patch contributions to musl are
>>    small and simple enough that it's dubious whether copyright applies
>>    at all, this may not be an issue in all cases, but it's still
>>    dishonest and wastes our time reviewing code that the submitter did
>>    not write and does not have any reasonable basis to assume is
>>    correct. Often the changes proposed by these models are blatently
>>    incorrect and introduce bugs/vulns into previously-correct code.
>>
>> 2. Please DO NOT submit "AI generated" or otherwise automated bug
>>    reports without disclosing the provenance (or lack thereof). This
>>    wastes everybody's time. If you are using tooling to identify
>>    potential bugs, please either confirm before reporting that you
>>    have actually found a bug (not just that the tool said it's a bug),
>>    or clearly state in the report that it's unconfirmed, which tools
>>    you used, and why you think the alleged bug may be legitimate -- or
>>    if you don't know you're just asking whether it might be.
>>
>> 3. Even being a permissive license, the MIT license requires
>>    attribution and preservation of copyright notice. It thereby does
>>    not permit incorporation of musl sources (or other MIT licensed
>>    code) into models or derived outputs of models where the necessary
>>    attribution and preservation of copyright notice are not possible.
>>
>> Anything I'm missing or that seems like it should be changed?
>
>
> Sorry to dig up an old thread...
>
> cURL just stopped its Bug Bounty program due (in part) to AI slop.  See <
> https://daniel.haxx.se/blog/2026/01/26/the-end-of-the-curl-bug-bounty/>.
>
> Jeff
>

[-- Attachment #2: Type: text/html, Size: 3738 bytes --]

Re: [musl] Proposed "AI" policies

[Rich Felker]

On Sat, Oct 19, 2024 at 07:40:45PM -0400, Rich Felker wrote:
> Some mentions here and there of ChatGPT/"AI" in musl- and
> musl-adjacent contexts has had me thinking we really should have some
> explicit policy on this stuff, which could be posted on the wiki as
> well as in final form here, and wherever else it may be appropriate,
> before it becomes an issue.

I'm thinking about publishing these in a more official place (as in,
on the website) soon.

> In a sense I don't even see these as "AI policies", just provenance,
> authorship-credit, honesty, license-honoring, etc. policies, but
> unfortunately it's "AI" that's made it necessary to spell them out
> explicitly. So, here's roughly what I have in mind:
> 
> 1. Please DO NOT submit "AI generated" code/patches for inclusion in
>    musl. These do not have clear authorship, are derived from models
>    that are clearly derived from a plethora of copyrighted works
>    without license or attribution, and thereby cannot be licensed by
>    the submitter. Being that most patch contributions to musl are
>    small and simple enough that it's dubious whether copyright applies
>    at all, this may not be an issue in all cases, but it's still
>    dishonest and wastes our time reviewing code that the submitter did
>    not write and does not have any reasonable basis to assume is
>    correct. Often the changes proposed by these models are blatently
>    incorrect and introduce bugs/vulns into previously-correct code.
> 
> 2. Please DO NOT submit "AI generated" or otherwise automated bug
>    reports without disclosing the provenance (or lack thereof). This
>    wastes everybody's time. If you are using tooling to identify
>    potential bugs, please either confirm before reporting that you
>    have actually found a bug (not just that the tool said it's a bug),
>    or clearly state in the report that it's unconfirmed, which tools
>    you used, and why you think the alleged bug may be legitimate -- or
>    if you don't know you're just asking whether it might be.
> 
> 3. Even being a permissive license, the MIT license requires
>    attribution and preservation of copyright notice. It thereby does
>    not permit incorporation of musl sources (or other MIT licensed
>    code) into models or derived outputs of models where the necessary
>    attribution and preservation of copyright notice are not possible.
> 
> Anything I'm missing or that seems like it should be changed?

A couple more I think should be added:

4. If, unaware of this policy, you first attempted using "AI" to
   produce code/patches intended for inclusion, please treat this
   situation as if you had read stolen/leaked proprietary code and
   cease further engagement with the relevant issue/enhancement. As
   long as you can commit to not doing it again, it doesn't preclude
   later contributing to the project elsewhere, but any further work
   on the area you already attempted with unknown-provenance code must
   be deemed tainted and unusable.

5. If you are or plan to be regularly contributing to musl, please try
   to avoid reviewing submissions (or non-upstreamed forks) made in
   violation of these policies. From a provenance standpoint, having
   engaged with code that someone else prompted the "AI" to generate
   is not a lot different from if you had prompted it yourself, and it
   likewise draws in to question the provenance of any overlapping
   work.

In some ways I think point 5 might be overly cautious, but I'd really
rather not have bad "AI" submissions followed up with a bunch of
attention reviewing them rather than just clean outright rejection.
Because then all the ideas that come out of the review are partly
derivative of what went into it. And, even with a policy that says no,
reviewing it gives a public impression that it's a matter open to
consideration.

Rich